Merge pull request #12345 from Mab879/hipaa_rhel10_updates

RHEL 10 HIPAA Profile Updates
ComplianceAsCode · Aug 28, 2024 · c4a694e · c4a694e
2 parents 6e02c99 + fc2c9ff
commit c4a694e
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/controls/hipaa.yml b/controls/hipaa.yml
@@ -533,6 +533,7 @@ controls:
             - restrict_serial_port_logins
             - securetty_root_login_console_only
             - enable_authselect
+            - var_authselect_profile=sssd
             - file_groupowner_grub2_cfg
             - file_groupowner_user_cfg
             - file_owner_grub2_cfg
@@ -640,7 +641,7 @@ controls:
             - sshd_enable_warning_banner
             - sshd_enable_warning_banner_net
             - sshd_set_keepalive
-            - sshd_set_keepalive_0
+            - var_sshd_set_keepalive=1
             - sshd_use_approved_ciphers
             - sshd_use_approved_macs
             - sshd_use_priv_separation
@@ -944,6 +945,8 @@ controls:
             - selinux_confinement_of_daemons
             - selinux_policytype
             - selinux_state
+            - var_selinux_policy_name=targeted
+            - var_selinux_state=enforcing
             - dconf_gnome_remote_access_credential_prompt
             - dconf_gnome_remote_access_encryption
         status: automated
@@ -1138,6 +1141,7 @@ controls:
         levels:
             - required
         rules:
+            - var_audit_failure_mode=panic
             - audit_rules_dac_modification_chmod
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod

diff --git a/products/rhel10/profiles/hipaa.profile b/products/rhel10/profiles/hipaa.profile
@@ -39,8 +39,15 @@ selections:
     - '!sshd_use_approved_ciphers'
     - '!accounts_passwords_pam_tally2'
     - '!package_audit-audispd-plugins_installed'
+    - '!auditd_audispd_syslog_plugin_activated'
     - '!package_ypserv_removed'
     - '!package_ypbind_removed'
     - '!package_xinetd_removed'
     - '!package_rsh_removed'
     - '!package_rsh-server_removed'
+    - '!package_tcp_wrappers_removed'
+    - '!package_xinetd_removed'
+    - '!service_xinetd_disabled'
+    - '!sshd_allow_only_protocol2'
+    - '!sshd_disable_kerb_auth'
+    - '!sshd_disable_gssapi_auth'