s-ocando
commented
2 years ago Environment, RHEL9 system
I have used the generic/rhel9 vagrant box to create the testing environment.
# cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="9.0 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.0"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.0 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/red_hat_enterprise_linux/9/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.0
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.0"Requirements for RHEL9 SCA checks
requirements:
title: "Check RHEL9 family platform"
description: "Requirements for running the policy against RHEL 9 family."
condition: any
rules:
- "f:/etc/redhat-release -> r:^Red Hat Enterprise Linux && r:release 9"
- "f:/etc/redhat-release -> r:^Cloud && r:release 9"
- "f:/etc/redhat-release -> r:^Oracle && r:release 9"
- "f:/etc/redhat-release -> r:^Better && r:release 9"
- "f:/etc/redhat-release -> r:^OpenVZ && r:release 9"The requirement for running the "CIS Benchmark for Red Hat Enterprise Linux 9" policy is met. The content of /etc/redhat-release is:
# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.0 (Plow)SCA checks
Comparison between the CIS Red Hat Enterprise Linux 8 Benchmark v2.0.0 - 02-23-2022 and cis_rhel9_linux.yml
1 Initial Setup
1.1 Filesystem Configuration
1.1.1 Disable unused filesystems
1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Automated) 🔴
title: 🟢 description: 🟢 rationale: 🔴
"Removing support for unneeded filesystem types reduces the local attack surface of the server system. If this filesystem type is not needed, disable it."
Where it says server, it should say system.
remediation: 🟢 cis compliance: 🟢
Check:
[root@Wazuh vagrant]# modprobe -n -v cramfs
modprobe: FATAL: Module cramfs not found in directory /lib/modules/5.14.0-70.13.1.el9_0.x86_64
[root@Wazuh vagrant]# lsmod | grep cramfs
[root@Wazuh vagrant]# grep -E "^blacklist\s+cramfs" /etc/modprobe.d/*
[root@Wazuh vagrant]# Expected: PASS
Findings: 🔴
-
This check passes thanks to the additional condition included in
"c:modprobe -n -v cramfs -> r:install /bin/false|Module cramfs not found". According to the CIS Benchmark, themodprobe -n -v cramfsoutput should beinstall /bin/false, theModule cramfs not foundis not an accepted output.- The
cramfsmodule has been removed in RHEL9. As this module is no longer present, consider removing the "1.1.1.1 Ensure mounting of cramfs filesystems is disabled" check. See Considerations in adopting RHEL 9.
- The
-
There is no rule for the third check included in the CIS Red Hat Enterprise Linux 8 Benchmark:
grep -E "^blacklist\s+cramfs" /etc/modprobe.d/*
1.1.1.2 Ensure mounting of squashfs filesystems is disabled (Automated) 🔴
title: 🟢 description: 🟢 rationale: 🟢 remediation: 🟢 cis compliance: 🟢
Check:
[root@Wazuh vagrant]# modprobe -n -v squashfs | grep "^install"
[root@Wazuh vagrant]# lsmod | grep squashfs
[root@Wazuh vagrant]# grep -E "^blacklist\s+squashfs" /etc/modprobe.d/*Expected: FAIL
Findings: 🔴
-
There is no rule for the third check included in the CIS Red Hat Enterprise Linux 8 Benchmark:
grep -E "^blacklist\s+squashfs" /etc/modprobe.d/*- An additional condition
Module squashfs not found, not present in the CIS Benchmark, is included in the first rule"c:modprobe -n -v squashfs -> r:install /bin/true|Module squashfs not found"
1.1.1.3 Ensure mounting of udf filesystems is disabled (Automated) 🔴
- An additional condition
title: 🟢 description: 🟢 rationale: 🟢 remediation: 🟢 cis compliance: 🔴
- cis: ["1.1.1.4"] should be: - "1.1.1.3"
Check:
[root@Wazuh vagrant]# modprobe -n -v udf | grep "^install"
[root@Wazuh vagrant]# lsmod | grep udf
[root@Wazuh vagrant]# grep -E "^blacklist[[:blank:]]*udf" /etc/modprobe.d/*
[root@Wazuh vagrant]#Expected: FAIL
Findings: 🔴
-
There is no rule for the third check included in the CIS Red Hat Enterprise Linux 8 Benchmark:
grep -E "^blacklist[[:blank:]]*udf" /etc/modprobe.d/*- An additional condition
Module udf not found, not present in the CIS Benchmark, is included in the first rule"c:modprobe -n -v udf -> r:install /bin/true|Module udf not found"
1.1.2 Configure /tmp
1.1.2.1 Ensure /tmp is a separate partition (Automated)
- An additional condition
title: 🟢
description: 🟢
rationale: 🔴
"Making /tmp its own file system allows an administrator to set additional mount options such as the noexec option on the mount, making /tmp useless for an attacker to install executable code. It would also prevent an attacker from establishing a hard link to a system setuid program and wait for it to be updated. Once the program was updated, the hard link would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw. This can be accomplished by either mounting tmpfs to /tmp, or creating a separate partition for /tmp."
The highlighted text "additional mount options such as" is present in the CIS Benchmark and missing in cis_rhel9_linux.yml.
In addition, "hardlink" must be changed to "hard link".
remediation: 🟢 cis compliance: 🔴
- cis_csc: ["9.1"] should be cis_csc: ["4.8", "9.2"]
Check:
[root@Wazuh vagrant]# findmnt --kernel /tmp
[root@Wazuh vagrant]# systemctl is-enabled tmp.mount
disabledExpected: FAIL
1.1.2.2 Ensure nodev option set on /tmp partition (Automated) 🔴
title: 🟢 description: 🟢 rationale: 🔴
"Since the /tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create a block or character special devices in /tmp."
The crossed-out phrase attempt to should be deleted.
"create block" should be "create a block".
remediation: 🟢 cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /tmp | grep nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.2.3 Ensure noexec option set on /tmp partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /tmp | grep noexec
[root@Wazuh vagrant]# Expected: FAIL
1.1.2.4 Ensure nosuid option set on /tmp partition (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🔴
"Edit the /etc/fstab file and add nosuid to the fourth field (mounting options) for the /tmp partition. Example:
There is an extra space between /tmp and the quotation mark "...remount /tmp ". The period is missing.
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /tmp | grep nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.3 Configure /var
1.1.3.1 Ensure separate partition exists for /var (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🔴
"... the hard- link would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw."
"hard- link" should be "hard-link".
remediation: 🟢 cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var
[root@Wazuh vagrant]# Expected: FAIL
1.1.3.2 Ensure nodev option set on /var partition (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🔴
- cis: ["1.1.2.2"] should be 1.1.3.2
[root@Wazuh vagrant]# findmnt --kernel /var | grep nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.3.3 Ensure noexec option set on /var partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var | grep noexec
[root@Wazuh vagrant]# Expected: FAIL
1.1.3.4 Ensure nosuid option set on /var partition (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🔴
- cis: ["1.1.2.4"] should be 1.1.3.4
[root@Wazuh vagrant]# findmnt --kernel /var | grep nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.4 Configure /var/tmp
1.1.4.1 Ensure separate partition exists for /var/tmp (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🔴
"... the hard- link would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw."
"hard- link" should be "hard-link".
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/tmp
[root@Wazuh vagrant]# Expected: FAIL
1.1.4.2 Ensure noexec option set on /var/tmp partition (Automated) 🔴
title: 🟢 description: 🟢 rationale: 🟢 remediation: 🔴
"Edit the /etc/fstab file and add noexec to the fourth field (mounting options) for the /var/tmp partition."
The remediation field is incomplete. The following text is missing:
"Example:
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/tmp | grep noexec
[root@Wazuh vagrant]# Expected: FAIL
1.1.4.3 Ensure nosuid option set on /var/tmp partition (Automated) 🟢
title: 🟢 description: 🟢 rationale: 🟢 remediation: 🟢 cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/tmp | grep nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.4.4 Ensure nodev option set on /var/tmp partition (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🔴
"Since the /var/tmp filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create a block or character special devices in /var/tmp."
"...to ensure that users cannot attempt to create block..." should be "...to ensure that users cannot create a block..."
remediation: 🟢 cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/tmp | grep nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.5 Configure /var/log
1.1.5.1 Ensure separate partition exists for /var/log (Automated) 🔴
title: 🟢 description: 🟢 rationale: 🔴
"...the hard- link would be broken and the attacker would have..."
"hard- link" should be "hard-link".
remediation: 🟢 cis compliance: :yellow_circle:
- cis_csc: ["6.4", "8.3"] Usually the
cis_cscvalues follow the order [v8, v7]. In this case, they are inverted.
[root@Wazuh vagrant]# findmnt --kernel /var/log
[root@Wazuh vagrant]#
Expected: FAIL
1.1.5.2 Ensure nodev option set on /var/log partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/log | grep nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.5.3 Ensure noexec option set on /var/log partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/log | grep noexec
[root@Wazuh vagrant]# Expected: FAIL
1.1.5.4 Ensure nosuid option set on /var/log partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/log | grep nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.6 Configure /var/log/audit
1.1.6.1 Ensure separate partition exists for /var/log/audit (Automated) :yellow_circle:
title: 🟢
description: 🟢
rationale: :yellow_circle:
"...the hard- link would be broken and the attacker would have his own copy of the program..."
"hard- link" should be "hard-link".
remediation: 🟢 cis compliance: :yellow_circle:
- cis_csc: ["6.4", "8.3"] Usually the
cis_cscvalues follow the order [v8, v7]. In this case, they are inverted.
[root@Wazuh vagrant]# findmnt --kernel /var/log/audit
[root@Wazuh vagrant]# Expected: FAIL
1.1.6.2 Ensure noexec option set on /var/log/audit partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/log/audit | grep noexec
[root@Wazuh vagrant]# Expected: FAIL
1.1.6.3 Ensure nodev option set on /var/log/audit partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /var/log/audit | grep nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.6.4 Ensure nosuid option set on /var/log/audit partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance:
[root@Wazuh vagrant]# findmnt --kernel /var/log/audit | grep nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.7 Configure /home
1.1.7.1 Ensure separate partition exists for /home (Automated) 🔴
title: 🔴 "Ensure separate partition exists for /var/log/audit." should be "Ensure separate partition exists for /home."
description: 🟢 rationale: 🔴
"the hard- link would be broken and the attacker"
"hard- link" should be "hard-link".
remediation: 🟢 cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /home
[root@Wazuh vagrant]# Expected: FAIL
1.1.7.2 Ensure nodev option set on /home partition (Automated) :yellow_circle:
title: 🟢
description: 🟢
rationale: :yellow_circle: The rationales differ but the one in the cis_rhel9_linux.yml document seems to be the right one.
cis_rhel9_linux.yml: "Since the /home filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in /home." CIS Benchmark: "Since the /home filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in /var"
The CIS Red Hat Enterprise Linux 8 Benchmark v2.0.0 rationale seems to be incorrect as it refers to /var.
remediation: 🟢 cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /home | grep nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.7.3 Ensure nosuid option set on /home partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation:
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /home | grep nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.7.4 Ensure usrquota option set on /home partition (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🔴
"...Enable quotas on the partition: # quotaon -vug /home /dev/sdb [/home]: group quotas turned on /dev/sdb [/home]: user quotas turned on "
There is an extra space between on and the quotation mark "... turned on ". The period is missing.
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /home | grep usrquota
[root@Wazuh vagrant]# Expected: FAIL
Findings: 🔴
- The second audit command is missing. The
cis_rhel9_linux.ymlis only verifying that the usrquota option is set for the /home mount, but is not verifying that quotas is enabled.
# quotaon -p /home | grep user
user quota on /home (/dev/sdb) is on1.1.7.5 Ensure grpquota option set on /home partition (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🔴
"...group quotas turned on /dev/sdb [/home]: user quotas turned on "
There is an extra space between on and the quotation mark "... turned on ". The period is missing.
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /home | grep grpquota
[root@Wazuh vagrant]# Expected: FAIL
Findings: 🔴
- The second audit command is missing. The
cis_rhel9_linux.ymlis only verifying that the grpquota option is set, but is not verifying that quotas is enabled.
# quotaon -p /home | grep group
user quota on /home (/dev/sdb) is onThe output off the command seems to be wrong in the CIS benchmark document. Note that the command is looking for "group" which is not present in the output.
1.1.8 Configure /dev/shm
1.1.8.1 Ensure nodev option set on /dev/shm partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# mount | grep -E '\s/dev/shm\s' | grep -v nodev
[root@Wazuh vagrant]# Expected: FAIL
1.1.8.2 Ensure noexec option set on /dev/shm partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# findmnt --kernel /dev/shm | grep noexec
[root@Wazuh vagrant]# Expected: FAIL
1.1.8.3 Ensure nosuid option set on /dev/shm partition (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# mount | grep -E '\s/dev/shm\s' | grep -v nosuid
[root@Wazuh vagrant]# Expected: FAIL
1.1.9 Disable Automounting (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# systemctl is-enabled autofs
Failed to get unit file state for autofs.service: No such file or directoryExpected: PASS
1.1.10 Disable USB Storage (Automated) 🔴
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🔴
"Edit or create a file in the /etc/modprobe.d/ directory ending in .conf Example: vim /etc/modprobe.d/usb-storage.conf and add the following line: install usb-storage /bin/true Run the following command to unload the usb-storage module: # rmmod usb-storage"
There are extra spaces between "/bin/true" and "Run": "/bin/true`Run". In "...module: # rmmod..." the#` symbol is not present in the CIS Benchmark document. The period is missing.
cis compliance: 🟢
[root@Wazuh vagrant]# modprobe -n -v usb-storage
insmod /lib/modules/5.14.0-70.13.1.el9_0.x86_64/kernel/drivers/usb/storage/usb-storage.ko.xz Expected: PASS (With the current rule that does not correspond to the CIS Benchmark audit).
Findings:
- The current rule "c:modprobe -n -v usb-storage -> r:insdmod" expects a different output that the one included in the CIS benchmark document:
install usb-storage /bin/true.
1.2 Configure Software Updates
1.2.3 Ensure gpgcheck is globally activated (Automated) 🔴
title: 🟢 description: 🔴
"The gpgcheck option, found in the main section of the /etc/yum.conf /etc/dnf/dnf.conf and individual /etc/yum/repos.d/* files determines if an RPM package's signature is checked prior to its installation."
"/etc/yum.conf" should be "/etc/dnf/dnf.conf".
rationale: 🟢
remediation: 🔴
"Edit /etc/yum.conf and set ' gpgcheck=1 ' in the [main] section. Example: # sed -i 's/^gpgcheck\s=\s./gpgcheck=1/' /etc/dnf/dnf.conf Edit any failing files in /etc/yum.repos.d/ and set all instances of gpgcheck to ' 1 ' Example: # find /etc/yum.repos.d/ -name \".repo\" -exec echo \"Checking:\" {} \; -exec sed -i 's/^gpgcheck\s=\s./gpgcheck=1/' {} \;."
As in the description, "/etc/yum.conf" should be "/etc/dnf/dnf.conf".
cis compliance: :yellow_circle:
- cis_csc: ["3.4", "7.3"] is inverted, we usually follow the convention v8, v7.
[root@Wazuh vagrant]# grep ^gpgcheck /etc/dnf/dnf.conf
gpgcheck=1
[root@Wazuh vagrant]# grep -P "^gpgcheck\h*=\h*[^1].*\h*$" /etc/yum.repos.d/*
[root@Wazuh vagrant]#Expected: PASS
1.3 Filesystem Integrity Checking
1.3.1 Ensure AIDE is installed (Automated) 🟢
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🟢
cis compliance: 🟢
[root@Wazuh vagrant]# rpm -q aide
package aide is not installedExpected: FAIL
1.3.2 Ensure filesystem integrity is regularly checked (Automated) 🔴
This check is divided in A and B. Check A verifies that aidcheck.service and aidcheck.timer are enabled and that aidcheck.timer is running. On the other hand, check B verifies that a cron job is scheduled to run the aide check.
title: 🟢
description: 🟢
rationale: 🟢
remediation: 🔴
"If cron will be used to schedule and run aide check. Run the following command: # crontab -u root -e Add the following line to the crontab: 0 5 /usr/sbin/aide --check OR if aidecheck.service and aidecheck.timer will be used to schedule and run aide check: Create or edit the file /etc/systemd/system/aidecheck.service and add the following lines:[Unit] Description=Aide Check [Service] Type=simple ExecStart=/usr/sbin/aide --check [Install] WantedBy=multi-user.target. Create or edit the file /etc/systemd/system/aidecheck.timer and add the following lines: [Unit] Description=Aide check every day at 5AM [Timer] OnCalendar=-- 05:00:00 Unit=aidecheck.service [Install] WantedBy=multi-user.target. Run the following commands: # chown root:root /etc/systemd/system/aidecheck. # chmod 0644 /etc/systemd/system/aidecheck. # systemctl daemon-reload # systemctl enable aidecheck.service # systemctl --now enable aidecheck.timer"
The sentence and add the following lines is included in the CIS Benchmark document and is missing in the cis_rhel9_linux.yml remediation for "Ensure filesystem integrity is regularly checked (A)".
🔴 The remediation in the "Ensure filesystem integrity is regularly checked (B)" check differs from the one included in the CIS Benchmark document.
cis compliance: 🔴 Check A: 🟢 Check B: 🔴
- cis_csc: ["3.5"] should be cis_csc: ["3.14", "14.9"].
🔴 Note that pci_dss, nist_800_53 and tsc checks differ between check A and check B.
[root@Wazuh vagrant]# systemctl is-enabled aidecheck.service
Failed to get unit file state for aidecheck.service: No such file or directory
[root@Wazuh vagrant]# systemctl is-enabled aidecheck.timer
Failed to get unit file state for aidecheck.timer: No such file or directory
[root@Wazuh vagrant]# systemctl status aidecheck.timer
Unit aidecheck.timer could not be found.
[root@Wazuh vagrant]# crontab -u root -l
no crontab for root
[root@Wazuh vagrant]# grep -r aide /etc/cron.* /etc/crontabExpected: FAIL
Description
This issue aims to manually test the correct functioning of the SCA checks, report the results, and open new issues for any encountered errors.
OS:
RHEL9 (Red Hat Enterprise Linux 9)SCA policy file: cis_rhel9_linux.ymlTests
For each check in the SCA policy checks:
ymlfile.https://github.com/wazuh/wazuh/blob/b2e6e27b0fcf11959d6013c2bac725cbaaa84ed0/ruleset/sca/rhel/9/cis_rhel9_linux.yml#L35-L3922
The installers must also be tested:
Note that at this moment there is no CIS Benchmark for RHEL9 available. We will use RHEL8 CIS Benchmark as the base.
Test report procedure
Any failing test must be properly addressed with a new issue, detailing the error and the possible cause.
An extended report of the test results can be attached as a ZIP or TXT file. Please attach any documents, screenshots, or tables to the issue update with the results. This report can be used by the auditors to dig deeper into any possible failures and details.
SCA checks
Conclusions
All the results reported in this issue, as well as other observations, have been discussed with @72nomada and have been addressed in the following commits: