Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated V2R2 update with latest saf cli release #49

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

DMedina6
Copy link
Contributor

@DMedina6 DMedina6 commented Feb 10, 2025

This PR will update the RHEL8 repository to Version 2 Release 2 of the latest STIG guidance

Removed Controls:
SV-230348, SV-230349, SV-230350, SV-230353, SV-230368, SV-244537, SV-244540, SV-245540, SV-251717"

New Controls:
SV-268322: RHEL 8 must not allow blank or null passwords in the system-auth file.

Modified Controls:

SV-230233: Check text, SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS input values changed. SHA_CRYPT_MIN_ROUNDS" or "SHA_CRYPT_MAX_ROUNDS" is set, and this value is below "100000" (Previously "5000")

FIPS-140-2 --> FIPS-140-3

SV-230251: Check text, MACs entries to verify in opensshserver.config changed

SV-230252: Verify ciphers use FIPS-140-3 instead of FIPS-140-2 algorithms

SV-230253: Control now only applicable for RHEL versions 8.0 and 8.1

SV-230315: Minor check text changes, no revisions necessary

SV-230379: Command for checking system accounts changed from using sudo more to just the less command

SV-230470: Additional condition for determining if control is not applicable: 'If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not a finding.'

SV-230524, SV-244548: Additional conditions for verifying peripheral / USB device security

'If the USBGuard package is not installed, ask the SA to indicate how unauthorized peripherals are being blocked.
If there is no evidence that unauthorized peripherals are being blocked before establishing a connection, this is a finding.
If the system is a virtual machine with no virtual or physical USB peripherals attached, this is not a finding.'

SV-230548: Removes note in check text specifying that control is not applicable if containers are in use

SV-230559: Additional condition specifying whether results are a finding for control: 'If NFS mounts are being used, this is not a finding'

SV-244527: Additional note specifying that requirement not applicable for RHEL versions 8.4 and above

SV-244547: New note specifying requirement not applicable for virtual machines with no virtual or physical USB devices attached.

SV-257728: Idle user session length lowered from 900 to 600 seconds, control now only applicable to RHEL versions 8.7 and higher

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants