diff --git a/CHANGELOG b/CHANGELOG index 35406db22bdaba0f06f9f27fcaa4bfc9124fe2c5..01ad0d2afc965d902ed76d03919c04b2206f7930 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -43,7 +43,7 @@ - Anolis OS 8及其最佳安全基线已经完成与国际知名社区——OpenSCAP的映射与适配，并被OpenSCAP社区合入，详见OpenSCAP社区Anolis OS 8 standard.profile - 新增若干条最佳安全基线规则（benchmark）及对应的修复和检测脚本 - 部分安全基线及配套的修复和检测脚本适配ARM架构 -- 修复工具和扫描工具中添加了参考等保2.0三级及CIS相关规则的config文件，并更新自述文件，添加使用说明 +- 修复工具和扫描工具中添加了参考等保2.0三级相关规则的config文件，并更新自述文件，添加使用说明 - 新增summary-of-rules.md文件（benchmark汇总表） - 修复Anolis OS 8最佳安全实践基线v1.1.0的若干bugs, 发布Anolis OS 8最佳安全实践基线v1.2.0 diff --git a/README.md b/README.md index 472580264d87368be1135c8afdec11432dfd438d..159a360a373b615326661933aef5bdd4ad89986e 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # security-benchmark -security-benchmark 是龙蜥下游各个厂商结合自己在安全合规/加固领域（包括国内的等保、国外的 CIS 等）的大规模产品落地经验和实践打造的龙蜥社区最佳安全加固实践指南，它包括安全基线（benchmark）、扫描脚本、修复脚本、安全合规镜像制作、安全合规监控等多个方面。其中，Anolis OS 8 、Anolis OS 23 及其最佳安全基线已经完成与[OpenSCAP国际知名社区](https://github.com/ComplianceAsCode/content)的映射与适配，并被OpenSCAP社区合入，详见： +security-benchmark 是龙蜥下游各个厂商结合自己在安全合规/加固领域的大规模产品落地经验和实践打造的龙蜥社区最佳安全加固实践指南，它包括安全基线（benchmark）、扫描脚本、修复脚本、安全合规镜像制作、安全合规监控等多个方面。其中，Anolis OS 8 、Anolis OS 23 及其最佳安全基线已经完成与[OpenSCAP国际知名社区](https://github.com/ComplianceAsCode/content)的映射与适配，并被OpenSCAP社区合入，详见： - [OpenSCAP社区Anolis OS 8 standard.profile](https://github.com/ComplianceAsCode/content/blob/master/products/anolis8/profiles/standard.profile) - [OpenSCAP社区Anolis OS 23 standard.profile](https://github.com/ComplianceAsCode/content/blob/master/products/anolis23/profiles/standard.profile) diff --git a/benchmarks/access-and-control/1.1-ensure-cron-daemon-is-enabled.md b/benchmarks/access-and-control/1.1-ensure-cron-daemon-is-enabled.md index 27e84b6040cadbb4b81ff2ea3145e04da11214de..4722a71a08f68beee7b66aae249aaf89902ad790 100644 --- a/benchmarks/access-and-control/1.1-ensure-cron-daemon-is-enabled.md +++ b/benchmarks/access-and-control/1.1-ensure-cron-daemon-is-enabled.md @@ -35,4 +35,3 @@ enabled ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.10-ensure-ssh-access-is-limited.md b/benchmarks/access-and-control/1.10-ensure-ssh-access-is-limited.md index 6be068b5fc41b6907fd73e2e139453ae4c5e2084..10e5b449f4f88fe56c2c81b6d2f3bc0da4fb9ba2 100644 --- a/benchmarks/access-and-control/1.10-ensure-ssh-access-is-limited.md +++ b/benchmarks/access-and-control/1.10-ensure-ssh-access-is-limited.md @@ -63,4 +63,3 @@ denygroups ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.11-ensure-permissions-on-ssh-private-host-key-files-are-configured.md b/benchmarks/access-and-control/1.11-ensure-permissions-on-ssh-private-host-key-files-are-configured.md index c0e88f8166be3ef8c7352cd6a947bc5ff4f96ea3..f65c104416798e7ddd15d9f3cef370edf7edda54 100644 --- a/benchmarks/access-and-control/1.11-ensure-permissions-on-ssh-private-host-key-files-are-configured.md +++ b/benchmarks/access-and-control/1.11-ensure-permissions-on-ssh-private-host-key-files-are-configured.md @@ -59,4 +59,3 @@ Change: 2018-10-22 18:24:56.873750616 +0000 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.12-ensure-permissions-on-ssh-public-host-key-files-are-configured.md b/benchmarks/access-and-control/1.12-ensure-permissions-on-ssh-public-host-key-files-are-configured.md index 046fca6e4470c6cd283fc1a9639c158f74c0ae44..58be78288b4f462b0a923648e59583f22d4143f2 100644 --- a/benchmarks/access-and-control/1.12-ensure-permissions-on-ssh-public-host-key-files-are-configured.md +++ b/benchmarks/access-and-control/1.12-ensure-permissions-on-ssh-public-host-key-files-are-configured.md @@ -47,4 +47,3 @@ Change: 2022-05-25 16:38:17.255207117 +0800 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.13-ensure-ssh-loglevel-is-appropriate.md b/benchmarks/access-and-control/1.13-ensure-ssh-loglevel-is-appropriate.md index 6a947054a9fad1f88b79c04943e3374e53687371..ab89b9f44ec733d578e5520f68766b9037de6fda 100644 --- a/benchmarks/access-and-control/1.13-ensure-ssh-loglevel-is-appropriate.md +++ b/benchmarks/access-and-control/1.13-ensure-ssh-loglevel-is-appropriate.md @@ -52,4 +52,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.14-ensure-ssh-maxauthtries-is-set-to-4-or-less.md b/benchmarks/access-and-control/1.14-ensure-ssh-maxauthtries-is-set-to-4-or-less.md index db311494cf0e6777e8727dd40239e173e65c0532..e1b4696be4ac86f4711d353f75f518f7ea8973ef 100644 --- a/benchmarks/access-and-control/1.14-ensure-ssh-maxauthtries-is-set-to-4-or-less.md +++ b/benchmarks/access-and-control/1.14-ensure-ssh-maxauthtries-is-set-to-4-or-less.md @@ -39,4 +39,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.15-ensure-ssh-ignorerhosts-is-enabled.md b/benchmarks/access-and-control/1.15-ensure-ssh-ignorerhosts-is-enabled.md index c68f94ea9e3503bfd19ba08f9214420f39710d21..4a90dae26d43d838418aee06bd6ca82edf520b15 100644 --- a/benchmarks/access-and-control/1.15-ensure-ssh-ignorerhosts-is-enabled.md +++ b/benchmarks/access-and-control/1.15-ensure-ssh-ignorerhosts-is-enabled.md @@ -41,4 +41,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.16-ensure-ssh-hostbasedauthentication-is-disabled.md b/benchmarks/access-and-control/1.16-ensure-ssh-hostbasedauthentication-is-disabled.md index 24592afaa8b0128395fb053d4e1d0d198bcd5e5b..7072746ba17d8051f71fa4be854301af31696306 100644 --- a/benchmarks/access-and-control/1.16-ensure-ssh-hostbasedauthentication-is-disabled.md +++ b/benchmarks/access-and-control/1.16-ensure-ssh-hostbasedauthentication-is-disabled.md @@ -39,4 +39,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.17-ensure-ssh-root-login-is-disabled.md b/benchmarks/access-and-control/1.17-ensure-ssh-root-login-is-disabled.md index f2eef08597f7dac116cf93c4205d8db6e07bd2b0..3a9e26797282984caf136205cccde66fa068f886 100644 --- a/benchmarks/access-and-control/1.17-ensure-ssh-root-login-is-disabled.md +++ b/benchmarks/access-and-control/1.17-ensure-ssh-root-login-is-disabled.md @@ -39,4 +39,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.18-ensure-ssh-permitemptypasswords-is-disabled.md b/benchmarks/access-and-control/1.18-ensure-ssh-permitemptypasswords-is-disabled.md index 235799b4be89040687792b890973cdcaa37c6420..19a92282aabbcd44d7f2a7c7e8219d6e63470353 100644 --- a/benchmarks/access-and-control/1.18-ensure-ssh-permitemptypasswords-is-disabled.md +++ b/benchmarks/access-and-control/1.18-ensure-ssh-permitemptypasswords-is-disabled.md @@ -39,4 +39,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.19-ensure-ssh-permituserenvironment-is-disabled.md b/benchmarks/access-and-control/1.19-ensure-ssh-permituserenvironment-is-disabled.md index 424e48561dbf863734fc0f14c0cdea828d9460b1..e8f16d503ba92523d455dd0bfa89be8d4e53588b 100644 --- a/benchmarks/access-and-control/1.19-ensure-ssh-permituserenvironment-is-disabled.md +++ b/benchmarks/access-and-control/1.19-ensure-ssh-permituserenvironment-is-disabled.md @@ -38,4 +38,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.2-ensure-permissions-on-etc-crontab-are-configured.md b/benchmarks/access-and-control/1.2-ensure-permissions-on-etc-crontab-are-configured.md index b48c8cb1c4b3389a4a971d7d9402eb68514f5105..52e802a024292e42e19f563cb33914e445cf7a73 100644 --- a/benchmarks/access-and-control/1.2-ensure-permissions-on-etc-crontab-are-configured.md +++ b/benchmarks/access-and-control/1.2-ensure-permissions-on-etc-crontab-are-configured.md @@ -36,4 +36,3 @@ Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.20-ensure-ssh-idle-timeout-interval-is-configured.md b/benchmarks/access-and-control/1.20-ensure-ssh-idle-timeout-interval-is-configured.md index 4fca251e3ecd8115dcc65fc8088ee95764188249..1b919a318697ec6526d9a6d007b31f27e4634ca9 100644 --- a/benchmarks/access-and-control/1.20-ensure-ssh-idle-timeout-interval-is-configured.md +++ b/benchmarks/access-and-control/1.20-ensure-ssh-idle-timeout-interval-is-configured.md @@ -69,4 +69,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.21-ensure-ssh-logingracetime-is-set-to-one-minute-or-less.md b/benchmarks/access-and-control/1.21-ensure-ssh-logingracetime-is-set-to-one-minute-or-less.md index 333a4aaff12026d14a6a0e354ab9c780b3c0ba74..37670b51b617b7d5dbab2c345da12a55f5f2835c 100644 --- a/benchmarks/access-and-control/1.21-ensure-ssh-logingracetime-is-set-to-one-minute-or-less.md +++ b/benchmarks/access-and-control/1.21-ensure-ssh-logingracetime-is-set-to-one-minute-or-less.md @@ -39,4 +39,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.22-ensure-ssh-warning-banner-is-configured.md b/benchmarks/access-and-control/1.22-ensure-ssh-warning-banner-is-configured.md index 8dd5de79d8d040cef2dcc41670f95de57fd24a63..7d0dfbbd3b0220fd33b7082cedc646e660c30853 100644 --- a/benchmarks/access-and-control/1.22-ensure-ssh-warning-banner-is-configured.md +++ b/benchmarks/access-and-control/1.22-ensure-ssh-warning-banner-is-configured.md @@ -38,4 +38,3 @@ banner /etc/issue.net ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.23-ensure-ssh-pam-is-enabled.md b/benchmarks/access-and-control/1.23-ensure-ssh-pam-is-enabled.md index e20dd2cdb5c377cfda25cc406d5b5370f7c3b5d3..59ed559781366e7c1620cf5ea6460695f5bb7b7e 100644 --- a/benchmarks/access-and-control/1.23-ensure-ssh-pam-is-enabled.md +++ b/benchmarks/access-and-control/1.23-ensure-ssh-pam-is-enabled.md @@ -42,4 +42,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.24-ensure-ssh-maxstartups-is-configured.md b/benchmarks/access-and-control/1.24-ensure-ssh-maxstartups-is-configured.md index 428fb7397daac08bb50557f49e1c6734f43b24a3..ee0e30292904f1b334d86af5174714bd5f5f0886 100644 --- a/benchmarks/access-and-control/1.24-ensure-ssh-maxstartups-is-configured.md +++ b/benchmarks/access-and-control/1.24-ensure-ssh-maxstartups-is-configured.md @@ -49,4 +49,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.25-ensure-ssh-maxsessions-is-set-to-10-or-less.md b/benchmarks/access-and-control/1.25-ensure-ssh-maxsessions-is-set-to-10-or-less.md index 5ddb7089fe2c27bcc47a8838efb9a77156c7adc9..c59b70c5f7182916d2cb842d6f1e93fbf14f808f 100644 --- a/benchmarks/access-and-control/1.25-ensure-ssh-maxsessions-is-set-to-10-or-less.md +++ b/benchmarks/access-and-control/1.25-ensure-ssh-maxsessions-is-set-to-10-or-less.md @@ -39,4 +39,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.26-ensure-system-wide-crypto-policy-is-not-over-ridden.md b/benchmarks/access-and-control/1.26-ensure-system-wide-crypto-policy-is-not-over-ridden.md index e15133ec9e2095e1af4fb86f9db4dfaf36a9f670..3e910c5499a73673ed886f46fcc3586f95895cb1 100644 --- a/benchmarks/access-and-control/1.26-ensure-system-wide-crypto-policy-is-not-over-ridden.md +++ b/benchmarks/access-and-control/1.26-ensure-system-wide-crypto-policy-is-not-over-ridden.md @@ -41,4 +41,3 @@ Nothing is returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md b/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md index b02612c261b9e8e72ef635658e1e9a1569ac899c..f565fe93655b18aaa1ce9697650307554dfa344f 100644 --- a/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md +++ b/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md @@ -88,4 +88,3 @@ ocredit=-1 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md b/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md index 64874fad8bee7fc245c619855e68a29e86adaa01..59037f53e8593d94e21b79f0817d1fbbaa2a2bf6 100644 --- a/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md +++ b/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md @@ -47,4 +47,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md b/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md index f2be6e304edd045cc16214251649f86819fce840..8bf6c5881f32042da4f241c1cf41adafe37879ad 100644 --- a/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md +++ b/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md @@ -47,4 +47,3 @@ password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 s ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.3-ensure-permissions-on-etc-cron.hourly-are-configured.md b/benchmarks/access-and-control/1.3-ensure-permissions-on-etc-cron.hourly-are-configured.md index 11e6f884f5b6bde3c01c578994f395c596a80181..9453994ac496a72c784570cb89531e46b01e8170 100644 --- a/benchmarks/access-and-control/1.3-ensure-permissions-on-etc-cron.hourly-are-configured.md +++ b/benchmarks/access-and-control/1.3-ensure-permissions-on-etc-cron.hourly-are-configured.md @@ -36,4 +36,3 @@ Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md b/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md index 9ad17a0c826524d1fb5f0fdf8b82cb223124f212..ab6aaf133d0fab9a1526dee4aa8176251be20b90 100644 --- a/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md +++ b/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md @@ -36,4 +36,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.31-ensure-password-expiration-is-365-days-or-less.md b/benchmarks/access-and-control/1.31-ensure-password-expiration-is-365-days-or-less.md index f0b9340f47aa1217c93001dd8f406d39e7f2571d..197aa75a60495836eb04c6747b06a88757d3ddd1 100644 --- a/benchmarks/access-and-control/1.31-ensure-password-expiration-is-365-days-or-less.md +++ b/benchmarks/access-and-control/1.31-ensure-password-expiration-is-365-days-or-less.md @@ -50,4 +50,3 @@ PASS_MAX_DAYS 365 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.32-ensure-minimum-days-between-password-changes-is-7-or-more.md b/benchmarks/access-and-control/1.32-ensure-minimum-days-between-password-changes-is-7-or-more.md index a4f7877ac6a2e06e993750b7451b6ae84a61296d..0d8c605d9e0e265c388464edace4d4064232b011 100644 --- a/benchmarks/access-and-control/1.32-ensure-minimum-days-between-password-changes-is-7-or-more.md +++ b/benchmarks/access-and-control/1.32-ensure-minimum-days-between-password-changes-is-7-or-more.md @@ -52,4 +52,3 @@ PASS_MIN_DAYS 7 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.33-ensure-password-expiration-warning-days-is-7-or-more.md b/benchmarks/access-and-control/1.33-ensure-password-expiration-warning-days-is-7-or-more.md index a2241a38221c71ee63019a96269b714fff1f2cdb..51817a5cbac7f0bf82ed61dcb220f09558f7f4ff 100644 --- a/benchmarks/access-and-control/1.33-ensure-password-expiration-warning-days-is-7-or-more.md +++ b/benchmarks/access-and-control/1.33-ensure-password-expiration-warning-days-is-7-or-more.md @@ -52,4 +52,3 @@ PASS_WARN_AGE 7 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.34-ensure-inactive-password-lock-is-30-days-or-less.md b/benchmarks/access-and-control/1.34-ensure-inactive-password-lock-is-30-days-or-less.md index 8378584f696790102e692ae832f326a2ea7970e3..0736562bf6be7ac54ae4e0ac6299fbc035de5e9b 100644 --- a/benchmarks/access-and-control/1.34-ensure-inactive-password-lock-is-30-days-or-less.md +++ b/benchmarks/access-and-control/1.34-ensure-inactive-password-lock-is-30-days-or-less.md @@ -50,4 +50,3 @@ INACTIVE=30 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.35-ensure-all-users-last-password-change-date-is-in-the-past.md b/benchmarks/access-and-control/1.35-ensure-all-users-last-password-change-date-is-in-the-past.md index 9d87b81b24b7752d627113b1688e18f5932a8f10..e4c24e5a636aa281393e2699599a6598c59be176 100644 --- a/benchmarks/access-and-control/1.35-ensure-all-users-last-password-change-date-is-in-the-past.md +++ b/benchmarks/access-and-control/1.35-ensure-all-users-last-password-change-date-is-in-the-past.md @@ -38,4 +38,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.36-ensure-system-accounts-are-secured.md b/benchmarks/access-and-control/1.36-ensure-system-accounts-are-secured.md index bd51b84c2a1b516deb7e2dfba79d151af0d059c3..6d675c3c8012936891be259b6cbae4c4b0418167 100644 --- a/benchmarks/access-and-control/1.36-ensure-system-accounts-are-secured.md +++ b/benchmarks/access-and-control/1.36-ensure-system-accounts-are-secured.md @@ -50,4 +50,3 @@ No file should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.37-ensure-default-user-shell-timeout-is-900-seconds-or-less.md b/benchmarks/access-and-control/1.37-ensure-default-user-shell-timeout-is-900-seconds-or-less.md index 130e12a3b1591958368b8f2c75af86d5083ea9e9..2ae25a074e794a838b277d70c396a4b94bd8601c 100644 --- a/benchmarks/access-and-control/1.37-ensure-default-user-shell-timeout-is-900-seconds-or-less.md +++ b/benchmarks/access-and-control/1.37-ensure-default-user-shell-timeout-is-900-seconds-or-less.md @@ -83,4 +83,3 @@ TMOUT is configured in: "/etc/profile.d/login.sh" ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.38-ensure-default-group-for-the-root-account-is-gid-0.md b/benchmarks/access-and-control/1.38-ensure-default-group-for-the-root-account-is-gid-0.md index a204c9f2df6eb27eb57fb4cb53f7691cbc1d21b6..c78f91016587da107d4d2676d50973b862c4c4c1 100644 --- a/benchmarks/access-and-control/1.38-ensure-default-group-for-the-root-account-is-gid-0.md +++ b/benchmarks/access-and-control/1.38-ensure-default-group-for-the-root-account-is-gid-0.md @@ -32,4 +32,3 @@ usermod -g 0 root ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.md b/benchmarks/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.md index da2e985385cf99218cda238a98cf05e09370e792..da34d62725f03e122c9c203067066ab1bfea296e 100644 --- a/benchmarks/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.md +++ b/benchmarks/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.md @@ -107,4 +107,3 @@ No file should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.4-ensure-permissions-on-etc-cron.daily-are-configured.md b/benchmarks/access-and-control/1.4-ensure-permissions-on-etc-cron.daily-are-configured.md index 5c9cc40eb93e463394b91bfbec2a294e47ac098f..ae4b4ded0f76898c188b0060f538c1ad2d30238a 100644 --- a/benchmarks/access-and-control/1.4-ensure-permissions-on-etc-cron.daily-are-configured.md +++ b/benchmarks/access-and-control/1.4-ensure-permissions-on-etc-cron.daily-are-configured.md @@ -36,4 +36,3 @@ Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.40-ensure-access-to-the-su-command-is-restricted.md b/benchmarks/access-and-control/1.40-ensure-access-to-the-su-command-is-restricted.md index 2804b159cae225e7478bcbfcc5f14c2fc5483b74..7cfc31eb201e9521a2d8f07bb8f39eda25b5e8fa 100644 --- a/benchmarks/access-and-control/1.40-ensure-access-to-the-su-command-is-restricted.md +++ b/benchmarks/access-and-control/1.40-ensure-access-to-the-su-command-is-restricted.md @@ -50,4 +50,3 @@ wheel:x:10: ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.5-ensure-permissions-on-etc-cron.weekly-are-configured.md b/benchmarks/access-and-control/1.5-ensure-permissions-on-etc-cron.weekly-are-configured.md index fe3f40ab3a87a32ba730a7ce5fb4f492959d9695..27fb5168553ed2f0eccde633c7e0bbc66fcd04b8 100644 --- a/benchmarks/access-and-control/1.5-ensure-permissions-on-etc-cron.weekly-are-configured.md +++ b/benchmarks/access-and-control/1.5-ensure-permissions-on-etc-cron.weekly-are-configured.md @@ -36,4 +36,3 @@ Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.50-ensure-ssh-x11-forwarding-is-disabled.md b/benchmarks/access-and-control/1.50-ensure-ssh-x11-forwarding-is-disabled.md index 204807150fb4bf10950e571a8f27910e687001b7..d34a4c591dfd0bedd29ffb5b9736f4eea5585049 100644 --- a/benchmarks/access-and-control/1.50-ensure-ssh-x11-forwarding-is-disabled.md +++ b/benchmarks/access-and-control/1.50-ensure-ssh-x11-forwarding-is-disabled.md @@ -41,4 +41,3 @@ Nothing is returned ## 参考 -- cis: diff --git a/benchmarks/access-and-control/1.51-ensure-mounting-of-udf-filesystems-is-disabled.md b/benchmarks/access-and-control/1.51-ensure-mounting-of-udf-filesystems-is-disabled.md index 2ee45d0a03c255f86de84adc880f960e87308295..85564cfcdb9faca61c67c77652e40d15da8e8ddd 100644 --- a/benchmarks/access-and-control/1.51-ensure-mounting-of-udf-filesystems-is-disabled.md +++ b/benchmarks/access-and-control/1.51-ensure-mounting-of-udf-filesystems-is-disabled.md @@ -60,4 +60,3 @@ install /bin/false ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.52-ensure-mounting-of-cramfs-filesystems-is-diasbled.md b/benchmarks/access-and-control/1.52-ensure-mounting-of-cramfs-filesystems-is-diasbled.md index 45d45f1528d6d8ceac38d1eb9c992e14c7437edd..cbf0834586bfb0ca79541e4da25a137bac9ac0f1 100644 --- a/benchmarks/access-and-control/1.52-ensure-mounting-of-cramfs-filesystems-is-diasbled.md +++ b/benchmarks/access-and-control/1.52-ensure-mounting-of-cramfs-filesystems-is-diasbled.md @@ -54,4 +54,3 @@ blacklist cramfs ## 参考 -- cis: diff --git a/benchmarks/access-and-control/1.53-ensure-mounting-of-squashfs-filesystems-is-disabled.md b/benchmarks/access-and-control/1.53-ensure-mounting-of-squashfs-filesystems-is-disabled.md index ca06c7f881336c280d75299626882ce6af816f91..56cd1adeca5467ff7461af93f0413e5c78da319a 100644 --- a/benchmarks/access-and-control/1.53-ensure-mounting-of-squashfs-filesystems-is-disabled.md +++ b/benchmarks/access-and-control/1.53-ensure-mounting-of-squashfs-filesystems-is-disabled.md @@ -57,4 +57,3 @@ install /bin/false ## 参考 -- cis: https://www.cisecurity.org/benchmark/aliyun_linux \ No newline at end of file diff --git a/benchmarks/access-and-control/1.6-ensure-permissions-on-etc-cron.monthly-are-configured.md b/benchmarks/access-and-control/1.6-ensure-permissions-on-etc-cron.monthly-are-configured.md index 929138256b3e6b4f07bbeeae86bc5ecda4f5844f..8885c4e883d3cbcdd37c1a9f3ff6f35f7f166e3b 100644 --- a/benchmarks/access-and-control/1.6-ensure-permissions-on-etc-cron.monthly-are-configured.md +++ b/benchmarks/access-and-control/1.6-ensure-permissions-on-etc-cron.monthly-are-configured.md @@ -36,4 +36,3 @@ Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.7-ensure-permissions-on-etc-cron.d-are-configured.md b/benchmarks/access-and-control/1.7-ensure-permissions-on-etc-cron.d-are-configured.md index 02295705d3dc5f8e63ef47be03c69881feeaa450..551c8e899ec2b26372619530288d2bc9043f3d43 100644 --- a/benchmarks/access-and-control/1.7-ensure-permissions-on-etc-cron.d-are-configured.md +++ b/benchmarks/access-and-control/1.7-ensure-permissions-on-etc-cron.d-are-configured.md @@ -36,4 +36,3 @@ Access: (0700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.8-ensure-at-cron-is-restricted-to-authorized-users.md b/benchmarks/access-and-control/1.8-ensure-at-cron-is-restricted-to-authorized-users.md index 6dd8c990191477499db957293d87512ba44437ee..6b47682aa0d14a8f941fd4614bc5155736f104c2 100644 --- a/benchmarks/access-and-control/1.8-ensure-at-cron-is-restricted-to-authorized-users.md +++ b/benchmarks/access-and-control/1.8-ensure-at-cron-is-restricted-to-authorized-users.md @@ -64,4 +64,3 @@ Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/access-and-control/1.9-ensure-permissions-on-etc-ssh-sshd_config-are-configured.md b/benchmarks/access-and-control/1.9-ensure-permissions-on-etc-ssh-sshd_config-are-configured.md index ebb51276781715528508f55cb5605cb49454db71..2bc1987db53be28bc897b88dbf861efe99b9317f 100644 --- a/benchmarks/access-and-control/1.9-ensure-permissions-on-etc-ssh-sshd_config-are-configured.md +++ b/benchmarks/access-and-control/1.9-ensure-permissions-on-etc-ssh-sshd_config-are-configured.md @@ -36,4 +36,3 @@ Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.1-ensure-audit-log-files-are-not-read-or-write-accessible-by-unauthorized-users.md b/benchmarks/logging-and-auditing/2.1-ensure-audit-log-files-are-not-read-or-write-accessible-by-unauthorized-users.md index f5cac3eef3d58cc6d7189251a99e590493d34b8e..cbed9f60ff76d45a546f5fb2d000ec88ff34704f 100644 --- a/benchmarks/logging-and-auditing/2.1-ensure-audit-log-files-are-not-read-or-write-accessible-by-unauthorized-users.md +++ b/benchmarks/logging-and-auditing/2.1-ensure-audit-log-files-are-not-read-or-write-accessible-by-unauthorized-users.md @@ -49,4 +49,3 @@ log_file = /var/log/audit/audit.log ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.10-ensure-audit-tools-are-group-owned-by-root.md b/benchmarks/logging-and-auditing/2.10-ensure-audit-tools-are-group-owned-by-root.md index 381be25839f95e89c7ea4df31f0b588e93e37c1c..32b356c7068e748fc96cd4ecb2376404c3a48ef4 100644 --- a/benchmarks/logging-and-auditing/2.10-ensure-audit-tools-are-group-owned-by-root.md +++ b/benchmarks/logging-and-auditing/2.10-ensure-audit-tools-are-group-owned-by-root.md @@ -45,4 +45,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.11-ensure-cryptographic-mechanisms-are-used-to-protect-the-integrity-of-audit-tools.md b/benchmarks/logging-and-auditing/2.11-ensure-cryptographic-mechanisms-are-used-to-protect-the-integrity-of-audit-tools.md index 47886c1e62be4535bb4b4950e8b5e4e2b64d3529..5cbadf6cb513dbeac0ed42d7b89a88d01cbac97e 100644 --- a/benchmarks/logging-and-auditing/2.11-ensure-cryptographic-mechanisms-are-used-to-protect-the-integrity-of-audit-tools.md +++ b/benchmarks/logging-and-auditing/2.11-ensure-cryptographic-mechanisms-are-used-to-protect-the-integrity-of-audit-tools.md @@ -50,4 +50,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.12-ensure-rsyslog-is-installed.md b/benchmarks/logging-and-auditing/2.12-ensure-rsyslog-is-installed.md index 5054f676f2f4e5bcda97f460fb6d12664821622d..8b737c15ff4aa9a89d7cabfcd1f0b29c7c9bd0ef 100644 --- a/benchmarks/logging-and-auditing/2.12-ensure-rsyslog-is-installed.md +++ b/benchmarks/logging-and-auditing/2.12-ensure-rsyslog-is-installed.md @@ -35,4 +35,3 @@ rsyslog- ## 参考 -- cis: diff --git a/benchmarks/logging-and-auditing/2.13-ensure-rsyslog-service-is-enabled.md b/benchmarks/logging-and-auditing/2.13-ensure-rsyslog-service-is-enabled.md index 6c22390e826007d6c7fede97d2dc6a6925e5025e..970d24fbcce3c4f69bc0311085fd41c17daaf041 100644 --- a/benchmarks/logging-and-auditing/2.13-ensure-rsyslog-service-is-enabled.md +++ b/benchmarks/logging-and-auditing/2.13-ensure-rsyslog-service-is-enabled.md @@ -35,4 +35,3 @@ enabled ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.md b/benchmarks/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.md index 56d471098dee596308f2a254019104cfff9d3210..92fffe341c147640cf60a65411afcfeeedc8db53 100644 --- a/benchmarks/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.md +++ b/benchmarks/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.md @@ -37,4 +37,3 @@ rsyslog 服务会生成新的日志文件，以下配置的作用在于控制这 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.15-ensure-rsyslog-is-configured-to-send-logs-to-a-remote-log-host.md b/benchmarks/logging-and-auditing/2.15-ensure-rsyslog-is-configured-to-send-logs-to-a-remote-log-host.md index 7f6372884e3557b194bff4da62d233e6238dde7a..9655c02d132669e186db528d28c33507237d4457 100644 --- a/benchmarks/logging-and-auditing/2.15-ensure-rsyslog-is-configured-to-send-logs-to-a-remote-log-host.md +++ b/benchmarks/logging-and-auditing/2.15-ensure-rsyslog-is-configured-to-send-logs-to-a-remote-log-host.md @@ -37,4 +37,3 @@ rsyslog 工具支持将其收集的日志发送到运行 syslogd(8) 的远程日 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.16-ensure-journald-is-configured-to-send-logs-to-rsyslog.md b/benchmarks/logging-and-auditing/2.16-ensure-journald-is-configured-to-send-logs-to-rsyslog.md index 7c067b86cb8482dab4e68947566f0bc9959d359c..6413f0cea207cc50b43069bc8446c7915459d5b8 100644 --- a/benchmarks/logging-and-auditing/2.16-ensure-journald-is-configured-to-send-logs-to-rsyslog.md +++ b/benchmarks/logging-and-auditing/2.16-ensure-journald-is-configured-to-send-logs-to-rsyslog.md @@ -31,4 +31,3 @@ ForwardToSyslog=yes ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.17-ensure-journald-is-configured-to-compress-large-log-files.md b/benchmarks/logging-and-auditing/2.17-ensure-journald-is-configured-to-compress-large-log-files.md index 5b0b75e4c77594f40d2e9b15572726dc3994fb1b..9b2b57714c11d97409de72b74c1f3f4dbaac3c54 100644 --- a/benchmarks/logging-and-auditing/2.17-ensure-journald-is-configured-to-compress-large-log-files.md +++ b/benchmarks/logging-and-auditing/2.17-ensure-journald-is-configured-to-compress-large-log-files.md @@ -33,4 +33,3 @@ Compress=yes ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.18-ensure-journald-is-configured-to-write-logfiles-to-persistent-disk.md b/benchmarks/logging-and-auditing/2.18-ensure-journald-is-configured-to-write-logfiles-to-persistent-disk.md index 1d03731cd3370436b813ff9b6902f8b00b3cbc1c..415ed31361c4180ad6bae0a5c714b2ec832a4baa 100644 --- a/benchmarks/logging-and-auditing/2.18-ensure-journald-is-configured-to-write-logfiles-to-persistent-disk.md +++ b/benchmarks/logging-and-auditing/2.18-ensure-journald-is-configured-to-write-logfiles-to-persistent-disk.md @@ -32,4 +32,3 @@ Storage=persistent ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.2-ensure-only-authorized-users-own-audit-log-files.md b/benchmarks/logging-and-auditing/2.2-ensure-only-authorized-users-own-audit-log-files.md index 7785bd92838ecda509d6538b06d0a7e6106e7de8..eccd570cf6dd6c267563640ec37f0f2164d04432 100644 --- a/benchmarks/logging-and-auditing/2.2-ensure-only-authorized-users-own-audit-log-files.md +++ b/benchmarks/logging-and-auditing/2.2-ensure-only-authorized-users-own-audit-log-files.md @@ -49,4 +49,3 @@ log_file = /var/log/audit/audit.log ## 参考 -- cis: diff --git a/benchmarks/logging-and-auditing/2.24-ensure-successful-and-unsuccessful-attempts-to-use-the-chsh-command-are-recorded.md b/benchmarks/logging-and-auditing/2.24-ensure-successful-and-unsuccessful-attempts-to-use-the-chsh-command-are-recorded.md index f84b7a38d8a0b24a838abe70e5cc025ae229a327..767267ed5cfcb9deace6f3f0de49f357ab1b97d7 100644 --- a/benchmarks/logging-and-auditing/2.24-ensure-successful-and-unsuccessful-attempts-to-use-the-chsh-command-are-recorded.md +++ b/benchmarks/logging-and-auditing/2.24-ensure-successful-and-unsuccessful-attempts-to-use-the-chsh-command-are-recorded.md @@ -45,4 +45,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.25-ensure-audit-logs-are-not-automatically-deleted.md b/benchmarks/logging-and-auditing/2.25-ensure-audit-logs-are-not-automatically-deleted.md index 6892e797b6be22ebe236acbc55ce98172008f131..8c691a14a02c62285d1f08ed2175bd98cdc81313 100644 --- a/benchmarks/logging-and-auditing/2.25-ensure-audit-logs-are-not-automatically-deleted.md +++ b/benchmarks/logging-and-auditing/2.25-ensure-audit-logs-are-not-automatically-deleted.md @@ -27,4 +27,3 @@ max_log_file_action = keep_logs ## 参考： -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.26-ensure-the-running-and-on-disk-configuration-is-the-same.md b/benchmarks/logging-and-auditing/2.26-ensure-the-running-and-on-disk-configuration-is-the-same.md index 592612f7c7305fe8ee8a5fb0247cc0bbdb3e9229..c47bb92172681a2765554bf88c0fd2880f8327e2 100644 --- a/benchmarks/logging-and-auditing/2.26-ensure-the-running-and-on-disk-configuration-is-the-same.md +++ b/benchmarks/logging-and-auditing/2.26-ensure-the-running-and-on-disk-configuration-is-the-same.md @@ -54,4 +54,3 @@ pass ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.28-ensure-login-and-logout-events-are-collected.md b/benchmarks/logging-and-auditing/2.28-ensure-login-and-logout-events-are-collected.md index 9683fcc2dc34ce339b5f2252e2e2b574804731b9..eadf5d17153b11457241534f217ccde5570bfc17 100644 --- a/benchmarks/logging-and-auditing/2.28-ensure-login-and-logout-events-are-collected.md +++ b/benchmarks/logging-and-auditing/2.28-ensure-login-and-logout-events-are-collected.md @@ -53,4 +53,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.3-ensure-only-authorized-groups-ownership-of-audit-log-files.md b/benchmarks/logging-and-auditing/2.3-ensure-only-authorized-groups-ownership-of-audit-log-files.md index d9091c89e61af85c2f485ff81be824907425a064..56eb3e392dc4f7a2703d65407c0b9256d2885ed0 100644 --- a/benchmarks/logging-and-auditing/2.3-ensure-only-authorized-groups-ownership-of-audit-log-files.md +++ b/benchmarks/logging-and-auditing/2.3-ensure-only-authorized-groups-ownership-of-audit-log-files.md @@ -67,4 +67,3 @@ log_file = /var/log/audit/audit.log ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.30-ensure-events-that-modify-the-sudo-log-file-are-collected.md b/benchmarks/logging-and-auditing/2.30-ensure-events-that-modify-the-sudo-log-file-are-collected.md index 019ab0c3e7c34aa0eeffd9d84d7f423fc31d3ec1..8ec7f9c3826f785b54456739e22c79a177e42881 100644 --- a/benchmarks/logging-and-auditing/2.30-ensure-events-that-modify-the-sudo-log-file-are-collected.md +++ b/benchmarks/logging-and-auditing/2.30-ensure-events-that-modify-the-sudo-log-file-are-collected.md @@ -81,4 +81,3 @@ printf " ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.31-ensure-use-of-privileged-commands-are-collected.md b/benchmarks/logging-and-auditing/2.31-ensure-use-of-privileged-commands-are-collected.md index b31e0c98e63197d85077867f770e6baa6ea45050..1946bd0efb10bb71fffa0548005f9a2c237e230f 100644 --- a/benchmarks/logging-and-auditing/2.31-ensure-use-of-privileged-commands-are-collected.md +++ b/benchmarks/logging-and-auditing/2.31-ensure-use-of-privileged-commands-are-collected.md @@ -82,4 +82,3 @@ done \ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.32-ensure-discretionary-access-control-permission-modification-events-are-collected.md b/benchmarks/logging-and-auditing/2.32-ensure-discretionary-access-control-permission-modification-events-are-collected.md index b5746146165e99ac1fc840275358c28f14aa797d..4d8a62eb96085c5526225a158dbc44e0b11856d0 100644 --- a/benchmarks/logging-and-auditing/2.32-ensure-discretionary-access-control-permission-modification-events-are-collected.md +++ b/benchmarks/logging-and-auditing/2.32-ensure-discretionary-access-control-permission-modification-events-are-collected.md @@ -111,4 +111,3 @@ UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.4-ensure-the-audit-log-directory-is-0750-or-more-restrictive.md b/benchmarks/logging-and-auditing/2.4-ensure-the-audit-log-directory-is-0750-or-more-restrictive.md index 1fd69440e8444d0c6f1b264b23745a319343ccfe..afd995d6100f9985833ba2870711fd4c1b250904 100644 --- a/benchmarks/logging-and-auditing/2.4-ensure-the-audit-log-directory-is-0750-or-more-restrictive.md +++ b/benchmarks/logging-and-auditing/2.4-ensure-the-audit-log-directory-is-0750-or-more-restrictive.md @@ -47,4 +47,3 @@ log_file = /var/log/audit/audit.log ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.md b/benchmarks/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.md index 2b9df7c3f13cffab44262efd13c3d3ff786045a7..04b661b64ae9aa0ab53f27470717ea2eab15ddd5 100644 --- a/benchmarks/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.md +++ b/benchmarks/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.md @@ -43,4 +43,3 @@ drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.md b/benchmarks/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.md index 2b6a8747712d38ca76e9eccb045fb3b916089f8f..a6408743e5c040d7156b761f202e9fdeb479a52a 100644 --- a/benchmarks/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.md +++ b/benchmarks/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.md @@ -48,4 +48,3 @@ drwxr-x--- 3 root root 4096 Nov 25 11:02 .. ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.md b/benchmarks/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.md index a2f10d12073f3c46168595f196472941428f7bc8..ae5cd897e6df776d2b2c77a19184c4da904ddbec 100644 --- a/benchmarks/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.md +++ b/benchmarks/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.md @@ -44,4 +44,3 @@ drwxr-x--- 2 root root 4096 Dec 27 09:56 rules.d ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.8-ensure-audit-tools-are-mode-of-0755-or-more-restrictive.md b/benchmarks/logging-and-auditing/2.8-ensure-audit-tools-are-mode-of-0755-or-more-restrictive.md index e58e2ab66e1f4da581d1d099e524fecb6b7f03a2..030c31276249dbd855fef6e6eba0cb2557bf5872 100644 --- a/benchmarks/logging-and-auditing/2.8-ensure-audit-tools-are-mode-of-0755-or-more-restrictive.md +++ b/benchmarks/logging-and-auditing/2.8-ensure-audit-tools-are-mode-of-0755-or-more-restrictive.md @@ -45,4 +45,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/logging-and-auditing/2.9-ensure-audit-tools-are-owned-by-root.md b/benchmarks/logging-and-auditing/2.9-ensure-audit-tools-are-owned-by-root.md index 4ba97e4584245cd6df7efe6bdb596aa9f6a0acf2..8b52a7502b1b6d0a1237cc0aa70d657e247f102e 100644 --- a/benchmarks/logging-and-auditing/2.9-ensure-audit-tools-are-owned-by-root.md +++ b/benchmarks/logging-and-auditing/2.9-ensure-audit-tools-are-owned-by-root.md @@ -45,4 +45,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/mandatory-access-control/5.9-ensure-setroubleshoot-is-not-installed.md b/benchmarks/mandatory-access-control/5.9-ensure-setroubleshoot-is-not-installed.md index 1876f51c201fa23dee1c0900bca921ebd64b725a..9e3465cfeb2be0429fccdce82a597ae9f951aa11 100644 --- a/benchmarks/mandatory-access-control/5.9-ensure-setroubleshoot-is-not-installed.md +++ b/benchmarks/mandatory-access-control/5.9-ensure-setroubleshoot-is-not-installed.md @@ -33,4 +33,3 @@ package setroubleshoot is not installed ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/services/3.1-disable-http-server.md b/benchmarks/services/3.1-disable-http-server.md index 83328695d7ec6c3b3bfb3d5c263c621ef6bcbdb3..5a18e8f616ced9d09c7b000c92a3732c72dcf170 100644 --- a/benchmarks/services/3.1-disable-http-server.md +++ b/benchmarks/services/3.1-disable-http-server.md @@ -30,4 +30,3 @@ HTTP 或 Web 服务器提供托管网站内容的能力。 ## 参考 -- cis: diff --git a/benchmarks/services/3.10-disable-rsync-server.md b/benchmarks/services/3.10-disable-rsync-server.md index 9b904187eca5efa9f16b238ac56e2010a0c17ca6..29b12cdeadbe51fca8fb4d41e66adb9f9c9bfad0 100644 --- a/benchmarks/services/3.10-disable-rsync-server.md +++ b/benchmarks/services/3.10-disable-rsync-server.md @@ -30,4 +30,3 @@ rsyncd 服务存在安全风险，因为它使用未加密的协议进行通信 ## 参考 -- cis: diff --git a/benchmarks/services/3.11-disable-avahi-server.md b/benchmarks/services/3.11-disable-avahi-server.md index e499c16bab3c2decbf2500d296861f5e231d6c3e..7122512723e59b99fa445599fc5268aad1e7fb8a 100644 --- a/benchmarks/services/3.11-disable-avahi-server.md +++ b/benchmarks/services/3.11-disable-avahi-server.md @@ -39,4 +39,3 @@ Avahi 是一个免费的 zeroconf（零配置网络服务规范） 实现，包 ## 参考 -- cis: diff --git a/benchmarks/services/3.12-disable-snmp-server.md b/benchmarks/services/3.12-disable-snmp-server.md index d9752a4e266c25eae85b13b6df1c7b883ce4581d..191ae051c324b3286a1bbef6962b1e51473b3c65 100644 --- a/benchmarks/services/3.12-disable-snmp-server.md +++ b/benchmarks/services/3.12-disable-snmp-server.md @@ -30,4 +30,3 @@ SNMP 服务器可以使用 SNMP v1 进行通信，它以明文方式传输数据 ## 参考 -- cis: diff --git a/benchmarks/services/3.13-disable-http-proxy-server.md b/benchmarks/services/3.13-disable-http-proxy-server.md index 879e409f51da46b51b3d056b4bf1c9dd723920b2..d486ae72f8239ba764937b7fdfe3e3828eb8918e 100644 --- a/benchmarks/services/3.13-disable-http-proxy-server.md +++ b/benchmarks/services/3.13-disable-http-proxy-server.md @@ -30,4 +30,3 @@ Squid 是在许多发行版和环境中使用的标准代理服务器。 ## 参考 -- cis: diff --git a/benchmarks/services/3.14-disable-samba.md b/benchmarks/services/3.14-disable-samba.md index 3f5b800ec9273c500a8346f2a9fd256ccccc42da..588d32149e78a2ac9f966ca30943a2e3ce5c9f43 100644 --- a/benchmarks/services/3.14-disable-samba.md +++ b/benchmarks/services/3.14-disable-samba.md @@ -30,4 +30,3 @@ Samba 守护程序允许系统管理员配置他们的 Linux 系统以与 Window ## 参考 -- cis: diff --git a/benchmarks/services/3.15-disable-imap-and-pop3-server.md b/benchmarks/services/3.15-disable-imap-and-pop3-server.md index dc6d57b96fdad4d5d2535630c4452b908522c57e..ea90aec0a44454cc457602133463ca87d9d69e04 100644 --- a/benchmarks/services/3.15-disable-imap-and-pop3-server.md +++ b/benchmarks/services/3.15-disable-imap-and-pop3-server.md @@ -30,4 +30,3 @@ dovecot 是基于 Linux 系统的开源 IMAP 和 POP3 服务器。 ## 参考 -- cis: diff --git a/benchmarks/services/3.17-disable-or-uninstall-the-telnet.md b/benchmarks/services/3.17-disable-or-uninstall-the-telnet.md index 77d96c21c119d985790900a242d6dda879640e85..87f6427f8f54caa9d32789d994174bdad56bbcd2 100644 --- a/benchmarks/services/3.17-disable-or-uninstall-the-telnet.md +++ b/benchmarks/services/3.17-disable-or-uninstall-the-telnet.md @@ -51,4 +51,3 @@ disabled ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/services/3.2-disable-ftp-server.md b/benchmarks/services/3.2-disable-ftp-server.md index fc9ed1d77bc4050e0553f2a5591c2844fcd99a4b..6731a28a92458e8c8fe10020c05d4ed408d75d8e 100644 --- a/benchmarks/services/3.2-disable-ftp-server.md +++ b/benchmarks/services/3.2-disable-ftp-server.md @@ -30,4 +30,3 @@ FTP 不保护数据或身份验证凭据的机密性。 如果需要文件传输 ## 参考 -- cis: diff --git a/benchmarks/services/3.22-ensure-NIS-Client-is-not-installed.md b/benchmarks/services/3.22-ensure-NIS-Client-is-not-installed.md index f9f9c8a25487d4c97ecc93fd21d653b6396dd813..021a60e82dc62a8ee737b1d59fb19e1dbf638830 100644 --- a/benchmarks/services/3.22-ensure-NIS-Client-is-not-installed.md +++ b/benchmarks/services/3.22-ensure-NIS-Client-is-not-installed.md @@ -35,4 +35,3 @@ package ypbind is not installed ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/services/3.25-ensure-xinetd-is-not-installed.md b/benchmarks/services/3.25-ensure-xinetd-is-not-installed.md index e7e6521bf0b4c7d2c62aeb6ba2e753b46f632951..65ca53aab97f0c8fa0f9d9c0385077743af9f2fc 100644 --- a/benchmarks/services/3.25-ensure-xinetd-is-not-installed.md +++ b/benchmarks/services/3.25-ensure-xinetd-is-not-installed.md @@ -35,4 +35,3 @@ package xinetd is not installed ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/services/3.26-disable-usb-storage.md b/benchmarks/services/3.26-disable-usb-storage.md index 9798409b6426ff4d2793234c46baec5c3ace3b15..5375fdd0d226a3c2760e2fb883144c813df68bba 100644 --- a/benchmarks/services/3.26-disable-usb-storage.md +++ b/benchmarks/services/3.26-disable-usb-storage.md @@ -53,4 +53,3 @@ install /bin/true ## 参考 -- cis: diff --git a/benchmarks/services/3.27-ensure-time-synchronization-is-installed.md b/benchmarks/services/3.27-ensure-time-synchronization-is-installed.md index 310df1382ab54b8adcdf9fa15eb76119e949fa26..8a3b75668ab2ba8b00e8d31f762ce10cff7db2eb 100644 --- a/benchmarks/services/3.27-ensure-time-synchronization-is-installed.md +++ b/benchmarks/services/3.27-ensure-time-synchronization-is-installed.md @@ -33,4 +33,3 @@ chrony- ## 参考 -- cis: diff --git a/benchmarks/services/3.28-disable-automounting.md b/benchmarks/services/3.28-disable-automounting.md index 65a729ae9fb7329caa9115e15b3c0fd41a269a8b..5e623b75cfb4050fb9d4626e699a86485f9fe92a 100644 --- a/benchmarks/services/3.28-disable-automounting.md +++ b/benchmarks/services/3.28-disable-automounting.md @@ -46,4 +46,3 @@ Failed to get unit file state for autofs.service: No such file or directory ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/services/3.3-disable-dns-server.md b/benchmarks/services/3.3-disable-dns-server.md index a10f7ca492045d13a7770a084632c2654f2e2354..b81eb5575dab2462558cd85526ff30bf34f71e6e 100644 --- a/benchmarks/services/3.3-disable-dns-server.md +++ b/benchmarks/services/3.3-disable-dns-server.md @@ -30,4 +30,3 @@ ## 参考 -- cis: diff --git a/benchmarks/services/3.4-disable-nfs.md b/benchmarks/services/3.4-disable-nfs.md index 522ca9e163338b5bac8eacf8a5bcae8262f4b777..3f4502de72972508d0552430de2e35e14700d3c8 100644 --- a/benchmarks/services/3.4-disable-nfs.md +++ b/benchmarks/services/3.4-disable-nfs.md @@ -30,4 +30,3 @@ ## 参考 -- cis: diff --git a/benchmarks/services/3.5-disable-rpc.md b/benchmarks/services/3.5-disable-rpc.md index d9c78df149f2a4a337bf18a85e3dd63873aed847..e7f2e577e5ac93d49ccffd922ee899dbcb5be432 100644 --- a/benchmarks/services/3.5-disable-rpc.md +++ b/benchmarks/services/3.5-disable-rpc.md @@ -32,4 +32,3 @@ rpcbind 服务将远程过程调用 (RPC) 服务映射到它们侦听的端口 ## 参考 -- cis: diff --git a/benchmarks/services/3.6-disable-ldap-server.md b/benchmarks/services/3.6-disable-ldap-server.md index c3ef70e2106e16d3d2f1e25d75a0a03faa5a1880..5611a90691b49bd68aad488155dc5d9caaef2381 100644 --- a/benchmarks/services/3.6-disable-ldap-server.md +++ b/benchmarks/services/3.6-disable-ldap-server.md @@ -30,4 +30,3 @@ ## 参考 -- cis: diff --git a/benchmarks/services/3.7-disable-dhcp-server.md b/benchmarks/services/3.7-disable-dhcp-server.md index 2ef920c4c9c90323347e1f90ece8db1552b34721..b75785dee282f5be9139572bb89402bd3f1bb353 100644 --- a/benchmarks/services/3.7-disable-dhcp-server.md +++ b/benchmarks/services/3.7-disable-dhcp-server.md @@ -30,4 +30,3 @@ ## 参考 -- cis: diff --git a/benchmarks/services/3.8-disable-cups.md b/benchmarks/services/3.8-disable-cups.md index 9b90af390109a7e28b0028f3059d5808157611b2..67a82ae8d0306e61ffe7da206f3e04dbf8953dc0 100644 --- a/benchmarks/services/3.8-disable-cups.md +++ b/benchmarks/services/3.8-disable-cups.md @@ -30,4 +30,3 @@ ## 参考 -- cis: diff --git a/benchmarks/services/3.9-disable-nis-server.md b/benchmarks/services/3.9-disable-nis-server.md index 6c062579d0f214ba55b08bba6d849fc1096b13e4..8782fa56bc360554b0ca56dfcff9181430084310 100644 --- a/benchmarks/services/3.9-disable-nis-server.md +++ b/benchmarks/services/3.9-disable-nis-server.md @@ -30,4 +30,3 @@ NIS Server本质上是一个不安全的系统，容易受到 DOS 攻击、缓 ## 参考 -- cis: diff --git a/benchmarks/system-configurations/4.1-ensure-message-of-the-day-is-configured-properly.md b/benchmarks/system-configurations/4.1-ensure-message-of-the-day-is-configured-properly.md index 914572cee6ae3541cf1d63a79da90d3d3d929de0..f3892540bcc4562df111a4dad936fc0247619c9b 100644 --- a/benchmarks/system-configurations/4.1-ensure-message-of-the-day-is-configured-properly.md +++ b/benchmarks/system-configurations/4.1-ensure-message-of-the-day-is-configured-properly.md @@ -46,4 +46,3 @@ No information is returned. ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.10-ensure-bootloader-password-is-set.md b/benchmarks/system-configurations/4.10-ensure-bootloader-password-is-set.md index 3eea6350928449fc152230e912bea6fd663bcf3e..300cce6b0efe9a99be95b55079b5ac3df174da93 100644 --- a/benchmarks/system-configurations/4.10-ensure-bootloader-password-is-set.md +++ b/benchmarks/system-configurations/4.10-ensure-bootloader-password-is-set.md @@ -54,4 +54,3 @@ GRUB2_PASSWORD=grub.pbkdf2.sha512...... ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.md b/benchmarks/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.md index 61b46d5576a667e33c0deef2166120b6458075be..661e64cd2f7597e7ea3acf66d06bd658032b3290 100644 --- a/benchmarks/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.md +++ b/benchmarks/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.md @@ -79,4 +79,3 @@ GFPT ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.12-ensure-authentication-required-for-single-user-mode.md b/benchmarks/system-configurations/4.12-ensure-authentication-required-for-single-user-mode.md index e2933a9e0f1041fe17aed6c21bc9e2e38b6c6d4f..6641fc2933cad76ee4121c335dba3c6f6e657462 100644 --- a/benchmarks/system-configurations/4.12-ensure-authentication-required-for-single-user-mode.md +++ b/benchmarks/system-configurations/4.12-ensure-authentication-required-for-single-user-mode.md @@ -44,4 +44,3 @@ ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.13-ensure-core-dumps-are-restricted.md b/benchmarks/system-configurations/4.13-ensure-core-dumps-are-restricted.md index fd4fceb5b53e1e05ab83d992f321968d356672a7..c51bc1361e4741293e9a615694d37066cb8f0034 100644 --- a/benchmarks/system-configurations/4.13-ensure-core-dumps-are-restricted.md +++ b/benchmarks/system-configurations/4.13-ensure-core-dumps-are-restricted.md @@ -53,4 +53,3 @@ fs.suid_dumpable = 0 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.14-ensure-address-space-layout-randomization-(ASLR)-is-enabled.md b/benchmarks/system-configurations/4.14-ensure-address-space-layout-randomization-(ASLR)-is-enabled.md index 14b0c90da71532be6821b7fc1fc4b68a59a52001..2b236fffc1d91c99e99e2800b80e60952d6c2b6c 100644 --- a/benchmarks/system-configurations/4.14-ensure-address-space-layout-randomization-(ASLR)-is-enabled.md +++ b/benchmarks/system-configurations/4.14-ensure-address-space-layout-randomization-(ASLR)-is-enabled.md @@ -45,4 +45,3 @@ kernel.randomize_va_space = 2 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.15-ensure-system-wide-crypto-policy-is-not-legacy.md b/benchmarks/system-configurations/4.15-ensure-system-wide-crypto-policy-is-not-legacy.md index 8d4ce885399033c031e4bf2178313a6cfc360f9b..bf6e9cefd51ff6588b8bdb897b40d7854a561c01 100644 --- a/benchmarks/system-configurations/4.15-ensure-system-wide-crypto-policy-is-not-legacy.md +++ b/benchmarks/system-configurations/4.15-ensure-system-wide-crypto-policy-is-not-legacy.md @@ -49,4 +49,3 @@ No information is returned. ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.16-ensure-sticky-bit-is-set-on-all-world-writable-directories.md b/benchmarks/system-configurations/4.16-ensure-sticky-bit-is-set-on-all-world-writable-directories.md index a6e605ef1a6f07dc1f8bc0d49c9ba28635b52d97..2a29599d24daa7db4bf1deac204c7d6938ed74c8 100644 --- a/benchmarks/system-configurations/4.16-ensure-sticky-bit-is-set-on-all-world-writable-directories.md +++ b/benchmarks/system-configurations/4.16-ensure-sticky-bit-is-set-on-all-world-writable-directories.md @@ -33,4 +33,3 @@ ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.17-ensure-permissions-on-etc-passwd-are-configured.md b/benchmarks/system-configurations/4.17-ensure-permissions-on-etc-passwd-are-configured.md index 61484fc7a6b4a9bd1e9fc13d545de4df3872ee5e..7928c41a2a8b3b8bcd6652c33ff73e100f131661 100644 --- a/benchmarks/system-configurations/4.17-ensure-permissions-on-etc-passwd-are-configured.md +++ b/benchmarks/system-configurations/4.17-ensure-permissions-on-etc-passwd-are-configured.md @@ -37,4 +37,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.18-ensure-permissions-on-etc-shadow-are-configured.md b/benchmarks/system-configurations/4.18-ensure-permissions-on-etc-shadow-are-configured.md index 0f23b98f8022118efbb1f5e894aee1a9ebe3e027..317c4dd91ee11665c2d3416112612080da15ea6b 100644 --- a/benchmarks/system-configurations/4.18-ensure-permissions-on-etc-shadow-are-configured.md +++ b/benchmarks/system-configurations/4.18-ensure-permissions-on-etc-shadow-are-configured.md @@ -39,4 +39,3 @@ Access: (0000/----------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.19-ensure-permissions-on-etc-group-are-configured.md b/benchmarks/system-configurations/4.19-ensure-permissions-on-etc-group-are-configured.md index 1475dd893f41a362268d7d312e7c3f5a5cf06c34..a2504e5b137aa42dfbe0bc5c425a5e7e22bde182 100644 --- a/benchmarks/system-configurations/4.19-ensure-permissions-on-etc-group-are-configured.md +++ b/benchmarks/system-configurations/4.19-ensure-permissions-on-etc-group-are-configured.md @@ -35,4 +35,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.2-ensure-local-login-warning-banner-is-configured-properly.md b/benchmarks/system-configurations/4.2-ensure-local-login-warning-banner-is-configured-properly.md index c6913ec4c5f7b552b05e6f0ecbae0849f2cf6eec..5f45293ce40be5e0aeca6c02ba6a3f836abf2734 100644 --- a/benchmarks/system-configurations/4.2-ensure-local-login-warning-banner-is-configured-properly.md +++ b/benchmarks/system-configurations/4.2-ensure-local-login-warning-banner-is-configured-properly.md @@ -63,4 +63,3 @@ No information is returned. ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.20-ensure-permissions-on-etc-gshadow-are-configured.md b/benchmarks/system-configurations/4.20-ensure-permissions-on-etc-gshadow-are-configured.md index b4f4b19dd6011c079ab38eb3d0472ab89de37ad0..438d72c98d69e3f94e8427ef846d297db7dbb3fa 100644 --- a/benchmarks/system-configurations/4.20-ensure-permissions-on-etc-gshadow-are-configured.md +++ b/benchmarks/system-configurations/4.20-ensure-permissions-on-etc-gshadow-are-configured.md @@ -39,4 +39,3 @@ Access: (0000/----------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.21-ensure-permissions-on-etc-passwd--are-configured.md b/benchmarks/system-configurations/4.21-ensure-permissions-on-etc-passwd--are-configured.md index 0f5d55aa8667f8b1484419ae401c5a972ec66348..75809537b419d5c15492b0feec43016f6a19253d 100644 --- a/benchmarks/system-configurations/4.21-ensure-permissions-on-etc-passwd--are-configured.md +++ b/benchmarks/system-configurations/4.21-ensure-permissions-on-etc-passwd--are-configured.md @@ -37,4 +37,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.22-ensure-permissions-on-etc-shadow--are-configured.md b/benchmarks/system-configurations/4.22-ensure-permissions-on-etc-shadow--are-configured.md index a5425186a1bdcf3ec2db8147be50764054883cf4..ba75297af6a0c0bd4b48b86a2363941d72d7ff0b 100644 --- a/benchmarks/system-configurations/4.22-ensure-permissions-on-etc-shadow--are-configured.md +++ b/benchmarks/system-configurations/4.22-ensure-permissions-on-etc-shadow--are-configured.md @@ -39,4 +39,3 @@ Access: (0000/----------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.23-ensure-permissions-on-etc-group--are-configured.md b/benchmarks/system-configurations/4.23-ensure-permissions-on-etc-group--are-configured.md index 359f8024ae599915ccad66ce4e9b213ccd2b85b7..62d19cbbc9603280ad64e67c670af4832e9b0fd2 100644 --- a/benchmarks/system-configurations/4.23-ensure-permissions-on-etc-group--are-configured.md +++ b/benchmarks/system-configurations/4.23-ensure-permissions-on-etc-group--are-configured.md @@ -35,4 +35,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.24-ensure-permissions-on-etc-gshadow--are-configured.md b/benchmarks/system-configurations/4.24-ensure-permissions-on-etc-gshadow--are-configured.md index da0edd37b4a1ea9e479bdc7d575d8bdd1c9f53f5..6c82c2d3e8258ff70f2f37d3909031f38506408a 100644 --- a/benchmarks/system-configurations/4.24-ensure-permissions-on-etc-gshadow--are-configured.md +++ b/benchmarks/system-configurations/4.24-ensure-permissions-on-etc-gshadow--are-configured.md @@ -39,4 +39,3 @@ Access: (0000/----------) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.25-ensure-no-world-writable-files-exist.md b/benchmarks/system-configurations/4.25-ensure-no-world-writable-files-exist.md index a04673e0a118613b421a28458ea87d0dc50a5988..4f5ddd990b78254dfd0f6d8b8b5e96d4dcb9d3d3 100644 --- a/benchmarks/system-configurations/4.25-ensure-no-world-writable-files-exist.md +++ b/benchmarks/system-configurations/4.25-ensure-no-world-writable-files-exist.md @@ -30,4 +30,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.26-ensure-no-unowned-files-or-directories-exist.md b/benchmarks/system-configurations/4.26-ensure-no-unowned-files-or-directories-exist.md index e6a7712f3be192f330400141e6c4fbde92ac3259..b2035aed147f2c384979c09a5c9bfb52ccaf1b88 100644 --- a/benchmarks/system-configurations/4.26-ensure-no-unowned-files-or-directories-exist.md +++ b/benchmarks/system-configurations/4.26-ensure-no-unowned-files-or-directories-exist.md @@ -30,4 +30,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.27-ensure-no-ungrouped-files-or-directories-exist.md b/benchmarks/system-configurations/4.27-ensure-no-ungrouped-files-or-directories-exist.md index 88b01fad4900d22486ac77f6c794acbda5fbe43b..ae54c4542126f2b41e731989673ca5444bb4001e 100644 --- a/benchmarks/system-configurations/4.27-ensure-no-ungrouped-files-or-directories-exist.md +++ b/benchmarks/system-configurations/4.27-ensure-no-ungrouped-files-or-directories-exist.md @@ -30,4 +30,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.28-ensure-no-password-fields-are-not-empty.md b/benchmarks/system-configurations/4.28-ensure-no-password-fields-are-not-empty.md index 00c594ae4ddd42ed482a5daac2606b5996113ae2..f56fd89d33e9d03d1f03308070ab4dcc5fb3c0ae 100644 --- a/benchmarks/system-configurations/4.28-ensure-no-password-fields-are-not-empty.md +++ b/benchmarks/system-configurations/4.28-ensure-no-password-fields-are-not-empty.md @@ -38,4 +38,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.29-ensure-root-path-integrity.md b/benchmarks/system-configurations/4.29-ensure-root-path-integrity.md index 69a15f93fa0bc22f139d37c30e533582e32a7ec0..f889e7491c5ec51adba7d11b4bb8c2d217388cc7 100644 --- a/benchmarks/system-configurations/4.29-ensure-root-path-integrity.md +++ b/benchmarks/system-configurations/4.29-ensure-root-path-integrity.md @@ -70,4 +70,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.3-ensure-remote-login-warning-banner-is-configured-properly.md b/benchmarks/system-configurations/4.3-ensure-remote-login-warning-banner-is-configured-properly.md index a7bad0f63b2240c4f7c2250387e41811a36cb298..36596c7f2fbb63b035da6b9ee190031672c51a77 100644 --- a/benchmarks/system-configurations/4.3-ensure-remote-login-warning-banner-is-configured-properly.md +++ b/benchmarks/system-configurations/4.3-ensure-remote-login-warning-banner-is-configured-properly.md @@ -61,4 +61,3 @@ No information is returned. ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.30-ensure-root-is-the-only-uid-0-account.md b/benchmarks/system-configurations/4.30-ensure-root-is-the-only-uid-0-account.md index 3eb0f5e1192df2bee0f2fdafc0b56a0a6ce48da5..ab2ca7abb07ebd1bd8e01bbe9a13ccd36cf33338 100644 --- a/benchmarks/system-configurations/4.30-ensure-root-is-the-only-uid-0-account.md +++ b/benchmarks/system-configurations/4.30-ensure-root-is-the-only-uid-0-account.md @@ -41,4 +41,3 @@ root ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.31-ensure-users-home-directories-permissions-are-750-or-more-restrictive.md b/benchmarks/system-configurations/4.31-ensure-users-home-directories-permissions-are-750-or-more-restrictive.md index 39cf3891b6d1b9841667c2791ee3be6ebf2f2148..76f87d0d4d2ad3eaf73135568ee75a2d0fb18683 100644 --- a/benchmarks/system-configurations/4.31-ensure-users-home-directories-permissions-are-750-or-more-restrictive.md +++ b/benchmarks/system-configurations/4.31-ensure-users-home-directories-permissions-are-750-or-more-restrictive.md @@ -59,4 +59,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.32-ensure-users-own-their-home-directories.md b/benchmarks/system-configurations/4.32-ensure-users-own-their-home-directories.md index ff02575d38b04ccd08e421d019e89fca6e2f71a2..c9c9d7cb47068bace399f942575b7a4e0ff9d648 100644 --- a/benchmarks/system-configurations/4.32-ensure-users-own-their-home-directories.md +++ b/benchmarks/system-configurations/4.32-ensure-users-own-their-home-directories.md @@ -69,4 +69,3 @@ UHOC ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.33-ensure-users-dot-files-are-not-group-or-world-writable.md b/benchmarks/system-configurations/4.33-ensure-users-dot-files-are-not-group-or-world-writable.md index 60bd945e2636fd91e30619db55f2909687bb404c..bafef8af9de2ee95de5a7fd962fa2bfd365dea62 100644 --- a/benchmarks/system-configurations/4.33-ensure-users-dot-files-are-not-group-or-world-writable.md +++ b/benchmarks/system-configurations/4.33-ensure-users-dot-files-are-not-group-or-world-writable.md @@ -59,4 +59,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.34-ensure-no-users-have-.forward-files.md b/benchmarks/system-configurations/4.34-ensure-no-users-have-.forward-files.md index 34869580731028396fbd521aa60e7062682bb182..91c6bf6b6f2877fcf28d1d20c37889854e7d3fde 100644 --- a/benchmarks/system-configurations/4.34-ensure-no-users-have-.forward-files.md +++ b/benchmarks/system-configurations/4.34-ensure-no-users-have-.forward-files.md @@ -50,4 +50,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.35-ensure-no-users-have-.netrc-files.md b/benchmarks/system-configurations/4.35-ensure-no-users-have-.netrc-files.md index 132239a87b5ac0a73836e4cf2bc2a450b476ac5e..e92403b5aa7eda3a168c10528a859bdd498ec019 100644 --- a/benchmarks/system-configurations/4.35-ensure-no-users-have-.netrc-files.md +++ b/benchmarks/system-configurations/4.35-ensure-no-users-have-.netrc-files.md @@ -50,4 +50,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.36-ensure-users-.netrc-files-are-not-group-or-world-accessible.md b/benchmarks/system-configurations/4.36-ensure-users-.netrc-files-are-not-group-or-world-accessible.md index 4b54ffa79e389d95e47cc10e3aea967eb07b0857..e74a43335bdc84e7ca044b109aeecb2f3d9f4896 100644 --- a/benchmarks/system-configurations/4.36-ensure-users-.netrc-files-are-not-group-or-world-accessible.md +++ b/benchmarks/system-configurations/4.36-ensure-users-.netrc-files-are-not-group-or-world-accessible.md @@ -60,4 +60,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.37-ensure-no-users-have-.rhosts-files.md b/benchmarks/system-configurations/4.37-ensure-no-users-have-.rhosts-files.md index cf32c2cb153ddfc14e3db1d6e8da43be53da7a0c..e9c68e5f585fca9b37312e1e324a5319792fd0e6 100644 --- a/benchmarks/system-configurations/4.37-ensure-no-users-have-.rhosts-files.md +++ b/benchmarks/system-configurations/4.37-ensure-no-users-have-.rhosts-files.md @@ -55,4 +55,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.38-ensure-all-groups-in-etc-passwd-exist-in-etc-group.md b/benchmarks/system-configurations/4.38-ensure-all-groups-in-etc-passwd-exist-in-etc-group.md index 11129dee6b38a9c37b078cf143b01fcc43999368..c4881865b195262d93cc956dddf3db79a141a094 100644 --- a/benchmarks/system-configurations/4.38-ensure-all-groups-in-etc-passwd-exist-in-etc-group.md +++ b/benchmarks/system-configurations/4.38-ensure-all-groups-in-etc-passwd-exist-in-etc-group.md @@ -35,4 +35,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.39-ensure-no-duplicate-uids-exist.md b/benchmarks/system-configurations/4.39-ensure-no-duplicate-uids-exist.md index 6b0e6bd15c407aebf00d1159d6f1fffa0ba999ad..f90d3fbfc3a538a47ecba60ea3ed73de500e2780 100644 --- a/benchmarks/system-configurations/4.39-ensure-no-duplicate-uids-exist.md +++ b/benchmarks/system-configurations/4.39-ensure-no-duplicate-uids-exist.md @@ -37,4 +37,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.4-ensure-permissions-on-etc-motd-are-configured.md b/benchmarks/system-configurations/4.4-ensure-permissions-on-etc-motd-are-configured.md index 3fcb15165ecdaef1cae08e73812c48f73dedce64..b66c3a73498f7fdb7c6ac393da5dc850ee7eec97 100644 --- a/benchmarks/system-configurations/4.4-ensure-permissions-on-etc-motd-are-configured.md +++ b/benchmarks/system-configurations/4.4-ensure-permissions-on-etc-motd-are-configured.md @@ -61,4 +61,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.40-ensure-no-duplicate-gids-exist.md b/benchmarks/system-configurations/4.40-ensure-no-duplicate-gids-exist.md index a35ab0d895decbcd44fd4e1219c05fa6dc6bca7b..ced81dcd02b9313156a335a34b84e0d70e721efc 100644 --- a/benchmarks/system-configurations/4.40-ensure-no-duplicate-gids-exist.md +++ b/benchmarks/system-configurations/4.40-ensure-no-duplicate-gids-exist.md @@ -32,4 +32,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.41-ensure-no-duplicate-user-names-exist.md b/benchmarks/system-configurations/4.41-ensure-no-duplicate-user-names-exist.md index 868508dac899c3bab474bbe09f63ac051ecccc2e..522c34cf17c79206426318b15bab9df483741fa3 100644 --- a/benchmarks/system-configurations/4.41-ensure-no-duplicate-user-names-exist.md +++ b/benchmarks/system-configurations/4.41-ensure-no-duplicate-user-names-exist.md @@ -32,4 +32,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.42-ensure-no-duplicate-group-names-exist.md b/benchmarks/system-configurations/4.42-ensure-no-duplicate-group-names-exist.md index c0622b3af84a052d2b5f405b78fe177f53ae1acf..2a4403b343eb4bdff818d3203732f9b25eade5ab 100644 --- a/benchmarks/system-configurations/4.42-ensure-no-duplicate-group-names-exist.md +++ b/benchmarks/system-configurations/4.42-ensure-no-duplicate-group-names-exist.md @@ -32,4 +32,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.43-ensure-all-users-home-directories-exist.md b/benchmarks/system-configurations/4.43-ensure-all-users-home-directories-exist.md index 04bdb9b97ac1c7363f025d5c9f1391a85d772897..4bbe06f086152f0c7c805d34216d44898357d2a2 100644 --- a/benchmarks/system-configurations/4.43-ensure-all-users-home-directories-exist.md +++ b/benchmarks/system-configurations/4.43-ensure-all-users-home-directories-exist.md @@ -47,4 +47,3 @@ done ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.44-ensure-sctp-is-disabled.md b/benchmarks/system-configurations/4.44-ensure-sctp-is-disabled.md index af8dc7a16ab6d3af15569b84e25c3babc9f74e76..fa96335af802f7552c60f04d284131fcc0cc4d11 100644 --- a/benchmarks/system-configurations/4.44-ensure-sctp-is-disabled.md +++ b/benchmarks/system-configurations/4.44-ensure-sctp-is-disabled.md @@ -40,4 +40,3 @@ install /bin/true ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.45-ensure-dccp-is-disabled.md b/benchmarks/system-configurations/4.45-ensure-dccp-is-disabled.md index 1f8c8e40c81219bf95124b4be6bb4b2b79a620ed..1ec810a390cd955c6debb792454c1ee4e182f878 100644 --- a/benchmarks/system-configurations/4.45-ensure-dccp-is-disabled.md +++ b/benchmarks/system-configurations/4.45-ensure-dccp-is-disabled.md @@ -41,4 +41,3 @@ install /bin/true ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.46-ensure-wireless-interfaces-are-disabled.md b/benchmarks/system-configurations/4.46-ensure-wireless-interfaces-are-disabled.md index 35b14dafffc3dbcccbee72acf170b6f33396cd37..5323045b8885096349da34822c0267bf0e8d831a 100644 --- a/benchmarks/system-configurations/4.46-ensure-wireless-interfaces-are-disabled.md +++ b/benchmarks/system-configurations/4.46-ensure-wireless-interfaces-are-disabled.md @@ -74,4 +74,3 @@ wireless_chk ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.47-ensure-ip-forwarding-is-disabled.md b/benchmarks/system-configurations/4.47-ensure-ip-forwarding-is-disabled.md index b650ff9e8070f8436554711719cc89a0b00bb1fd..e3de21c59559b4bc21a1fb5d7304f873830e903c 100644 --- a/benchmarks/system-configurations/4.47-ensure-ip-forwarding-is-disabled.md +++ b/benchmarks/system-configurations/4.47-ensure-ip-forwarding-is-disabled.md @@ -44,4 +44,3 @@ No value should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.48-ensure-packet-redirect-sending-is-disabled.md b/benchmarks/system-configurations/4.48-ensure-packet-redirect-sending-is-disabled.md index 22b910163e3bbf38b97643560815a13a2e363ee7..ed66d0e63977aa61323e1f1df3186a870e0002bc 100644 --- a/benchmarks/system-configurations/4.48-ensure-packet-redirect-sending-is-disabled.md +++ b/benchmarks/system-configurations/4.48-ensure-packet-redirect-sending-is-disabled.md @@ -51,4 +51,3 @@ net.ipv4.conf.default.send_redirects = 0 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.49-ensure-source-routed-packets-are-not-accepted.md b/benchmarks/system-configurations/4.49-ensure-source-routed-packets-are-not-accepted.md index b178bb47af5e859f47a6e8beadfc49cd654116be..9f25f823d6753a4357c95d9da5c534f7eefdc1dd 100644 --- a/benchmarks/system-configurations/4.49-ensure-source-routed-packets-are-not-accepted.md +++ b/benchmarks/system-configurations/4.49-ensure-source-routed-packets-are-not-accepted.md @@ -64,4 +64,3 @@ net.ipv6.conf.default.accept_source_route = 0 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.5-ensure-permissions-on-etc-issue-are-configured.md b/benchmarks/system-configurations/4.5-ensure-permissions-on-etc-issue-are-configured.md index a3709b3f76ff4985ec6c5186e81c551fc69ab17d..29cdc1f1b1c9157054352f6466eb5b26de756143 100644 --- a/benchmarks/system-configurations/4.5-ensure-permissions-on-etc-issue-are-configured.md +++ b/benchmarks/system-configurations/4.5-ensure-permissions-on-etc-issue-are-configured.md @@ -36,4 +36,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.50-ensure-icmp-redirects-are-not-accepted.md b/benchmarks/system-configurations/4.50-ensure-icmp-redirects-are-not-accepted.md index 478ecaee0c7466186a2121e0ba3ec670ef7aa1d4..9e1c50cb81d8134b181acfe0c6b5c00ab026bef1 100644 --- a/benchmarks/system-configurations/4.50-ensure-icmp-redirects-are-not-accepted.md +++ b/benchmarks/system-configurations/4.50-ensure-icmp-redirects-are-not-accepted.md @@ -64,4 +64,3 @@ net.ipv6.conf.default.accept_redirects = 0 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.51-ensure-secure-icmp-redirects-are-not-accepted.md b/benchmarks/system-configurations/4.51-ensure-secure-icmp-redirects-are-not-accepted.md index aa7a5f365d1b45d70e62bf0d2159a2c682037ab7..a2c6cab6a270960b75f5a230fbc182f538b79115 100644 --- a/benchmarks/system-configurations/4.51-ensure-secure-icmp-redirects-are-not-accepted.md +++ b/benchmarks/system-configurations/4.51-ensure-secure-icmp-redirects-are-not-accepted.md @@ -53,4 +53,3 @@ net.ipv4.conf.default.secure_redirects = 0 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.52-ensure-suspicious-packets-are-logged.md b/benchmarks/system-configurations/4.52-ensure-suspicious-packets-are-logged.md index 7eb0b3cc5b3d91855f8a09cf5079b6b2c48541ba..38e5b779c91e8cdc5c7338cbd030d4f9f254dd6d 100644 --- a/benchmarks/system-configurations/4.52-ensure-suspicious-packets-are-logged.md +++ b/benchmarks/system-configurations/4.52-ensure-suspicious-packets-are-logged.md @@ -51,4 +51,3 @@ net.ipv4.conf.default.log_martians = 1 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.53-ensure-broadcast-icmp-requests-are-ignored.md b/benchmarks/system-configurations/4.53-ensure-broadcast-icmp-requests-are-ignored.md index edd5bc769218f858a337be7b6437973eed6fe40d..cb5839e89c58532ca17f89dcf0ab35b12a0f04b8 100644 --- a/benchmarks/system-configurations/4.53-ensure-broadcast-icmp-requests-are-ignored.md +++ b/benchmarks/system-configurations/4.53-ensure-broadcast-icmp-requests-are-ignored.md @@ -38,4 +38,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.54-ensure-bogus-icmp-responses-are-ignored.md b/benchmarks/system-configurations/4.54-ensure-bogus-icmp-responses-are-ignored.md index 8173b346be7764b978d200a138d12fc2843423b0..7b0f1b32e847765b380ef0f87d4ea0c8492dd7fe 100644 --- a/benchmarks/system-configurations/4.54-ensure-bogus-icmp-responses-are-ignored.md +++ b/benchmarks/system-configurations/4.54-ensure-bogus-icmp-responses-are-ignored.md @@ -38,4 +38,3 @@ Nothing should be returned ## 参考 -- cis: ```bash \ No newline at end of file diff --git a/benchmarks/system-configurations/4.55-ensure-reverse-path-filtering-is-enabled.md b/benchmarks/system-configurations/4.55-ensure-reverse-path-filtering-is-enabled.md index 7f20c3d18cc0af702b5c87919f7b0d35266709db..c1b36a0b5f8d03ef24037b8d1b2bb9b52daa9d2a 100644 --- a/benchmarks/system-configurations/4.55-ensure-reverse-path-filtering-is-enabled.md +++ b/benchmarks/system-configurations/4.55-ensure-reverse-path-filtering-is-enabled.md @@ -55,4 +55,3 @@ net.ipv4.conf.default.rp_filter = 1 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.56-ensure-tcp-syn-cookies-is-enabled.md b/benchmarks/system-configurations/4.56-ensure-tcp-syn-cookies-is-enabled.md index b3e3e46730b7cf224fa9b8dbac83b9158a5da401..9c1801687af59103bb96274d36f30e63bc8ef06d 100644 --- a/benchmarks/system-configurations/4.56-ensure-tcp-syn-cookies-is-enabled.md +++ b/benchmarks/system-configurations/4.56-ensure-tcp-syn-cookies-is-enabled.md @@ -38,4 +38,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.57-ensure-ipv6-router-advertisements-are-not-accepted.md b/benchmarks/system-configurations/4.57-ensure-ipv6-router-advertisements-are-not-accepted.md index c3e6887f1fed05b5e0e59bb0e01629da50da7466..3a14d9e008aecbf2be871f07540eb7a23612a5fc 100644 --- a/benchmarks/system-configurations/4.57-ensure-ipv6-router-advertisements-are-not-accepted.md +++ b/benchmarks/system-configurations/4.57-ensure-ipv6-router-advertisements-are-not-accepted.md @@ -51,4 +51,3 @@ net.ipv6.conf.default.accept_ra = 0 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.58-ensure-a-firewall-package-is-installed.md b/benchmarks/system-configurations/4.58-ensure-a-firewall-package-is-installed.md index 13bbc47a19223e93fdafa905f3e2300952492783..dedd6b8477448f20c96db9a6888dcd274b041b25 100644 --- a/benchmarks/system-configurations/4.58-ensure-a-firewall-package-is-installed.md +++ b/benchmarks/system-configurations/4.58-ensure-a-firewall-package-is-installed.md @@ -66,4 +66,3 @@ iptables- ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.59-ensure-firewalld-service-is-enabled-and-running.md b/benchmarks/system-configurations/4.59-ensure-firewalld-service-is-enabled-and-running.md index 283252af15bca8af7c879a71319e26049227bd4a..e3420ccf77f4e08d501a72a181b35caa6390eba9 100644 --- a/benchmarks/system-configurations/4.59-ensure-firewalld-service-is-enabled-and-running.md +++ b/benchmarks/system-configurations/4.59-ensure-firewalld-service-is-enabled-and-running.md @@ -40,4 +40,3 @@ running ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.6-ensure-permissions-on-etc-issue.net-are-configured.md b/benchmarks/system-configurations/4.6-ensure-permissions-on-etc-issue.net-are-configured.md index 85a6f5a7acf299425e044457d7f9e00371b3e06c..fc27f6e3ed2e505b5f1c822d475a2dfe9e953755 100644 --- a/benchmarks/system-configurations/4.6-ensure-permissions-on-etc-issue.net-are-configured.md +++ b/benchmarks/system-configurations/4.6-ensure-permissions-on-etc-issue.net-are-configured.md @@ -36,4 +36,3 @@ Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.60-ensure-iptables-is-not-enabled.md b/benchmarks/system-configurations/4.60-ensure-iptables-is-not-enabled.md index 43dca54554b6e62b4a2017f51206c4f45679e170..75355f342703b2b141d8d87705c540f8d5b560e5 100644 --- a/benchmarks/system-configurations/4.60-ensure-iptables-is-not-enabled.md +++ b/benchmarks/system-configurations/4.60-ensure-iptables-is-not-enabled.md @@ -45,4 +45,3 @@ iptables 是集成在 Linux 内核中的包过滤防火墙系统。使用 iptabl ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.61-ensure-nftables-is-not-enabled.md b/benchmarks/system-configurations/4.61-ensure-nftables-is-not-enabled.md index 63bb003c2913984bc9708ff9689807cf51f1ce94..226032053e59133aae483c4ea3cd77eda2e379f2 100644 --- a/benchmarks/system-configurations/4.61-ensure-nftables-is-not-enabled.md +++ b/benchmarks/system-configurations/4.61-ensure-nftables-is-not-enabled.md @@ -59,4 +59,3 @@ nftables 提供了一个新的包过滤框架，该框架基于特定于网络 ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.62-ensure-nftables-service-is-enabled.md b/benchmarks/system-configurations/4.62-ensure-nftables-service-is-enabled.md index 8f091166bb137cfd60340efb8825df9a0e24643a..c087da6254668449cb3ae9113a481476037dd9fe 100644 --- a/benchmarks/system-configurations/4.62-ensure-nftables-service-is-enabled.md +++ b/benchmarks/system-configurations/4.62-ensure-nftables-service-is-enabled.md @@ -49,4 +49,3 @@ enabled ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.63-ensure-iptables-packages-are-installed.md b/benchmarks/system-configurations/4.63-ensure-iptables-packages-are-installed.md index 637b73a331d52440246495770eecd7247f17c8e1..cdd2b2c9c7ed7950c3f5e43d1480ce01d3947117 100644 --- a/benchmarks/system-configurations/4.63-ensure-iptables-packages-are-installed.md +++ b/benchmarks/system-configurations/4.63-ensure-iptables-packages-are-installed.md @@ -38,4 +38,3 @@ iptables-services- ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.64-ensure-nftables-is-not-installed.md b/benchmarks/system-configurations/4.64-ensure-nftables-is-not-installed.md index 0df6a2cd4e61838ce358cba1ef9857497df14598..b549a78b43641fffb9bb2a587b4680066a87679c 100644 --- a/benchmarks/system-configurations/4.64-ensure-nftables-is-not-installed.md +++ b/benchmarks/system-configurations/4.64-ensure-nftables-is-not-installed.md @@ -51,4 +51,3 @@ package nftables is not installed ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.65-ensure-firewalld-is-not-installed-or-stopped-and-masked.md b/benchmarks/system-configurations/4.65-ensure-firewalld-is-not-installed-or-stopped-and-masked.md index b90b57dfd2e93754ec57539a4a0d64c9d9847c94..9074eb33a37df783f4d8a89b422e97c19ee41d5a 100644 --- a/benchmarks/system-configurations/4.65-ensure-firewalld-is-not-installed-or-stopped-and-masked.md +++ b/benchmarks/system-configurations/4.65-ensure-firewalld-is-not-installed-or-stopped-and-masked.md @@ -56,4 +56,3 @@ masked ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.7-ensure-gpgcheck-is-globally-activated.md b/benchmarks/system-configurations/4.7-ensure-gpgcheck-is-globally-activated.md index 661c71091220dfa336a8eda7d141c4357a5a74c4..3d0f1ea50918cb3c8dc3829068e6bb2a4e914e97 100644 --- a/benchmarks/system-configurations/4.7-ensure-gpgcheck-is-globally-activated.md +++ b/benchmarks/system-configurations/4.7-ensure-gpgcheck-is-globally-activated.md @@ -48,4 +48,3 @@ No information is returned. ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.70-ensure-xdmcp-is-not-enabled.md b/benchmarks/system-configurations/4.70-ensure-xdmcp-is-not-enabled.md index ead255b80846175b041be363aa815f38eab55ce6..96b12616a78cbe2c83c4e6c42e301acdb5c07cd8 100644 --- a/benchmarks/system-configurations/4.70-ensure-xdmcp-is-not-enabled.md +++ b/benchmarks/system-configurations/4.70-ensure-xdmcp-is-not-enabled.md @@ -33,4 +33,3 @@ Nothing should be returned ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.71-ensure-nosuid-option-set-on-var-partition-Automated.md b/benchmarks/system-configurations/4.71-ensure-nosuid-option-set-on-var-partition-Automated.md index fe906bc04a8d55505f09a6cf023546037c60b9b4..8bb45bfb808581154e9e01ccee656e6cf0c7f519 100644 --- a/benchmarks/system-configurations/4.71-ensure-nosuid-option-set-on-var-partition-Automated.md +++ b/benchmarks/system-configurations/4.71-ensure-nosuid-option-set-on-var-partition-Automated.md @@ -58,4 +58,3 @@ nosuid ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.8-ensure-aide-is-installed.md b/benchmarks/system-configurations/4.8-ensure-aide-is-installed.md index 367a0b2d0bdbbde29b976cefc9fc9726b8f42c96..61f6a7f4cabfdcb90e41c7424b7ed66b72876724 100644 --- a/benchmarks/system-configurations/4.8-ensure-aide-is-installed.md +++ b/benchmarks/system-configurations/4.8-ensure-aide-is-installed.md @@ -43,4 +43,3 @@ aide- ## 参考 -- cis: \ No newline at end of file diff --git a/benchmarks/system-configurations/4.9-ensure-filesystem-integrity-is-regularly-checked.md b/benchmarks/system-configurations/4.9-ensure-filesystem-integrity-is-regularly-checked.md index 03660c3b79eb5517e9039b7e4384df0431d0257b..fc5f4508d41fd70483b295b6834e5e7df799862c 100644 --- a/benchmarks/system-configurations/4.9-ensure-filesystem-integrity-is-regularly-checked.md +++ b/benchmarks/system-configurations/4.9-ensure-filesystem-integrity-is-regularly-checked.md @@ -63,4 +63,3 @@ aide- ## 参考 -- cis: \ No newline at end of file diff --git a/docs/openscap-usage-guide/openscap-usage-guide.md b/docs/openscap-usage-guide/openscap-usage-guide.md index a027d1b17a78a807f69e5b3642efd4e27f206082..404f5142bcc1a82347abb8d2ddf8b870c3e66108 100644 --- a/docs/openscap-usage-guide/openscap-usage-guide.md +++ b/docs/openscap-usage-guide/openscap-usage-guide.md @@ -1,7 +1,7 @@ # openscap 使用指南 ## 背景及简介 -- Anolis OS 安全最佳实践基线是由龙蜥社区系统安全委员会SIG，联合阿里云、统信软件等SIG成员，基于最新Anolis OS发行版联合发布的。该最佳实践基于 Anolis OS 下游发行版 Alibaba Cloud Linux 3 和 UOS Server v20 大规模产品落地的安全经验和实践进行打造，兼容 CIS（Center for Internet Security）、等保 2.0 等安全标准的安全保护基本要求，包括access-and-control、logging-and-auditing、services、 system-configurations、mandatory-access-control等五个方面共150多条内容，以安全基线的形式为社区用户提供配置各种安全功能的指南，帮助企业和组织对安全风险做出更清晰的决策。 +- Anolis OS 安全最佳实践基线是由龙蜥社区系统安全委员会SIG，联合阿里云、统信软件等SIG成员，基于最新Anolis OS发行版联合发布的。该最佳实践基于 Anolis OS 下游发行版 Alibaba Cloud Linux 3 和 UOS Server v20 大规模产品落地的安全经验和实践进行打造，兼容等保 2.0 安全标准的安全保护基本要求，包括access-and-control、logging-and-auditing、services、 system-configurations、mandatory-access-control等五个方面共150多条内容，以安全基线的形式为社区用户提供配置各种安全功能的指南，帮助企业和组织对安全风险做出更清晰的决策。 - SCAP（Security Content Automation Protocol：安全内容自动化协议）由NIST（National Institute of Standards and Technology：美国国家标准与技术研究院）提出，NIST期望利用SCAP解决三个棘手的问题：一是实现高层政策法规（如FISMA，ISO27000系列）等到底层实施的落地，二是将信息安全所涉及的各个要素标准化（如统一漏洞的命名及严重性度量），三是将复杂的系统配置核查工作自动化。SCAP是当前美国比较成熟的一套信息安全评估标准体系，其标准化、自动化的思想对信息安全行业产生了深远的影响。 diff --git a/examples/benchmarks/services/3.1-disable-http-server.md b/examples/benchmarks/services/3.1-disable-http-server.md index 83328695d7ec6c3b3bfb3d5c263c621ef6bcbdb3..5a18e8f616ced9d09c7b000c92a3732c72dcf170 100644 --- a/examples/benchmarks/services/3.1-disable-http-server.md +++ b/examples/benchmarks/services/3.1-disable-http-server.md @@ -30,4 +30,3 @@ HTTP 或 Web 服务器提供托管网站内容的能力。 ## 参考 -- cis: diff --git a/tools/remediation-kits/README.md b/tools/remediation-kits/README.md index a8db9d236bff0861b33c867bb2ebafc8a8b135ae..a6967299c882fe1f7c45724eb019492ec364d456 100644 --- a/tools/remediation-kits/README.md +++ b/tools/remediation-kits/README.md @@ -12,8 +12,6 @@ - Reference_DengBaoThree.config -- 此 config 文件包含的编号为：已发布的 benchmark 中参考了 等保2.0三级 标准的规则。其中包含 level 3 的规则，需谨慎使用 -- Reference_CIS.config -- 此 config 文件包含的编号为：已发布的 benchmark 中参考了 CIS 标准的规则。具体可在 benchmark Markdown 文档的参考一项中查看 - - run_Anolis_remediation_kit.sh -- 可执行文件，用于调用加固脚本对系统进行加固 - config（目录） -- 用于存放config文件 @@ -58,7 +56,7 @@ config文件建议存放在`security-benchmark/tools/remediation-kits/config`目 1.4 ... ``` -![img](./img/config文件.png) +![img](./img/加固config文件展示.png) 注意： @@ -71,7 +69,7 @@ config文件建议存放在`security-benchmark/tools/remediation-kits/config`目 3. 执行脚本： - 直接执行`run_Anolis_remediation_kit.sh`加固脚本，将默认使用`config`文件夹下`Anolis_security_benchmark_level1.config`配置文件进行加固修复（相当于进行 level-1 等级的加固修复）。 -- `-c`参数可指定任意路径下符合要求的 config 文件（要求详见上节），并使用该文件内包含的加固项目，对系统进行加固修复。如`./config/Anolis_security_benchmark_level2.config`、`./config/Reference_CIS.config`等。 +- `-c`参数可指定任意路径下符合要求的 config 文件（要求详见上节），并使用该文件内包含的加固项目，对系统进行加固修复。如`./config/Anolis_security_benchmark_level2.config`。 - 具体命令可参考下文： ```shell @@ -84,4 +82,4 @@ sh run_Anolis_remediation_kit.sh -c [configfile] ![img](./img/脚本执行-1.png) -![img](./img/脚本执行-2.png) \ No newline at end of file +![img](./img/脚本执行-2.png) diff --git a/tools/remediation-kits/config/Reference_CIS.config b/tools/remediation-kits/config/Reference_CIS.config deleted file mode 100644 index 4963f7e7a25bdef47aa8bd9b63545bad52e7aa5e..0000000000000000000000000000000000000000 --- a/tools/remediation-kits/config/Reference_CIS.config +++ /dev/null @@ -1,79 +0,0 @@ -1.2 -1.3 -1.4 -1.5 -1.6 -1.7 -1.8 -1.14 -1.17 -1.20 -1.21 -1.22 -1.24 -1.27 -1.28 -1.29 -1.31 -1.32 -1.34 -1.36 -1.37 -1.39 -1.40 -1.50 -1.51 -1.52 -1.53 -2.11 -2.14 -2.16 -2.17 -2.18 -2.24 -2.25 -2.26 -3.1 -3.2 -3.3 -3.4 -3.5 -3.6 -3.7 -3.8 -3.9 -3.10 -3.11 -3.12 -3.13 -3.14 -3.15 -3.22 -3.25 -3.26 -3.27 -3.28 -4.2 -4.3 -4.7 -4.8 -4.9 -4.11 -4.13 -4.44 -4.45 -4.46 -4.47 -4.48 -4.49 -4.50 -4.51 -4.52 -4.55 -4.57 -4.59 -4.62 -4.63 -4.64 -4.1 -4.71 diff --git "a/tools/remediation-kits/img/config\346\226\207\344\273\266.png" "b/tools/remediation-kits/img/config\346\226\207\344\273\266.png" deleted file mode 100644 index 8fa734d8f4e9095db49cfdec4735664f16c767fb..0000000000000000000000000000000000000000 Binary files "a/tools/remediation-kits/img/config\346\226\207\344\273\266.png" and /dev/null differ diff --git "a/tools/remediation-kits/img/\345\212\240\345\233\272config\346\226\207\344\273\266\345\261\225\347\244\272.png" "b/tools/remediation-kits/img/\345\212\240\345\233\272config\346\226\207\344\273\266\345\261\225\347\244\272.png" new file mode 100644 index 0000000000000000000000000000000000000000..8d53f53b6b86d37c8228fe98b90055fbde722143 Binary files /dev/null and "b/tools/remediation-kits/img/\345\212\240\345\233\272config\346\226\207\344\273\266\345\261\225\347\244\272.png" differ diff --git a/tools/scanners/README.md b/tools/scanners/README.md index 2e00e603acaea4a6f71dc1044f4be61e39c12b61..a7a9ab0bdf7072243a3b57dd41c48c3c97f80ff1 100644 --- a/tools/scanners/README.md +++ b/tools/scanners/README.md @@ -12,8 +12,6 @@ - Reference_DengBaoThree.config -- 此 config 文件包含的编号为：已发布的 benchmark 中参考了 等保2.0三级 标准的规则 -- Reference_CIS.config -- 此 config 文件包含的编号为：已发布的 benchmark 中参考了 CIS 标准的规则。具体可在 benchmark Markdown 文档的参考一项中查看 - - run_Anolis_scanners.sh -- 可执行文件，用于调用扫描脚本对系统进行安全合规扫描 - config（目录） -- 用于存放config文件 @@ -58,7 +56,7 @@ config文件建议存放在`security-benchmark/tools/scanners/config`目录下 1.4 ... ``` -![img](./img/查看config文件.png) +![img](./img/扫描config文件展示.png) 注意： @@ -70,7 +68,7 @@ config文件建议存放在`security-benchmark/tools/scanners/config`目录下 - 直接执行`run_Anolis_scanners.sh`扫描脚本，将默认使用`config`文件夹下`Anolis_security_benchmark_level1.config`配置文件进行合规扫描（相当于进行 level-1 等级的合规扫描）。 - `-l`参数可指定“龙蜥最佳安全基线”中 level-1 至 level-4 中任意一个等级，并使用该等级的加固要求，对系统进行合规扫描。 -- `-c`参数可指定任意路径下符合要求的 config 文件（要求详见上节），并使用该文件内包含的加固项目，对系统进行合规扫描。如`./config/Anolis_security_benchmark_level2.config`、`./config/Reference_CIS.config`等。 +- `-c`参数可指定任意路径下符合要求的 config 文件（要求详见上节），并使用该文件内包含的加固项目，对系统进行合规扫描。如`./config/Anolis_security_benchmark_level2.config`。 - 具体命令可参考下文： ```shell @@ -86,4 +84,4 @@ sh run_Anolis_scanners.sh -c [configfile] ![img](./img/脚本执行-1.png) -![img](./img/脚本执行-2.png) \ No newline at end of file +![img](./img/脚本执行-2.png) diff --git a/tools/scanners/config/Reference_CIS.config b/tools/scanners/config/Reference_CIS.config deleted file mode 100644 index 8ca573c7a78a14a7fedd4bc2d7433b7ce6b764e7..0000000000000000000000000000000000000000 --- a/tools/scanners/config/Reference_CIS.config +++ /dev/null @@ -1,154 +0,0 @@ -1.1 -1.2 -1.3 -1.4 -1.5 -1.6 -1.7 -1.8 -1.9 -1.10 -1.11 -1.12 -1.13 -1.14 -1.15 -1.16 -1.17 -1.18 -1.19 -1.20 -1.21 -1.22 -1.23 -1.24 -1.25 -1.26 -1.27 -1.28 -1.29 -1.30 -1.31 -1.32 -1.33 -1.34 -1.35 -1.36 -1.37 -1.38 -1.39 -1.40 -1.50 -1.51 -1.52 -1.53 -2.1 -2.2 -2.3 -2.4 -2.5 -2.6 -2.7 -2.8 -2.9 -2.10 -2.11 -2.12 -2.13 -2.14 -2.15 -2.16 -2.17 -2.18 -2.19 -2.24 -2.25 -2.26 -3.1 -3.2 -3.3 -3.4 -3.5 -3.6 -3.7 -3.8 -3.9 -3.10 -3.11 -3.12 -3.13 -3.14 -3.15 -3.22 -3.25 -3.26 -3.27 -3.28 -4.1 -4.2 -4.3 -4.4 -4.5 -4.6 -4.7 -4.8 -4.9 -4.10 -4.11 -4.12 -4.13 -4.14 -4.15 -4.16 -4.17 -4.18 -4.19 -4.20 -4.21 -4.22 -4.23 -4.24 -4.25 -4.26 -4.27 -4.28 -4.29 -4.30 -4.31 -4.32 -4.33 -4.34 -4.35 -4.36 -4.37 -4.38 -4.39 -4.40 -4.41 -4.42 -4.43 -4.44 -4.45 -4.46 -4.47 -4.48 -4.49 -4.50 -4.51 -4.52 -4.53 -4.54 -4.55 -4.56 -4.57 -4.58 -4.59 -4.60 -4.61 -4.62 -4.63 -4.64 -4.65 -4.70 -4.71 -5.9 \ No newline at end of file diff --git "a/tools/scanners/img/\346\211\253\346\217\217config\346\226\207\344\273\266\345\261\225\347\244\272.png" "b/tools/scanners/img/\346\211\253\346\217\217config\346\226\207\344\273\266\345\261\225\347\244\272.png" new file mode 100644 index 0000000000000000000000000000000000000000..813a7c5b854cb780f077721332211e0e1530db0b Binary files /dev/null and "b/tools/scanners/img/\346\211\253\346\217\217config\346\226\207\344\273\266\345\261\225\347\244\272.png" differ diff --git "a/tools/scanners/img/\346\237\245\347\234\213config\346\226\207\344\273\266.png" "b/tools/scanners/img/\346\237\245\347\234\213config\346\226\207\344\273\266.png" deleted file mode 100644 index 05558e7b2f9bf06e1c8a66bca2de4c970963c467..0000000000000000000000000000000000000000 Binary files "a/tools/scanners/img/\346\237\245\347\234\213config\346\226\207\344\273\266.png" and /dev/null differ