diff --git a/.github/workflows/verify-ec2.yml b/.github/workflows/verify-ec2.yml
index ef804992a..b41ac931d 100644
--- a/.github/workflows/verify-ec2.yml
+++ b/.github/workflows/verify-ec2.yml
@@ -49,11 +49,11 @@ jobs:
       - name: Run kitchen test
         run: bundle exec kitchen test --destroy=always ${{ matrix.suite }}-rhel-7 || true
       - name: Display our ${{ matrix.suite }} results summary
-        uses: mitre/saf_action@v1
+        uses: mitre/saf_action@main
         with:
           command_string: 'view summary -i spec/results/ec2_rhel-7_${{ matrix.suite }}.json'
       - name: Ensure the scan meets our ${{ matrix.suite }} results threshold
-        uses: mitre/saf_action@v1
+        uses: mitre/saf_action@main
         with:
           command_string: 'validate threshold -i spec/results/ec2_rhel-7_${{ matrix.suite }}.json -F ${{ matrix.suite }}.threshold.yml'
       - name: Save Test Result JSON
diff --git a/.github/workflows/verify-vagrant.yml b/.github/workflows/verify-vagrant.yml
index 516610b97..5a6eb99f6 100644
--- a/.github/workflows/verify-vagrant.yml
+++ b/.github/workflows/verify-vagrant.yml
@@ -40,11 +40,11 @@ jobs:
       - name: Run kitchen test
         run: bundle exec kitchen test --destroy=always ${{ matrix.suite }}-rhel-7 || true
       - name: Display our ${{ matrix.suite }} results summary
-        uses: mitre/saf_action@v1
+        uses: mitre/saf_action@main
         with:
           command_string: 'view summary -i spec/results/rhel-7_${{ matrix.suite }}.json'
       - name: Ensure the scan meets our ${{ matrix.suite }} results threshold
-        uses: mitre/saf_action@v1
+        uses: mitre/saf_action@main
         with:
           command_string: 'validate threshold -i spec/results/rhel-7_${{ matrix.suite }}.json -F ${{ matrix.suite }}.threshold.yml'
       - name: Save Test Result JSON
diff --git a/README.md b/README.md
index 962598190..eda1d40a2 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # red-hat-enterprise-linux-7-stig-baseline
 
-InSpec profile to validate the secure configuration of Red Hat Enterprise Linux 7 against [DISA's](https://iase.disa.mil/stigs/Pages/index.aspx) Red Hat Enterprise Linux 7 STIG Version 3 Release 6.
+InSpec profile to validate the secure configuration of Red Hat Enterprise Linux 7 against [DISA's](https://public.cyber.mil/stigs/downloads/) Red Hat Enterprise Linux 7 STIG Version 3 Release 10.
 
 ## Getting Started  
 It is intended and recommended that InSpec and this profile be run from a __"runner"__ host (such as a DevOps orchestration server, an administrative management system, or a developer's workstation/laptop) against the target remotely over __ssh__.
@@ -14,8 +14,8 @@ Latest versions and installation options are available at the [InSpec](http://in
 The following inputs may be configured in an inputs ".yml" file for the profile to run correctly for your specific environment. More information about InSpec inputs can be found in the [InSpec Profile Documentation](https://www.inspec.io/docs/reference/profiles/).
 
 ```yaml
-# Used by InSpec checks V-71849, V-71855, V-72037
-# InSpec Tests that are known to consistently have long run times (V-71849, V-71855, V-72037) can be disabled with this attribute
+# Used by InSpec checks SV-204392, SV-204478, SV-214799
+# InSpec Tests that are known to consistently have long run times can be disabled with this attribute
 # Acceptable values: false, true
 # (default: false)
 disable_slow_controls: 
@@ -24,11 +24,11 @@ disable_slow_controls:
 # (default: true)
 monitor_kernel_log: 
 
-# Used by InSpec check V-71849
+# Used by InSpec check SV-204392
 # list of system files that should be allowed to change from an rpm verify point of view
 rpm_verify_perms_except: []
 
-# Used by InSpec check V-71855
+# Used by InSpec check SV-214799
 # list of system files that should be allowed to change from an rpm verify point of view
 rpm_verify_integrity_except: []
 
@@ -36,15 +36,11 @@ rpm_verify_integrity_except: []
 # (default: true)
 banner_message_enabled: 
 
-# Used by InSpec check V-72211 (default: false)
+# Used by InSpec check SV-204575 (default: false)
 # Do NOT set to 'true' UNLESS the server is documented as being used as a log aggregation server. 
 log_aggregation_server: 
 
-# Used by InSpec check V-72047 (default: [])
-# Known application groups that are allowed to have world-writeable files or directories
-application_groups: []
-
-# Used by InSpec check V-72307 (default: false)
+# Used by InSpec check SV-204624 (default: false)
 # Do NOT set to 'true' UNLESS use of X Windows System is documented and approved. 
 x11_enabled: 
 
@@ -84,9 +80,6 @@ difok: 8
 # Number of reuse generations
 min_reuse_generations: 5
 
-# Number of characters
-min_len: 15
-
 # Number of days
 days_of_inactivity: 0
 
@@ -105,54 +98,47 @@ file_integrity_tool: ''
 # Interval to run the file integrity tool (monthly, weekly, or daily).
 file_integrity_interval: ''
 
+# Used by InSpec checks SV-204498 SV-204499 SV-204500 (default: "/etc/aide.conf")
+# Path to the aide.conf file
+aide_conf_path:
+
 # System activity timeout (time in seconds).
 system_activity_timeout: 600
 
 # Client alive interval (time in seconds).
 client_alive_interval: 600
 
-# V-71965, V-72417, V-72433
+# SV-204441, SV-204631, SV-204633
 # (enabled or disabled)
 smart_card_status: "enabled"
 
-# V-72051/V-72209
+# SV-204489, SV-204574
 # The path to the logging package
 log_pkg_path: "/etc/rsyslog.conf"
 
-# V-72011, V-72015, V-72017, V-72019, V-72021, V-72023, V-72025
-# V-72027, V-72029, V-72031, V-72033, V-72035, V-72037, V-72059
-# Users exempt from home directory-based controls in array
-# format
+# SV-204467, SV-204468, SV-204469, SV-204470, SV-204471, SV-204472, SV-204473
+# SV-204474, SV-204475, SV-204476, SV-204477, SV-204478, SV-204493
+# Users exempt from home directory-based controls in array format
 exempt_home_users: []
 
-# V-71961
+# SV-244557
 # main grub boot config file
 grub_main_cfg: ""
 
 # Main grub boot config file
 grub_uefi_main_cfg: ''
 
-# superusers for grub boot ( array )
-grub_superusers: ''
-
 # grub boot config files
 grub_user_boot_files: []
 
-# V-71963
-# superusers for efi boot ( array )
-efi_superusers: []
-
-# V-71971
+# SV-204444
 # system accounts that support approved system activities
 admin_logins: []
 
-# Maximum number of times to prompt user for new password
-max_rety: 3
-
 # The list of packages needed for MFA on RHEL
 mfa_pkg_list: []
 
-# V-77819
+# SV-204397
 # should dconf have smart card authentication (e.g., true or false <- no quotes!)
 multifactor_enabled: true
 
@@ -165,12 +151,12 @@ randomize_va_space: 2
 # File systems that don't correspond to removable media
 non_removable_media_fs: []
 
-# V-72317
+# SV-204629
 # approved configured tunnels prepended with word 'conn'
 # Example: ['conn myTunnel']
 approved_tunnels: []
 
-# V-72039
+# SV-204479
 # Is the target expected to be a virtual machine
 virtual_machine: false
 
@@ -216,30 +202,15 @@ custom_antivirus: false
 # Description of custom antivirus solution, when in use.
 custom_antivirus_description: ''
 
-# Whether an HIPS solution, other than HBSS, is in use.
-custom_hips: false
-
-# Description of custom HIPS solution, when in use.
-custom_hips_description: ''
-
-# Restrict the number of returned processes to account for invalid inputs, such as nil(~), that will match all processes while allowing for 3rd party software that may spawn multiple similarly named processes.
-max_daemon_processes: 1
-
 # It is reasonable and advisable to skip checksum on frequently changing files
 aide_exclude_patterns: []
 
-# A list of acceptable terminal multiplexers
-terminal_mux_pkgs: []
-
 # Required PAM rules
 required_rules: []
 
 # Alternate PAM rules
 alternate_rules: []
 
-# is an HBSS with a Device Control Module and a Data Loss Prevention mechanism
-data_loss_prevention_installed: true
-
 # An alternate method is used for logs than rsyslog
 alternate_logs: false
 
diff --git a/controls/SV-204392.rb b/controls/SV-204392.rb
index 242200818..134e242fb 100644
--- a/controls/SV-204392.rb
+++ b/controls/SV-204392.rb
@@ -1,28 +1,31 @@
+require 'shellwords'
+
 control 'SV-204392' do
   title 'The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership,
     and group membership of system files and commands match the vendor values.'
   desc 'Discretionary access control is weakened if a user or group has access permissions to system files and
     directories greater than the default.'
-  desc 'rationale', ''
-  desc 'check', %q{Verify the file permissions, ownership, and group membership of system files and commands match the
-    vendor values.
-    Check the default file permissions, ownership, and group membership of system files and commands with the following
-    command:
-    # for i in `rpm -Va | egrep '^.{1}M|^.{5}U|^.{6}G' | cut -d " " -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j
-    --dump | cut -d " " -f 1,5,6,7 | grep $i;done;done
-    /var/log/gdm 040755 root root
-    /etc/audisp/audisp-remote.conf 0100640 root root
-    /usr/bin/passwd 0104755 root root
-    For each file returned, verify the current permissions, ownership, and group membership:
-    # ls -la <filename>
-    -rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf
-    If the file is more permissive than the default permissions, this is a finding.
-    If the file is not owned by the default owner and is not documented with the Information System Security Officer
-    (ISSO), this is a finding.
-    If the file is not a member of the default group and is not documented with the Information System Security Officer
-    (ISSO), this is a finding.}
-  desc  'fix', "
-    Run the following command to determine which package owns the file:
+  desc 'check', %q(Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.
+
+Check the default file permissions, ownership, and group membership of system files and commands with the following command:
+
+     # for i in `rpm -Va | grep -E '^.{1}M|^.{5}U|^.{6}G' | cut -d " " -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d " " -f 1,5,6,7 | grep $i;done;done
+
+     /var/log/gdm 040755 root root
+     /etc/audisp/audisp-remote.conf 0100640 root root
+     /usr/bin/passwd 0104755 root root
+
+For each file returned, verify the current permissions, ownership, and group membership:
+     # ls -la <filename>
+
+     -rw-------. 1 root root 2017 Nov 1 10:03 /etc/audisp/audisp-remote.conf
+
+If the file is more permissive than the default permissions, this is a finding.
+
+If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.
+
+If the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.)
+  desc 'fix', 'Run the following command to determine which package owns the file:
 
     # rpm -qf <filename>
 
@@ -34,21 +37,21 @@
 
     Reset the permissions of files within a package with the following command:
 
-    #rpm --setperms <packagename>
-  "
+    #rpm --setperms <packagename>'
   impact 0.7
-  tag 'legacy': ['V-71849', 'SV-86473']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000257-GPOS-00098'
-  tag 'satisfies': ['SRG-OS-000257-GPOS-00098', 'SRG-OS-000278-GPOS-00108']
-  tag 'gid': 'V-204392'
-  tag 'rid': 'SV-204392r646841_rule'
-  tag 'stig_id': 'RHEL-07-010010'
-  tag 'fix_id': 'F-36302r646840_fix'
-  tag 'cci': ['CCI-001494', 'CCI-001496', 'CCI-002165', 'CCI-002235']
+  tag legacy: ['V-71849', 'SV-86473']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000257-GPOS-00098'
+  tag satisfies: ['SRG-OS-000257-GPOS-00098', 'SRG-OS-000278-GPOS-00108']
+  tag gid: 'V-204392'
+  tag rid: 'SV-204392r880752_rule'
+  tag stig_id: 'RHEL-07-010010'
+  tag fix_id: 'F-36302r880751_fix'
+  tag cci: ['CCI-001494', 'CCI-001496', 'CCI-002165', 'CCI-002235']
   tag nist: ['AU-9', 'AU-9 (3)', 'AC-3 (4)', 'AC-6 (10)']
   tag subsystems: ['permissions', 'package', 'rpm']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if input('disable_slow_controls')
     describe "This control consistently takes a long time to run and has been disabled
@@ -58,23 +61,31 @@
             full accredidation for production."
     end
   else
+    ownership_allowlist = input('rpm_verify_ownership_except')
+    group_membership_allowlist = input('rpm_verify_group_membership_except')
 
-    allowlist = input('rpm_verify_perms_except')
-
-    misconfigured_packages = command('rpm -Va').stdout.split("\n")
-                                               .select { |package| package[0..7].match(/M|U|G/) }
-                                               .map { |package| package.match(/\S+$/)[0] }
+    identified_files = command('rpm -Va | awk \'/^.{1}M|^.{5}U|^.{6}G/ {print $NF}\'').stdout.split("\n")
 
-    if misconfigured_packages.empty?
-      describe 'The list of rpm packages with permissions changed from the vendor values' do
-        subject { misconfigured_packages }
+    if identified_files.empty?
+      describe 'The list of system files and commands with permissions, ownership, or group membership changed from the vendor values' do
+        subject { identified_files }
         it { should be_empty }
       end
     else
-      describe 'The list of rpm packages with permissions changed from the vendor values' do
-        fail_msg = "Files that have been modified from vendor-approved permissions but are not in the allowlist: #{(misconfigured_packages - allowlist).join(', ')}"
-        it 'should all appear in the allowlist' do
-          expect(misconfigured_packages).to all(be_in allowlist), fail_msg
+      misconfigured_packages = identified_files.flat_map { |f| command("rpm -qf #{f}").stdout.split("\n") }.uniq
+      potentially_misconfigured_files = misconfigured_packages.flat_map { |p| command("rpm -ql #{p} --dump").stdout.split("\n") }.uniq.map(&:shellsplit)
+      potentially_misconfigured_files.each do |path, size, mtime, digest, mode, owner, group, isconfig, isdoc, rdev, symlink|
+        file_obj = file(path)
+        if file_obj.exist?
+          describe file_obj do
+            it { should_not be_more_permissive_than(mode) }
+            unless ownership_allowlist.include? path
+              it { should be_owned_by owner }
+            end
+            unless group_membership_allowlist.include? path
+              it { should be_grouped_into group }
+            end
+          end
         end
       end
     end
diff --git a/controls/SV-204393.rb b/controls/SV-204393.rb
index 63fc69736..c0afefea2 100644
--- a/controls/SV-204393.rb
+++ b/controls/SV-204393.rb
@@ -22,7 +22,6 @@
     monitoring of the content of privileged communications, or work product, related to personal representation or
     services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are
     private and confidential. See User Agreement for details."'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before
     granting access to the operating system via a graphical user logon.
     Note: If the system does not have GNOME installed, this requirement is Not Applicable.
@@ -43,16 +42,15 @@
     # dconf update
     Users must log out and back in again before the system-wide settings take effect.'
   impact 0.5
-  tag 'legacy': ['V-71859', 'SV-86483']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000023-GPOS-00006'
-  tag 'satisfies': ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007',
-                    'SRG-OS-000228-GPOS-00088']
-  tag 'gid': 'V-204393'
-  tag 'rid': 'SV-204393r603261_rule'
-  tag 'stig_id': 'RHEL-07-010030'
-  tag 'fix_id': 'F-4517r88372_fix'
-  tag 'cci': ['CCI-000048']
+  tag legacy: ['V-71859', 'SV-86483']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000023-GPOS-00006'
+  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007', 'SRG-OS-000228-GPOS-00088']
+  tag gid: 'V-204393'
+  tag rid: 'SV-204393r603261_rule'
+  tag stig_id: 'RHEL-07-010030'
+  tag fix_id: 'F-4517r88372_fix'
+  tag cci: ['CCI-000048']
   tag nist: ['AC-8 a']
   tag subsystems: ['gui', 'banner']
 
diff --git a/controls/SV-204394.rb b/controls/SV-204394.rb
index 118237ad6..aadac6c37 100644
--- a/controls/SV-204394.rb
+++ b/controls/SV-204394.rb
@@ -21,8 +21,7 @@
     monitoring of the content of privileged communications, or work product, related to personal representation or
     services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are
     private and confidential. See User Agreement for details."'
-  desc 'rationale', ''
-  desc 'check', %q{Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner
+  desc 'check', %q(Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner
     before granting access to the operating system via a graphical user logon.
     Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.
     Check that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text
@@ -42,8 +41,8 @@
     representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and
     work product are private and confidential. See User Agreement for details. '
     Note: The "\n " characters are for formatting only. They will not be displayed on the Graphical User Interface.
-    If the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.}
-  desc 'fix', %q{Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent
+    If the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.)
+  desc 'fix', %q(Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent
     Banner before granting access to the system.
     Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.
     Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the
@@ -66,18 +65,17 @@
     communications and work product are private and confidential. See User Agreement for details. '
     Note: The "\n " characters are for formatting only. They will not be displayed on the Graphical User Interface.
     Run the following command to update the database:
-    # dconf update}
+    # dconf update)
   impact 0.5
-  tag 'legacy': ['V-71861', 'SV-86485']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000023-GPOS-00006'
-  tag 'satisfies': ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007',
-                    'SRG-OS-000228-GPOS-00088']
-  tag 'gid': 'V-204394'
-  tag 'rid': 'SV-204394r603261_rule'
-  tag 'stig_id': 'RHEL-07-010040'
-  tag 'fix_id': 'F-4518r297479_fix'
-  tag 'cci': ['CCI-000048']
+  tag legacy: ['V-71861', 'SV-86485']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000023-GPOS-00006'
+  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007', 'SRG-OS-000228-GPOS-00088']
+  tag gid: 'V-204394'
+  tag rid: 'SV-204394r603261_rule'
+  tag stig_id: 'RHEL-07-010040'
+  tag fix_id: 'F-4518r297479_fix'
+  tag cci: ['CCI-000048']
   tag nist: ['AC-8 a']
   tag subsystems: ['gdm']
   tag 'host'
diff --git a/controls/SV-204395.rb b/controls/SV-204395.rb
index f18edbfdb..1c9d513f6 100644
--- a/controls/SV-204395.rb
+++ b/controls/SV-204395.rb
@@ -22,7 +22,6 @@
     monitoring of the content of privileged communications, or work product, related to personal representation or
     services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are
     private and confidential. See User Agreement for details."'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before
     granting access to the operating system via a command line user logon.
     Check to see if the operating system displays a banner at the command line logon screen with the following command:
@@ -64,15 +63,15 @@
     services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are
     private and confidential.  See User Agreement for details."'
   impact 0.5
-  tag 'legacy': ['V-71863', 'SV-86487']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000023-GPOS-00006'
-  tag 'satisfies': ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007']
-  tag 'gid': 'V-204395'
-  tag 'rid': 'SV-204395r603261_rule'
-  tag 'stig_id': 'RHEL-07-010050'
-  tag 'fix_id': 'F-4519r88378_fix'
-  tag 'cci': ['CCI-000048']
+  tag legacy: ['V-71863', 'SV-86487']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000023-GPOS-00006'
+  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007']
+  tag gid: 'V-204395'
+  tag rid: 'SV-204395r603261_rule'
+  tag stig_id: 'RHEL-07-010050'
+  tag fix_id: 'F-4519r88378_fix'
+  tag cci: ['CCI-000048']
   tag nist: ['AC-8 a']
   tag subsystems: ['banner', '/etc/issue']
   tag 'host'
diff --git a/controls/SV-204396.rb b/controls/SV-204396.rb
index f7243419b..ecb56139c 100644
--- a/controls/SV-204396.rb
+++ b/controls/SV-204396.rb
@@ -6,16 +6,17 @@
     The session lock is implemented at the point where session activity can be determined.
     Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in
     place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.'
-  desc 'rationale', ''
-  desc 'check', %q(Verify the operating system enables a user's session lock until that user re-establishes access
-    using established identification and authentication procedures. The screen program must be installed to lock
-    sessions on the console.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable.
-    Check to see if the screen lock is enabled with the following command:
-    # grep -i lock-enabled /etc/dconf/db/local.d/*
-    lock-enabled=true
-    If the "lock-enabled" setting is missing or is not set to "true", this is a finding.)
-  desc 'fix', %q{Configure the operating system to enable a user's session lock until that user re-establishes access
+  desc 'check', %q(Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+Check to see if the screen lock is enabled with the following command:
+
+     # grep -ir lock-enabled /etc/dconf/db/local.d/ | grep -v locks
+     lock-enabled=true
+
+If the "lock-enabled" setting is missing or is not set to "true", this is a finding.)
+  desc 'fix', %q(Configure the operating system to enable a user's session lock until that user re-establishes access
     using established identification and authentication procedures.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
     example:
@@ -25,17 +26,17 @@
     lock-enabled=true
     Update the system databases:
     # dconf update
-    Users must log out and back in again before the system-wide settings take effect. }
+    Users must log out and back in again before the system-wide settings take effect.)
   impact 0.5
-  tag 'legacy': ['SV-86515', 'V-71891']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000028-GPOS-00009'
-  tag 'satisfies': ['SRG-OS-000028-GPOS-00009', 'SRG-OS-000030-GPOS-00011']
-  tag 'gid': 'V-204396'
-  tag 'rid': 'SV-204396r603261_rule'
-  tag 'stig_id': 'RHEL-07-010060'
-  tag 'fix_id': 'F-4520r88381_fix'
-  tag 'cci': ['CCI-000056']
+  tag legacy: ['SV-86515', 'V-71891']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000028-GPOS-00009'
+  tag satisfies: ['SRG-OS-000028-GPOS-00009', 'SRG-OS-000030-GPOS-00011']
+  tag gid: 'V-204396'
+  tag rid: 'SV-204396r880746_rule'
+  tag stig_id: 'RHEL-07-010060'
+  tag fix_id: 'F-4520r880745_fix'
+  tag cci: ['CCI-000056']
   tag nist: ['AC-11 b']
   tag subsystems: ['session', 'lock', 'gui', 'screensaver']
   tag 'host'
diff --git a/controls/SV-204397.rb b/controls/SV-204397.rb
index 45d631933..fca2c483c 100644
--- a/controls/SV-204397.rb
+++ b/controls/SV-204397.rb
@@ -6,7 +6,6 @@
     Multifactor solutions that require devices separate from information systems gaining access include, for example,
     hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.
     Government Personal Identity Verification card and the DoD Common Access Card.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system uniquely identifies and authenticates users using multifactor
     authentication via a graphical user logon.
     Note: If the system does not have GNOME installed, this requirement is Not Applicable.
@@ -30,15 +29,16 @@
     enable-smartcard-authentication=true
     Update the system databases:
     # dconf update'
-  tag 'legacy': ['V-77819', 'SV-92515']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000375-GPOS-00160'
-  tag 'satisfies': ['SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']
-  tag 'gid': 'V-204397'
-  tag 'rid': 'SV-204397r603261_rule'
-  tag 'stig_id': 'RHEL-07-010061'
-  tag 'fix_id': 'F-4521r88384_fix'
-  tag 'cci': ['CCI-001948', 'CCI-001953', 'CCI-001954']
+  impact 0.5
+  tag legacy: ['V-77819', 'SV-92515']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000375-GPOS-00160'
+  tag satisfies: ['SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']
+  tag gid: 'V-204397'
+  tag rid: 'SV-204397r853879_rule'
+  tag stig_id: 'RHEL-07-010061'
+  tag fix_id: 'F-4521r88384_fix'
+  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']
   tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']
   tag subsystems: ['gui']
   tag 'host'
diff --git a/controls/SV-204398.rb b/controls/SV-204398.rb
index f68a2bbfb..6ceb1dab2 100644
--- a/controls/SV-204398.rb
+++ b/controls/SV-204398.rb
@@ -7,14 +7,16 @@
     operating systems need to be able to identify when a user's session has idled and take action to initiate the
     session lock.
     The session lock is implemented at the point where session activity can be determined and/or controlled."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system initiates a screensaver after a 15-minute period of inactivity for
-    graphical user interfaces. The screen program must be installed to lock sessions on the console.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable.
-    Check to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:
-    # grep -i idle-delay /etc/dconf/db/local.d/*
-    idle-delay=uint32 900
-    If the "idle-delay" setting is missing or is not set to "900" or less, this is a finding.'
+  desc 'check', 'Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+Check to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:
+
+     # grep -i idle-delay /etc/dconf/db/local.d/*
+     idle-delay=uint32 900
+
+If the "idle-delay" setting is missing or is not set to "900" or less, this is a finding.'
   desc 'fix', 'Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for
     graphical user interfaces.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -29,14 +31,14 @@
     # dconf update
     Users must log out and back in again before the system-wide settings take effect.'
   impact 0.5
-  tag 'legacy': ['V-71893', 'SV-86517']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-204398'
-  tag 'rid': 'SV-204398r603261_rule'
-  tag 'stig_id': 'RHEL-07-010070'
-  tag 'fix_id': 'F-4522r88387_fix'
-  tag 'cci': ['CCI-000057']
+  tag legacy: ['V-71893', 'SV-86517']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-204398'
+  tag rid: 'SV-204398r880770_rule'
+  tag stig_id: 'RHEL-07-010070'
+  tag fix_id: 'F-4522r880769_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui', 'screensaver', 'session', 'lock']
   tag 'host'
diff --git a/controls/SV-204399.rb b/controls/SV-204399.rb
index 8417e028d..b1347507c 100644
--- a/controls/SV-204399.rb
+++ b/controls/SV-204399.rb
@@ -7,20 +7,22 @@
     operating systems need to be able to identify when a user's session has idled and take action to initiate the
     session lock.
     The session lock is implemented at the point where session activity can be determined and/or controlled."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute
-    period of inactivity for graphical user interfaces.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be
-    installed to lock sessions on the console.
-    Determine which profile the system database is using with the following command:
-    # grep system-db /etc/dconf/profile/user
-    system-db:local
-    Check for the lock delay setting with the following command:
-    Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This
-    path must be modified if a database other than "local" is being used.
-    # grep -i lock-delay /etc/dconf/db/local.d/locks/*
-    /org/gnome/desktop/screensaver/lock-delay
-    If the command does not return a result, this is a finding.'
+  desc 'check', 'Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+Determine which profile the system database is using with the following command:
+     # grep system-db /etc/dconf/profile/user
+     system-db:local
+
+Check for the lock delay setting with the following command:
+
+Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.
+
+     # grep -i lock-delay /etc/dconf/db/local.d/locks/*
+     /org/gnome/desktop/screensaver/lock-delay
+
+If the command does not return a result, this is a finding.'
   desc 'fix', 'Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute
     period of inactivity for graphical user interfaces.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -30,16 +32,15 @@
     # touch /etc/dconf/db/local.d/locks/session
     Add the setting to lock the screensaver lock delay:
     /org/gnome/desktop/screensaver/lock-delay'
-
   impact 0.5
-  tag 'legacy': ['V-73155', 'SV-87807']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-204399'
-  tag 'rid': 'SV-204399r603261_rule'
-  tag 'stig_id': 'RHEL-07-010081'
-  tag 'fix_id': 'F-4523r88390_fix'
-  tag 'cci': ['CCI-000057']
+  tag legacy: ['V-73155', 'SV-87807']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-204399'
+  tag rid: 'SV-204399r880773_rule'
+  tag stig_id: 'RHEL-07-010081'
+  tag fix_id: 'F-4523r880772_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui']
   tag 'host'
diff --git a/controls/SV-204400.rb b/controls/SV-204400.rb
index ab3ce8398..bd9dacd7c 100644
--- a/controls/SV-204400.rb
+++ b/controls/SV-204400.rb
@@ -7,20 +7,22 @@
     operating systems need to be able to identify when a user's session has idled and take action to initiate the
     session lock.
     The session lock is implemented at the point where session activity can be determined and/or controlled."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system prevents a user from overriding session idle delay after a 15-minute
-    period of inactivity for graphical user interfaces.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be
-    installed to lock sessions on the console.
-    Determine which profile the system database is using with the following command:
-    # grep system-db /etc/dconf/profile/user
-    system-db:local
-    Check for the session idle delay setting with the following command:
-    Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This
-    path must be modified if a database other than "local" is being used.
-    # grep -i idle-delay /etc/dconf/db/local.d/locks/*
-    /org/gnome/desktop/session/idle-delay
-    If the command does not return a result, this is a finding.'
+  desc 'check', 'Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+Determine which profile the system database is using with the following command:
+     # grep system-db /etc/dconf/profile/user
+     system-db:local
+
+Check for the session idle delay setting with the following command:
+
+Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.
+
+     # grep -i idle-delay /etc/dconf/db/local.d/locks/*
+     /org/gnome/desktop/session/idle-delay
+
+If the command does not return a result, this is a finding.'
   desc 'fix', 'Configure the operating system to prevent a user from overriding a session lock after a 15-minute
     period of inactivity for graphical user interfaces.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -31,14 +33,14 @@
     Add the setting to lock the session idle delay:
     /org/gnome/desktop/session/idle-delay'
   impact 0.5
-  tag 'legacy': ['V-73157', 'SV-87809']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-204400'
-  tag 'rid': 'SV-204400r603261_rule'
-  tag 'stig_id': 'RHEL-07-010082'
-  tag 'fix_id': 'F-4524r88393_fix'
-  tag 'cci': ['CCI-000057']
+  tag legacy: ['V-73157', 'SV-87809']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-204400'
+  tag rid: 'SV-204400r880776_rule'
+  tag stig_id: 'RHEL-07-010082'
+  tag fix_id: 'F-4524r880775_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui']
   tag 'host'
diff --git a/controls/SV-204402.rb b/controls/SV-204402.rb
index b4d26d779..5d5b72409 100644
--- a/controls/SV-204402.rb
+++ b/controls/SV-204402.rb
@@ -7,14 +7,16 @@
     operating systems need to be able to identify when a user's session has idled and take action to initiate the
     session lock.
     The session lock is implemented at the point where session activity can be determined and/or controlled."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system initiates a session lock after a 15-minute period of inactivity for
-    graphical user interfaces. The screen program must be installed to lock sessions on the console.
-    Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.
-    Check for the session lock settings with the following commands:
-    # grep -i idle-activation-enabled /etc/dconf/db/local.d/*
-    idle-activation-enabled=true
-    If "idle-activation-enabled" is not set to "true", this is a finding.'
+  desc 'check', 'Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces.
+
+Note: If the system does not have a GNOME installed, this requirement is Not Applicable.
+
+Check for the session lock settings with the following commands:
+
+     # grep -i idle-activation-enabled /etc/dconf/db/local.d/*
+     idle-activation-enabled=true
+
+If "idle-activation-enabled" is not set to "true", this is a finding.'
   desc 'fix', 'Configure the operating system to initiate a session lock after a 15-minute period of inactivity for
     graphical user interfaces.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -27,14 +29,14 @@
     # dconf update
     Users must log out and back in again before the system-wide settings take effect.'
   impact 0.5
-  tag 'legacy': ['V-71899', 'SV-86523']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-204402'
-  tag 'rid': 'SV-204402r603261_rule'
-  tag 'stig_id': 'RHEL-07-010100'
-  tag 'fix_id': 'F-4526r88399_fix'
-  tag 'cci': ['CCI-000057']
+  tag legacy: ['V-71899', 'SV-86523']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-204402'
+  tag rid: 'SV-204402r880782_rule'
+  tag stig_id: 'RHEL-07-010100'
+  tag fix_id: 'F-4526r880781_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui', 'session', 'lock']
   tag 'host'
diff --git a/controls/SV-204403.rb b/controls/SV-204403.rb
index b8261f515..22d6b9fa8 100644
--- a/controls/SV-204403.rb
+++ b/controls/SV-204403.rb
@@ -7,20 +7,24 @@
     The ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to
     disengage the graphical user interface session lock provides the assurance that all sessions will lock after the
     specified period of time."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled
-    setting for the graphical user interface.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be
-    installed to lock sessions on the console.
-    Determine which profile the system database is using with the following command:
-    # grep system-db /etc/dconf/profile/user
-    system-db:local
-    Check for the idle-activation-enabled setting with the following command:
-    Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This
-    path must be modified if a database other than "local" is being used.
-    # grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*
-    /org/gnome/desktop/screensaver/idle-activation-enabled
-    If the command does not return a result, this is a finding.'
+  desc 'check', 'Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+Determine which profile the system database is using with the following command:
+     # grep system-db /etc/dconf/profile/user
+
+     system-db:local
+
+Check for the idle-activation-enabled setting with the following command:
+
+Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.
+
+     # grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*
+
+     /org/gnome/desktop/screensaver/idle-activation-enabled
+
+If the command does not return a result, this is a finding.'
   desc 'fix', 'Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute
     period of inactivity for graphical user interfaces.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -30,14 +34,15 @@
     # touch /etc/dconf/db/local.d/locks/session
     Add the setting to lock the screensaver idle-activation-enabled setting:
     /org/gnome/desktop/screensaver/idle-activation-enabled'
-  tag 'legacy': ['V-78997', 'SV-93703']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-204403'
-  tag 'rid': 'SV-204403r603261_rule'
-  tag 'stig_id': 'RHEL-07-010101'
-  tag 'fix_id': 'F-4527r88402_fix'
-  tag 'cci': ['CCI-000057']
+  impact 0.5
+  tag legacy: ['V-78997', 'SV-93703']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-204403'
+  tag rid: 'SV-204403r880785_rule'
+  tag stig_id: 'RHEL-07-010101'
+  tag fix_id: 'F-4527r880784_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui']
   tag 'host'
diff --git a/controls/SV-204404.rb b/controls/SV-204404.rb
index df23d3bd5..00a8bc0e6 100644
--- a/controls/SV-204404.rb
+++ b/controls/SV-204404.rb
@@ -7,16 +7,16 @@
     operating systems need to be able to identify when a user's session has idled and take action to initiate the
     session lock.
     The session lock is implemented at the point where session activity can be determined and/or controlled."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system initiates a session lock a for graphical user interfaces when the
-    screensaver is activated.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be
-    installed to lock sessions on the console.
-    If GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following
-    command:
-    # grep -i lock-delay /etc/dconf/db/local.d/*
-    lock-delay=uint32 5
-    If the "lock-delay" setting is missing, or is not set to "5" or less, this is a finding.'
+  desc 'check', 'Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+If GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:
+
+     # grep -i lock-delay /etc/dconf/db/local.d/*
+     lock-delay=uint32 5
+
+If the "lock-delay" setting is missing, or is not set to "5" or less, this is a finding.'
   desc 'fix', 'Configure the operating system to initiate a session lock for graphical user interfaces when a
     screensaver is activated.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -30,14 +30,14 @@
     # dconf update
     Users must log out and back in again before the system-wide settings take effect.'
   impact 0.5
-  tag 'legacy': ['V-71901', 'SV-86525']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-204404'
-  tag 'rid': 'SV-204404r603261_rule'
-  tag 'stig_id': 'RHEL-07-010110'
-  tag 'fix_id': 'F-4528r88405_fix'
-  tag 'cci': ['CCI-000057']
+  tag legacy: ['V-71901', 'SV-86525']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-204404'
+  tag rid: 'SV-204404r880788_rule'
+  tag stig_id: 'RHEL-07-010110'
+  tag fix_id: 'F-4528r880787_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui', 'screensaver', 'lock', 'session']
   tag 'host'
@@ -50,8 +50,7 @@
   elsif package('gnome-desktop3').installed?
 
     describe command("gsettings get org.gnome.desktop.screensaver lock-delay | cut -d ' ' -f2") do
-      its('stdout.strip') { should cmp input('expected_lock_delay') }
-      its('stdout.strip') { should cmp <= input('max_lock_delay') }
+      its('stdout.strip') { should cmp <= input('lock_delay') }
     end
   else
     impact 0.0
diff --git a/controls/SV-204405.rb b/controls/SV-204405.rb
index 31e32a29e..aa1b5b95a 100644
--- a/controls/SV-204405.rb
+++ b/controls/SV-204405.rb
@@ -4,7 +4,6 @@
   desc 'Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods.
     PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important
     security function could be bypassed if stack entries are not centralized.'
-  desc 'rationale', ''
   desc 'check', 'Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:
     # cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth
     password     substack     system-auth
@@ -13,17 +12,18 @@
     Add the following line to "/etc/pam.d/passwd" (or modify the line to have the required value):
     password     substack    system-auth'
   impact 0.5
-  tag 'legacy': ['SV-95715', 'V-81003']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000069-GPOS-00037'
-  tag 'gid': 'V-204405'
-  tag 'rid': 'SV-204405r603261_rule'
-  tag 'stig_id': 'RHEL-07-010118'
-  tag 'fix_id': 'F-4529r88408_fix'
-  tag 'cci': ['CCI-000192']
+  tag legacy: ['SV-95715', 'V-81003']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000069-GPOS-00037'
+  tag gid: 'V-204405'
+  tag rid: 'SV-204405r603261_rule'
+  tag stig_id: 'RHEL-07-010118'
+  tag fix_id: 'F-4529r88408_fix'
+  tag cci: ['CCI-000192']
   tag subsystems: ['pam', 'password']
   tag nist: ['IA-5 (1) (a)']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe pam('/etc/pam.d/password-auth') do
     its('lines') { should match_pam_rule('password substack system-auth') }
diff --git a/controls/SV-204406.rb b/controls/SV-204406.rb
index 9c919ee8d..d77425513 100644
--- a/controls/SV-204406.rb
+++ b/controls/SV-204406.rb
@@ -5,7 +5,6 @@
     Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing
     and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to
     limit brute-force attacks on the system.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system uses "pwquality" to enforce the password complexity rules.
     Check for the use of "pwquality" with the following command:
     # cat /etc/pam.d/system-auth | grep pam_pwquality
@@ -17,17 +16,18 @@
     password required pam_pwquality.so retry=3
     Note: The value of "retry" should be between "1" and "3".'
   impact 0.5
-  tag 'legacy': ['SV-87811', 'V-73159']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000069-GPOS-00037'
-  tag 'gid': 'V-204406'
-  tag 'rid': 'SV-204406r603261_rule'
-  tag 'stig_id': 'RHEL-07-010119'
-  tag 'fix_id': 'F-4530r88411_fix'
-  tag 'cci': ['CCI-000192']
+  tag legacy: ['SV-87811', 'V-73159']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000069-GPOS-00037'
+  tag gid: 'V-204406'
+  tag rid: 'SV-204406r603261_rule'
+  tag stig_id: 'RHEL-07-010119'
+  tag fix_id: 'F-4530r88411_fix'
+  tag cci: ['CCI-000192']
   tag nist: ['IA-5 (1) (a)']
   tag subsystems: ['pam', 'pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe pam('/etc/pam.d/system-auth') do
     its('lines') { should match_pam_rule("password required pam_pwquality.so retry=#{input('retry')}") }
diff --git a/controls/SV-204407.rb b/controls/SV-204407.rb
index 3cd0d4a13..1cb3029f5 100644
--- a/controls/SV-204407.rb
+++ b/controls/SV-204407.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'Note: The value to require a number of upper-case characters to be set is expressed as a negative
     number in "/etc/security/pwquality.conf".
     Check the value for "ucredit" in "/etc/security/pwquality.conf" with the following command:
@@ -19,17 +18,18 @@
     Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value):
     ucredit = -1'
   impact 0.5
-  tag 'legacy': ['SV-86527', 'V-71903']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000069-GPOS-00037'
-  tag 'gid': 'V-204407'
-  tag 'rid': 'SV-204407r603261_rule'
-  tag 'stig_id': 'RHEL-07-010120'
-  tag 'fix_id': 'F-4531r88414_fix'
-  tag 'cci': ['CCI-000192']
+  tag legacy: ['SV-86527', 'V-71903']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000069-GPOS-00037'
+  tag gid: 'V-204407'
+  tag rid: 'SV-204407r603261_rule'
+  tag stig_id: 'RHEL-07-010120'
+  tag fix_id: 'F-4531r88414_fix'
+  tag cci: ['CCI-000192']
   tag nist: ['IA-5 (1) (a)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
     its('ucredit') { should cmp < 0 }
diff --git a/controls/SV-204408.rb b/controls/SV-204408.rb
index 4f7143409..a4e6cf2be 100644
--- a/controls/SV-204408.rb
+++ b/controls/SV-204408.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'Note: The value to require a number of lower-case characters to be set is expressed as a negative
     number in "/etc/security/pwquality.conf".
     Check the value for "lcredit" in "/etc/security/pwquality.conf" with the following command:
@@ -20,17 +19,18 @@
     in "/etc/security/pwquality.conf":
     lcredit = -1'
   impact 0.5
-  tag 'legacy': ['SV-86529', 'V-71905']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000070-GPOS-00038'
-  tag 'gid': 'V-204408'
-  tag 'rid': 'SV-204408r603261_rule'
-  tag 'stig_id': 'RHEL-07-010130'
-  tag 'fix_id': 'F-4532r88417_fix'
-  tag 'cci': ['CCI-000193']
+  tag legacy: ['SV-86529', 'V-71905']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000070-GPOS-00038'
+  tag gid: 'V-204408'
+  tag rid: 'SV-204408r603261_rule'
+  tag stig_id: 'RHEL-07-010130'
+  tag fix_id: 'F-4532r88417_fix'
+  tag cci: ['CCI-000193']
   tag nist: ['IA-5 (1) (a)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
     its('lcredit') { should cmp < 0 }
diff --git a/controls/SV-204409.rb b/controls/SV-204409.rb
index 858941c0b..b6c80af61 100644
--- a/controls/SV-204409.rb
+++ b/controls/SV-204409.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'Note: The value to require a number of numeric characters to be set is expressed as a negative
     number in "/etc/security/pwquality.conf".
     Check the value for "dcredit" in "/etc/security/pwquality.conf" with the following command:
@@ -19,17 +18,18 @@
     Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value):
     dcredit = -1'
   impact 0.5
-  tag 'legacy': ['SV-86531', 'V-71907']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000071-GPOS-00039'
-  tag 'gid': 'V-204409'
-  tag 'rid': 'SV-204409r603261_rule'
-  tag 'stig_id': 'RHEL-07-010140'
-  tag 'fix_id': 'F-4533r88420_fix'
-  tag 'cci': ['CCI-000194']
+  tag legacy: ['SV-86531', 'V-71907']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000071-GPOS-00039'
+  tag gid: 'V-204409'
+  tag rid: 'SV-204409r603261_rule'
+  tag stig_id: 'RHEL-07-010140'
+  tag fix_id: 'F-4533r88420_fix'
+  tag cci: ['CCI-000194']
   tag nist: ['IA-5 (1) (a)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
     its('dcredit') { should cmp < 0 }
diff --git a/controls/SV-204410.rb b/controls/SV-204410.rb
index 1d7694bf2..bd93c63de 100644
--- a/controls/SV-204410.rb
+++ b/controls/SV-204410.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system enforces password complexity by requiring that at least one special
     character be used.
     Note: The value to require a number of special characters to be set is expressed as a negative number in
@@ -21,17 +20,18 @@
     Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value):
     ocredit = -1'
   impact 0.5
-  tag 'legacy': ['SV-86533', 'V-71909']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000266-GPOS-00101'
-  tag 'gid': 'V-204410'
-  tag 'rid': 'SV-204410r603261_rule'
-  tag 'stig_id': 'RHEL-07-010150'
-  tag 'fix_id': 'F-4534r88423_fix'
-  tag 'cci': ['CCI-001619']
+  tag legacy: ['SV-86533', 'V-71909']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000266-GPOS-00101'
+  tag gid: 'V-204410'
+  tag rid: 'SV-204410r603261_rule'
+  tag stig_id: 'RHEL-07-010150'
+  tag fix_id: 'F-4534r88423_fix'
+  tag cci: ['CCI-001619']
   tag nist: ['IA-5 (1) (a)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
     its('ocredit') { should cmp < 0 }
diff --git a/controls/SV-204411.rb b/controls/SV-204411.rb
index 678ea9b6e..3485faca6 100644
--- a/controls/SV-204411.rb
+++ b/controls/SV-204411.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'The "difok" option sets the number of characters in a password that must not be present in the old
     password.
     Check for the value of the "difok" option in "/etc/security/pwquality.conf" with the following command:
@@ -19,20 +18,20 @@
     Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value):
     difok = 8'
   impact 0.5
-  tag 'legacy': ['V-71911', 'SV-86535']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000072-GPOS-00040'
-  tag 'gid': 'V-204411'
-  tag 'rid': 'SV-204411r603261_rule'
-  tag 'stig_id': 'RHEL-07-010160'
-  tag 'fix_id': 'F-4535r88426_fix'
-  tag 'cci': ['CCI-000195']
+  tag legacy: ['V-71911', 'SV-86535']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000072-GPOS-00040'
+  tag gid: 'V-204411'
+  tag rid: 'SV-204411r603261_rule'
+  tag stig_id: 'RHEL-07-010160'
+  tag fix_id: 'F-4535r88426_fix'
+  tag cci: ['CCI-000195']
   tag nist: ['IA-5 (1) (b)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
-    its('difok') { should cmp input('expected_difok') }
-    its('difok') { should cmp <= input('max_difok') }
+    its('difok') { should cmp >= input('difok') }
   end
 end
diff --git a/controls/SV-204412.rb b/controls/SV-204412.rb
index ed9c47de1..a8145acfb 100644
--- a/controls/SV-204412.rb
+++ b/controls/SV-204412.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'The "minclass" option sets the minimum number of required classes of characters for the new password
     (digits, upper-case, lower-case, others).
     Check for the value of the "minclass" option in "/etc/security/pwquality.conf" with the following command:
@@ -19,20 +18,20 @@
     Add the following line to "/etc/security/pwquality.conf conf" (or modify the line to have the required value):
     minclass = 4'
   impact 0.5
-  tag 'legacy': ['V-71913', 'SV-86537']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000072-GPOS-00040'
-  tag 'gid': 'V-204412'
-  tag 'rid': 'SV-204412r603261_rule'
-  tag 'stig_id': 'RHEL-07-010170'
-  tag 'fix_id': 'F-4536r88429_fix'
-  tag 'cci': ['CCI-000195']
+  tag legacy: ['V-71913', 'SV-86537']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000072-GPOS-00040'
+  tag gid: 'V-204412'
+  tag rid: 'SV-204412r603261_rule'
+  tag stig_id: 'RHEL-07-010170'
+  tag fix_id: 'F-4536r88429_fix'
+  tag cci: ['CCI-000195']
   tag nist: ['IA-5 (1) (b)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
-    its('minclass') { should cmp input('expected_minclass') }
-    its('minclass') { should cmp >= input('min_minclass') }
+    its('minclass') { should cmp >= input('minclass') }
   end
 end
diff --git a/controls/SV-204413.rb b/controls/SV-204413.rb
index e9f6a62e6..3ac90f2ca 100644
--- a/controls/SV-204413.rb
+++ b/controls/SV-204413.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'The "maxrepeat" option sets the maximum number of allowed same consecutive characters in a new
     password.
     Check for the value of the "maxrepeat" option in "/etc/security/pwquality.conf" with the following command:
@@ -19,20 +18,20 @@
     Add the following line to "/etc/security/pwquality.conf conf" (or modify the line to have the required value):
     maxrepeat = 3'
   impact 0.5
-  tag 'legacy': ['SV-86539', 'V-71915']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000072-GPOS-00040'
-  tag 'gid': 'V-204413'
-  tag 'rid': 'SV-204413r603261_rule'
-  tag 'stig_id': 'RHEL-07-010180'
-  tag 'fix_id': 'F-4537r88432_fix'
-  tag 'cci': ['CCI-000195']
+  tag legacy: ['SV-86539', 'V-71915']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000072-GPOS-00040'
+  tag gid: 'V-204413'
+  tag rid: 'SV-204413r603261_rule'
+  tag stig_id: 'RHEL-07-010180'
+  tag fix_id: 'F-4537r88432_fix'
+  tag cci: ['CCI-000195']
   tag nist: ['IA-5 (1) (b)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
-    its('maxrepeat') { should cmp input('expected_passwd_repeats') }
-    its('maxrepeat') { should cmp <= input('max_passwd_repeats') }
+    its('maxrepeat') { should cmp <= input('passwd_repeats') }
   end
 end
diff --git a/controls/SV-204414.rb b/controls/SV-204414.rb
index 8b587664b..603caf5d3 100644
--- a/controls/SV-204414.rb
+++ b/controls/SV-204414.rb
@@ -7,7 +7,6 @@
     Password complexity is one factor of several that determines how long it takes to crack a password. The more complex
     the password, the greater the number of possible combinations that need to be tested before the password is
     compromised.'
-  desc 'rationale', ''
   desc 'check', 'The "maxclassrepeat" option sets the maximum number of allowed same consecutive characters in the
     same class in the new password.
     Check for the value of the "maxclassrepeat" option in "/etc/security/pwquality.conf" with the following command:
@@ -19,20 +18,20 @@
     Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value):
     maxclassrepeat = 4'
   impact 0.5
-  tag 'legacy': ['SV-86541', 'V-71917']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000072-GPOS-00040'
-  tag 'gid': 'V-204414'
-  tag 'rid': 'SV-204414r809186_rule'
-  tag 'stig_id': 'RHEL-07-010190'
-  tag 'fix_id': 'F-4538r88435_fix'
-  tag 'cci': ['CCI-000195']
+  tag legacy: ['SV-86541', 'V-71917']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000072-GPOS-00040'
+  tag gid: 'V-204414'
+  tag rid: 'SV-204414r809186_rule'
+  tag stig_id: 'RHEL-07-010190'
+  tag fix_id: 'F-4538r88435_fix'
+  tag cci: ['CCI-000195']
   tag nist: ['IA-5 (1) (b)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
-    its('maxclassrepeat') { should cmp input('classrepeat') }
     its('maxclassrepeat') { should_not cmp > input('max_classrepeat') }
     its('maxclassrepeat') { should_not cmp <= 0 }
   end
diff --git a/controls/SV-204415.rb b/controls/SV-204415.rb
index 344c74a17..38aa972b8 100644
--- a/controls/SV-204415.rb
+++ b/controls/SV-204415.rb
@@ -4,7 +4,6 @@
   desc 'Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
     If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
     encrypted with a weak algorithm are no more protected than if they are kept in plain text.'
-  desc 'rationale', ''
   desc 'check', 'Verify the PAM system service is configured to store only encrypted representations of passwords.
     The strength of encryption that must be used to hash passwords for all accounts is SHA512.
     Check that the system is configured to create SHA512 hashed passwords with the following command:
@@ -15,33 +14,34 @@
     If the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" configuration files allow for password hashes other
     than SHA512 to be used, this is a finding.'
   desc 'fix', 'Configure the operating system to store only SHA512 encrypted representations of passwords.
-    Add the following line in "/etc/pam.d/system-auth":
-    pam_unix.so sha512 shadow try_first_pass use_authtok
-    Add the following line in "/etc/pam.d/password-auth":
-    pam_unix.so sha512 shadow try_first_pass use_authtok
-    Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program
-    should not be used to update the configurations listed in this requirement.'
+
+Add the following line in "/etc/pam.d/system-auth":
+     pam_unix.so sha512 shadow try_first_pass use_authtok
+
+Add the following line in "/etc/pam.d/password-auth":
+     pam_unix.so sha512 shadow try_first_pass use_authtok
+
+Note: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'
   impact 0.5
-  tag 'legacy': ['V-71919', 'SV-86543']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000073-GPOS-00041'
-  tag 'gid': 'V-204415'
-  tag 'rid': 'SV-204415r603261_rule'
-  tag 'stig_id': 'RHEL-07-010200'
-  tag 'fix_id': 'F-4539r88438_fix'
-  tag 'cci': ['CCI-000196']
+  tag legacy: ['V-71919', 'SV-86543']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000073-GPOS-00041'
+  tag gid: 'V-204415'
+  tag rid: 'SV-204415r880833_rule'
+  tag stig_id: 'RHEL-07-010200'
+  tag fix_id: 'F-4539r880832_fix'
+  tag cci: ['CCI-000196']
   tag nist: ['IA-5 (1) (c)']
   tag subsystems: ['pam', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
-  describe.one do
-    describe pam('/etc/pam.d/password-auth') do
-      its('lines') { should match_pam_rule('password sufficient pam_unix.so sha512') }
-      its('lines') { should_not match_pam_rule('password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)') }
-    end
-    describe pam('/etc/pam.d/system-auth') do
-      its('lines') { should match_pam_rule('password sufficient pam_unix.so sha512') }
-      its('lines') { should_not match_pam_rule('password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)') }
-    end
+  describe pam('/etc/pam.d/password-auth') do
+    its('lines') { should match_pam_rule('password sufficient pam_unix.so sha512') }
+    its('lines') { should_not match_pam_rule('password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)') }
+  end
+  describe pam('/etc/pam.d/system-auth') do
+    its('lines') { should match_pam_rule('password sufficient pam_unix.so sha512') }
+    its('lines') { should_not match_pam_rule('password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)') }
   end
 end
diff --git a/controls/SV-204416.rb b/controls/SV-204416.rb
index 6c1660beb..646c73667 100644
--- a/controls/SV-204416.rb
+++ b/controls/SV-204416.rb
@@ -4,7 +4,6 @@
   desc 'Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
     If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
     encrypted with a weak algorithm are no more protected than if they are kept in plain text.'
-  desc 'rationale', ''
   desc 'check', %q(Verify the system's shadow file is configured to store only encrypted representations of passwords.
     The strength of encryption that must be used to hash passwords for all accounts is SHA512.
     Check that the system is configured to create SHA512 hashed passwords with the following command:
@@ -16,17 +15,18 @@
     Add or update the following line in "/etc/login.defs":
     ENCRYPT_METHOD SHA512'
   impact 0.5
-  tag 'legacy': ['V-71921', 'SV-86545']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000073-GPOS-00041'
-  tag 'gid': 'V-204416'
-  tag 'rid': 'SV-204416r603261_rule'
-  tag 'stig_id': 'RHEL-07-010210'
-  tag 'fix_id': 'F-4540r88441_fix'
-  tag 'cci': ['CCI-000196']
+  tag legacy: ['V-71921', 'SV-86545']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000073-GPOS-00041'
+  tag gid: 'V-204416'
+  tag rid: 'SV-204416r877397_rule'
+  tag stig_id: 'RHEL-07-010210'
+  tag fix_id: 'F-4540r88441_fix'
+  tag cci: ['CCI-000196']
   tag nist: ['IA-5 (1) (c)']
   tag subsystems: ['login_defs', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe login_defs do
     its('ENCRYPT_METHOD') { should cmp 'SHA512' }
diff --git a/controls/SV-204417.rb b/controls/SV-204417.rb
index 7088abe43..ac9f02b4a 100644
--- a/controls/SV-204417.rb
+++ b/controls/SV-204417.rb
@@ -4,7 +4,6 @@
   desc 'Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
     If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
     encrypted with a weak algorithm are no more protected than if they are kept in plain text.'
-  desc 'rationale', ''
   desc 'check', 'Verify the user and group account administration utilities are configured to store only encrypted
     representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is
     "SHA512".
@@ -17,17 +16,18 @@
     Add or update the following line in "/etc/libuser.conf" in the [defaults] section:
     crypt_style = sha512'
   impact 0.5
-  tag 'legacy': ['V-71923', 'SV-86547']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000073-GPOS-00041'
-  tag 'gid': 'V-204417'
-  tag 'rid': 'SV-204417r603261_rule'
-  tag 'stig_id': 'RHEL-07-010220'
-  tag 'fix_id': 'F-4541r88444_fix'
-  tag 'cci': ['CCI-000196']
+  tag legacy: ['V-71923', 'SV-86547']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000073-GPOS-00041'
+  tag gid: 'V-204417'
+  tag rid: 'SV-204417r877397_rule'
+  tag stig_id: 'RHEL-07-010220'
+  tag fix_id: 'F-4541r88444_fix'
+  tag cci: ['CCI-000196']
   tag nist: ['IA-5 (1) (c)']
   tag subsystems: ['libuser_conf', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe command('cat /etc/libuser.conf | grep -i sha512') do
     its('stdout.strip') { should match(/^crypt_style = sha512$/) }
diff --git a/controls/SV-204418.rb b/controls/SV-204418.rb
index c72e16092..b3cce29af 100644
--- a/controls/SV-204418.rb
+++ b/controls/SV-204418.rb
@@ -5,7 +5,6 @@
     reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,
     the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding
     password reuse."
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user
     accounts.
     Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" with the following command:
@@ -16,14 +15,14 @@
     Add the following line in "/etc/login.defs" (or modify the line to have the required value):
     PASS_MIN_DAYS     1'
   impact 0.5
-  tag 'legacy': ['V-71925', 'SV-86549']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000075-GPOS-00043'
-  tag 'gid': 'V-204418'
-  tag 'rid': 'SV-204418r603261_rule'
-  tag 'stig_id': 'RHEL-07-010230'
-  tag 'fix_id': 'F-4542r88447_fix'
-  tag 'cci': ['CCI-000198']
+  tag legacy: ['V-71925', 'SV-86549']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000075-GPOS-00043'
+  tag gid: 'V-204418'
+  tag rid: 'SV-204418r603261_rule'
+  tag stig_id: 'RHEL-07-010230'
+  tag fix_id: 'F-4542r88447_fix'
+  tag cci: ['CCI-000198']
   tag nist: ['IA-5 (1) (d)']
   tag subsystems: ['login_defs', 'password']
 
diff --git a/controls/SV-204419.rb b/controls/SV-204419.rb
index f3ac24e55..a501cbef5 100644
--- a/controls/SV-204419.rb
+++ b/controls/SV-204419.rb
@@ -5,7 +5,6 @@
     reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,
     the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding
     password reuse."
-  desc 'rationale', ''
   desc 'check', %q(Check whether the minimum time period between password changes for each user account is one day or
     greater.
     # awk -F: '$4 < 1 {print $1 " " $4}' /etc/shadow
@@ -13,14 +12,14 @@
   desc 'fix', 'Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:
     # chage -m 1 [user]'
   impact 0.5
-  tag 'legacy': ['SV-86551', 'V-71927']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000075-GPOS-00043'
-  tag 'gid': 'V-204419'
-  tag 'rid': 'SV-204419r603261_rule'
-  tag 'stig_id': 'RHEL-07-010240'
-  tag 'fix_id': 'F-4543r88450_fix'
-  tag 'cci': ['CCI-000198']
+  tag legacy: ['SV-86551', 'V-71927']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000075-GPOS-00043'
+  tag gid: 'V-204419'
+  tag rid: 'SV-204419r603261_rule'
+  tag stig_id: 'RHEL-07-010240'
+  tag fix_id: 'F-4543r88450_fix'
+  tag cci: ['CCI-000198']
   tag nist: ['IA-5 (1) (d)']
   tag subsystems: ['password', '/etc/shadow']
   tag 'host'
@@ -37,8 +36,7 @@
       next unless user(user).uid >= 1000
 
       describe shadow.users(user) do
-        its('min_days.first') { should cmp input('expected_password_lifetime') }
-        its('min_days.first') { should cmp >= input('min_password_lifetime') }
+        its('min_days.first') { should cmp input('min_password_lifetime') }
       end
     end
   end
diff --git a/controls/SV-204420.rb b/controls/SV-204420.rb
index dc7421d2f..f1ffe6fff 100644
--- a/controls/SV-204420.rb
+++ b/controls/SV-204420.rb
@@ -4,7 +4,6 @@
   desc 'Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed
     periodically. If the operating system does not limit the lifetime of passwords and force users to change their
     passwords, there is the risk that the operating system passwords could be compromised.'
-  desc 'rationale', ''
   desc 'check', 'If passwords are not being used for authentication, this is Not Applicable.
     Verify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.
     Check for the value of "PASS_MAX_DAYS" in "/etc/login.defs" with the following command:
@@ -15,22 +14,22 @@
     Add the following line in "/etc/login.defs" (or modify the line to have the required value):
     PASS_MAX_DAYS     60'
   impact 0.5
-  tag 'legacy': ['V-71929', 'SV-86553']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000076-GPOS-00044'
-  tag 'gid': 'V-204420'
-  tag 'rid': 'SV-204420r603261_rule'
-  tag 'stig_id': 'RHEL-07-010250'
-  tag 'fix_id': 'F-4544r88453_fix'
-  tag 'cci': ['CCI-000199']
+  tag legacy: ['V-71929', 'SV-86553']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000076-GPOS-00044'
+  tag gid: 'V-204420'
+  tag rid: 'SV-204420r603261_rule'
+  tag stig_id: 'RHEL-07-010250'
+  tag fix_id: 'F-4544r88453_fix'
+  tag cci: ['CCI-000199']
   tag nist: ['IA-5 (1) (d)']
   tag subsystems: ['login_defs', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if command("grep 'pam_unix.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'optional'").stdout.empty? && command("grep 'pam_permit.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'required'").stdout.empty?
     describe login_defs do
-      its('PASS_MAX_DAYS') { should cmp input('pass_max_days') }
-      its('PASS_MAX_DAYS') { should cmp <= input('max_pass_max_days') }
+      its('PASS_MAX_DAYS') { should cmp <= input('pass_max_days') }
     end
   else
     impact 0.0
diff --git a/controls/SV-204421.rb b/controls/SV-204421.rb
index f64a938c8..39311c658 100644
--- a/controls/SV-204421.rb
+++ b/controls/SV-204421.rb
@@ -4,22 +4,20 @@
   desc 'Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed
     periodically. If the operating system does not limit the lifetime of passwords and force users to change their
     passwords, there is the risk that the operating system passwords could be compromised.'
-  desc 'rationale', ''
   desc 'check', %q(Check whether the maximum time period for existing passwords is restricted to 60 days.
     # awk -F: '$5 > 60 {print $1 " " $5}' /etc/shadow
-    If any results are returned that are not associated with a system account, this is a finding.
-    )
+    If any results are returned that are not associated with a system account, this is a finding.)
   desc 'fix', 'Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.
     # chage -M 60 [user]'
   impact 0.5
-  tag 'legacy': ['V-71931', 'SV-86555']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000076-GPOS-00044'
-  tag 'gid': 'V-204421'
-  tag 'rid': 'SV-204421r603261_rule'
-  tag 'stig_id': 'RHEL-07-010260'
-  tag 'fix_id': 'F-4545r88456_fix'
-  tag 'cci': ['CCI-000199']
+  tag legacy: ['V-71931', 'SV-86555']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000076-GPOS-00044'
+  tag gid: 'V-204421'
+  tag rid: 'SV-204421r603261_rule'
+  tag stig_id: 'RHEL-07-010260'
+  tag fix_id: 'F-4545r88456_fix'
+  tag cci: ['CCI-000199']
   tag nist: ['IA-5 (1) (d)']
   tag subsystems: ['password', '/etc/shadow', 'tty']
   tag 'host'
@@ -35,8 +33,7 @@
       next unless user(user).uid >= 1000
 
       describe shadow.users(user) do
-        its('max_days.first') { should cmp input('expected_max_password_lifetime') }
-        its('max_days.first') { should cmp <= input('max_password_lifetime') }
+        its('max_days.first') { should cmp input('max_password_lifetime') }
       end
     end
   end
diff --git a/controls/SV-204422.rb b/controls/SV-204422.rb
index 8dfb932ac..c54c0c680 100644
--- a/controls/SV-204422.rb
+++ b/controls/SV-204422.rb
@@ -5,7 +5,6 @@
     guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse
     their password when that password has exceeded its defined lifetime, the end result is a password that is not
     changed per policy requirements.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system prohibits password reuse for a minimum of five generations.
     Check for the value of the "remember" argument in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" with the
     following command:
@@ -14,38 +13,32 @@
     If the line containing the "pam_pwhistory.so" line does not have the "remember" module argument set, is commented
     out, or the value of the "remember" module argument is set to less than "5", this is a finding.'
   desc 'fix', 'Configure the operating system to prohibit password reuse for a minimum of five generations.
-    Add the following line in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" (or modify the line to have the
-    required value):
-    password    requisite     pam_pwhistory.so use_authtok remember=5 retry=3
-    Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program
-    should not be used to update the configurations listed in this requirement.'
+
+Add the following line in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" (or modify the line to have the required value):
+
+     password     requisite     pam_pwhistory.so use_authtok remember=5 retry=3
+
+Note: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'
   impact 0.5
-  tag 'legacy': ['V-71933', 'SV-86557']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000077-GPOS-00045'
-  tag 'gid': 'V-204422'
-  tag 'rid': 'SV-204422r603261_rule'
-  tag 'stig_id': 'RHEL-07-010270'
-  tag 'fix_id': 'F-4546r88459_fix'
-  tag 'cci': ['CCI-000200']
+  tag legacy: ['V-71933', 'SV-86557']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000077-GPOS-00045'
+  tag gid: 'V-204422'
+  tag rid: 'SV-204422r880836_rule'
+  tag stig_id: 'RHEL-07-010270'
+  tag fix_id: 'F-4546r880835_fix'
+  tag cci: ['CCI-000200']
   tag nist: ['IA-5 (1) (e)']
   tag subsystems: ['pam', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
-  reuse_generations = input('expected_reuse_generations')
+  min_reuse_generations = input('min_reuse_generations')
 
-  describe.one do
-    describe pam('/etc/pam.d/system-auth') do
-      its('lines') { should match_pam_rule("password (required|requisite|sufficient) pam_(unix|pwhistory).so remember=#{reuse_generations}") }
-    end
-    describe pam('/etc/pam.d/password-auth') do
-      its('lines') { should match_pam_rule("password (required|requisite|sufficient) pam_(unix|pwhistory).soremember=#{reuse_generations}") }
-    end
+  describe pam('/etc/pam.d/system-auth') do
+    its('lines') { should match_pam_rule("password (required|requisite|sufficient) pam_(unix|pwhistory).so use_authtok remember=#{min_reuse_generations}") }
   end
-
-  describe 'input value' do
-    it 'for reuse_generations should be in line with maximum/minimum allowed values by policy' do
-      expect(input('expected_reuse_generations')).to cmp >= input('min_reuse_generations')
-    end
+  describe pam('/etc/pam.d/password-auth') do
+    its('lines') { should match_pam_rule("password (required|requisite|sufficient) pam_(unix|pwhistory).so use_authtok remember=#{min_reuse_generations}") }
   end
 end
diff --git a/controls/SV-204423.rb b/controls/SV-204423.rb
index f2789b5c7..62414af9e 100644
--- a/controls/SV-204423.rb
+++ b/controls/SV-204423.rb
@@ -7,7 +7,6 @@
     and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it
     takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or
     resources required to compromise the password.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system enforces a minimum 15-character password length. The "minlen" option
     sets the minimum number of characters in a new password.
     Check for the value of the "minlen" option in "/etc/security/pwquality.conf" with the following command:
@@ -18,20 +17,20 @@
     Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value):
     minlen = 15'
   impact 0.5
-  tag 'legacy': ['V-71935', 'SV-86559']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000078-GPOS-00046'
-  tag 'gid': 'V-204423'
-  tag 'rid': 'SV-204423r603261_rule'
-  tag 'stig_id': 'RHEL-07-010280'
-  tag 'fix_id': 'F-4547r88462_fix'
-  tag 'cci': ['CCI-000205']
+  tag legacy: ['V-71935', 'SV-86559']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000078-GPOS-00046'
+  tag gid: 'V-204423'
+  tag rid: 'SV-204423r603261_rule'
+  tag stig_id: 'RHEL-07-010280'
+  tag fix_id: 'F-4547r88462_fix'
+  tag cci: ['CCI-000205']
   tag nist: ['IA-5 (1) (a)']
   tag subsystems: ['pwquality', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/security/pwquality.conf') do
-    its('minlen') { should cmp input('expected_minlen') }
-    its('minlen') { should cmp input('min_minlen') }
+    its('minlen') { should cmp >= input('min_len') }
   end
 end
diff --git a/controls/SV-204424.rb b/controls/SV-204424.rb
index bf1e79354..e4167ee22 100644
--- a/controls/SV-204424.rb
+++ b/controls/SV-204424.rb
@@ -3,36 +3,33 @@
     passwords.'
   desc 'If an account has an empty password, anyone could log on and run commands with the privileges of that
     account. Accounts with empty passwords should never be used in operational environments.'
-  desc 'rationale', ''
   desc 'check', 'To verify that null passwords cannot be used, run the following command:
     # grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth
     If this produces any output, it may be possible to log on with accounts with empty passwords.
     If null passwords can be used, this is a finding.'
-  desc 'fix', 'If an account is configured for password authentication but does not have an assigned password, it may
-    be possible to log on to the account without authenticating.
-    Remove any instances of the "nullok" option in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" to prevent
-    logons with empty passwords.
-    Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program
-    should not be used to update the configurations listed in this requirement.'
+  desc 'fix', 'If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.
+
+Remove any instances of the "nullok" option in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" to prevent logons with empty passwords.
+
+Note: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'
   impact 0.7
-  tag 'legacy': ['V-71937', 'SV-86561']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204424'
-  tag 'rid': 'SV-204424r809187_rule'
-  tag 'stig_id': 'RHEL-07-010290'
-  tag 'fix_id': 'F-4548r88465_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-71937', 'SV-86561']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204424'
+  tag rid: 'SV-204424r880839_rule'
+  tag stig_id: 'RHEL-07-010290'
+  tag fix_id: 'F-4548r880838_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['pam', 'password']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
-  describe.one do
-    describe pam('/etc/pam.d/system-auth') do
-      its('lines') { should_not match_pam_rule('.* .* pam_unix.so nullok') }
-    end
-    describe pam('/etc/pam.d/password-auth') do
-      its('lines') { should_not match_pam_rule('.* .* pam_unix.so nullok') }
-    end
+  describe pam('/etc/pam.d/system-auth') do
+    its('lines') { should_not match_pam_rule('.* .* pam_unix.so nullok') }
+  end
+  describe pam('/etc/pam.d/password-auth') do
+    its('lines') { should_not match_pam_rule('.* .* pam_unix.so nullok') }
   end
 end
diff --git a/controls/SV-204425.rb b/controls/SV-204425.rb
index eaa3e3b89..65e753799 100644
--- a/controls/SV-204425.rb
+++ b/controls/SV-204425.rb
@@ -3,7 +3,6 @@
     authentication using an empty password.'
   desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will
     require a password, even in the event of misconfiguration elsewhere.'
-  desc 'rationale', ''
   desc 'check', %q(To determine how the SSH daemon's "PermitEmptyPasswords" option is set, run the following command:
     # grep -i PermitEmptyPasswords /etc/ssh/sshd_config
     PermitEmptyPasswords no
@@ -15,14 +14,14 @@
     The SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled
     immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.'
   impact 0.7
-  tag 'legacy': ['SV-86563', 'V-71939']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000106-GPOS-00053'
-  tag 'gid': 'V-204425'
-  tag 'rid': 'SV-204425r603261_rule'
-  tag 'stig_id': 'RHEL-07-010300'
-  tag 'fix_id': 'F-4549r88468_fix'
-  tag 'cci': ['CCI-000766']
+  tag legacy: ['SV-86563', 'V-71939']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000106-GPOS-00053'
+  tag gid: 'V-204425'
+  tag rid: 'SV-204425r603261_rule'
+  tag stig_id: 'RHEL-07-010300'
+  tag fix_id: 'F-4549r88468_fix'
+  tag cci: ['CCI-000766']
   tag nist: ['IA-2 (2)']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204426.rb b/controls/SV-204426.rb
index 80080b19b..4544319b7 100644
--- a/controls/SV-204426.rb
+++ b/controls/SV-204426.rb
@@ -6,7 +6,6 @@
     unauthorized access to their user account has been obtained.
     Operating systems need to track periods of inactivity and disable application identifiers after 35 days of
     inactivity.'
-  desc 'rationale', ''
   desc 'check', 'If passwords are not being used for authentication, this is Not Applicable.
     Verify the operating system disables account identifiers (individuals, groups, roles, and devices) after the
     password expires with the following command:
@@ -20,22 +19,23 @@
     DoD recommendation is 35 days, but a lower value is acceptable. The value "-1" will disable this feature, and "0"
     will disable the account immediately after the password expires.'
   impact 0.5
-  tag 'legacy': ['SV-86565', 'V-71941']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000118-GPOS-00060'
-  tag 'gid': 'V-204426'
-  tag 'rid': 'SV-204426r809190_rule'
-  tag 'stig_id': 'RHEL-07-010310'
-  tag 'fix_id': 'F-4550r809189_fix'
-  tag 'cci': ['CCI-000795']
+  tag legacy: ['SV-86565', 'V-71941']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000118-GPOS-00060'
+  tag gid: 'V-204426'
+  tag rid: 'SV-204426r809190_rule'
+  tag stig_id: 'RHEL-07-010310'
+  tag fix_id: 'F-4550r809189_fix'
+  tag cci: ['CCI-000795']
   tag nist: ['IA-4 e']
   tag subsystems: ['user']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if command("grep 'pam_unix.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'optional'").stdout.empty? && command("grep 'pam_permit.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'required'").stdout.empty?
     describe parse_config_file('/etc/default/useradd') do
-      its('INACTIVE') { should cmp input('expected_days_of_inactivity') }
-      its('INACTIVE') { should cmp <= input('max_days_of_inactivity') }
+      its('INACTIVE') { should cmp <= input('days_of_inactivity') }
+      its('INACTIVE') { should_not cmp -1 }
     end
   else
     impact 0.0
diff --git a/controls/SV-204427.rb b/controls/SV-204427.rb
index 848d5bdb0..71b70c7b7 100644
--- a/controls/SV-204427.rb
+++ b/controls/SV-204427.rb
@@ -3,7 +3,6 @@
     minutes after three unsuccessful logon attempts within a 15-minute timeframe.'
   desc 'By limiting the number of failed logon attempts, the risk of unauthorized system access via user password
     guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.'
-  desc 'rationale', ''
   desc 'check', 'Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon
     attempts within a period of 15 minutes with the following command:
     # grep pam_faillock.so /etc/pam.d/password-auth
@@ -34,29 +33,30 @@
     with the "pam_faillock.so" module or is missing from these lines, this is a finding.
     Note: The maximum configurable value for "unlock_time" is "604800".
     If any line referencing the "pam_faillock.so" module is commented out, this is a finding.'
-  desc 'fix', 'Configure the operating system to lock an account for the maximum period when three unsuccessful logon
-    attempts in 15 minutes are made.
-    Add/Modify the appropriate sections of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match
-    the following lines:
-    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
-    auth sufficient pam_unix.so try_first_pass
-    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
-    account required pam_faillock.so
-    Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program
-    should not be used to update the configurations listed in this requirement.'
+  desc 'fix', 'Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.
+
+Add/Modify the appropriate sections of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines:
+
+auth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+auth        sufficient    pam_unix.so try_first_pass
+auth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+account     required      pam_faillock.so
+
+Note: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'
   impact 0.5
-  tag 'legacy': ['V-71943', 'SV-86567']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000329-GPOS-00128'
-  tag 'satisfies': ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']
-  tag 'gid': 'V-204427'
-  tag 'rid': 'SV-204427r603824_rule'
-  tag 'stig_id': 'RHEL-07-010320'
-  tag 'fix_id': 'F-4551r622287_fix'
-  tag 'cci': ['CCI-000044', 'CCI-002236', 'CCI-002237', 'CCI-002238']
+  tag legacy: ['V-71943', 'SV-86567']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000329-GPOS-00128'
+  tag satisfies: ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']
+  tag gid: 'V-204427'
+  tag rid: 'SV-204427r880842_rule'
+  tag stig_id: 'RHEL-07-010320'
+  tag fix_id: 'F-4551r880841_fix'
+  tag cci: ['CCI-000044', 'CCI-002236', 'CCI-002237', 'CCI-002238']
   tag nist: ['AC-7 a', 'AC-7 b', 'AC-7 b', 'AC-7 b']
   tag subsystems: ['pam', 'faillock']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   # pam rules files to check
   pa_rules = pam('/etc/pam.d/password-auth').lines
@@ -64,9 +64,9 @@
 
   # rule patterns to match for
   faillock_rule_pattern = 'auth [default=die]|required pam_faillock.so'
-  deny_pattern = faillock_rule_pattern + " deny=#{input('expected_unsuccessful_attempts')}"
-  fail_interval_pattern = faillock_rule_pattern + " fail_interval=#{input('expected_fail_interval')}"
-  unlock_time_pattern = faillock_rule_pattern + " unlock_time=(0|never|#{input('expected_lockout_time')})"
+  deny_pattern = faillock_rule_pattern + " deny=#{input('unsuccessful_attempts')}"
+  fail_interval_pattern = faillock_rule_pattern + " fail_interval=#{input('fail_interval')}"
+  unlock_time_pattern = faillock_rule_pattern + " unlock_time=(0|never|#{input('lockout_time')})"
 
   # explicit rulesets to look for
   req = input('required_rules')
@@ -113,16 +113,4 @@
       expect(sa_rules).to match_pam_rule(unlock_time_pattern), 'missing or misconfigured unlock_time'
     end
   end
-
-  describe 'input value' do
-    it 'for unsuccessful_attempts should be in line with maximum/minimum allowed values by policy' do
-      expect(input('expected_unsuccessful_attempts')).to cmp <= input('max_unsuccessful_attempts')
-    end
-    it 'for fail_interval should be in line with maximum/minimum allowed values by policy' do
-      expect(input('expected_fail_interval')).to cmp <= input('max_fail_interval')
-    end
-    it 'for lockout_time should be in line with maximum/minimum allowed values by policy' do
-      expect(input('expected_lockout_time')).to cmp >= input('min_lockout_time')
-    end
-  end
 end
diff --git a/controls/SV-204428.rb b/controls/SV-204428.rb
index 8ca67387b..1a421b65f 100644
--- a/controls/SV-204428.rb
+++ b/controls/SV-204428.rb
@@ -3,7 +3,6 @@
     root logon attempts are made within a 15-minute period.'
   desc 'By limiting the number of failed logon attempts, the risk of unauthorized system access via user password
     guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system automatically locks the root account, for a minimum of 15 minutes, when
     three unsuccessful logon attempts in 15 minutes are made.
     # grep pam_faillock.so /etc/pam.d/password-auth
@@ -18,46 +17,45 @@
     account required pam_faillock.so
     If the "even_deny_root" setting is not defined on both lines with the "pam_faillock.so" module, is commented out, or
     is missing from a line, this is a finding.'
-  desc 'fix', 'Configure the operating system to automatically lock the root account, for a minimum of 15 minutes,
-    when three unsuccessful logon attempts in 15 minutes are made.
-    Modify the first three lines of the auth section and the first line of the account section of the
-    "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines:
-    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
-    auth sufficient pam_unix.so try_first_pass
-    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
-    account required pam_faillock.so
-    Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program
-    should not be used to update the configurations listed in this requirement.'
+  desc 'fix', 'Configure the operating system to automatically lock the root account, for a minimum of 15 minutes, when three unsuccessful logon attempts in 15 minutes are made.
+
+Modify the first three lines of the auth section and the first line of the account section of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines:
+
+auth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+auth        sufficient    pam_unix.so try_first_pass
+auth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+account     required      pam_faillock.so
+
+Note: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'
   impact 0.5
-  tag 'legacy': ['V-71945', 'SV-86569']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000329-GPOS-00128'
-  tag 'satisfies': ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']
-  tag 'gid': 'V-204428'
-  tag 'rid': 'SV-204428r792821_rule'
-  tag 'stig_id': 'RHEL-07-010330'
-  tag 'fix_id': 'F-4552r792820_fix'
-  tag 'cci': ['CCI-002238']
+  tag legacy: ['V-71945', 'SV-86569']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000329-GPOS-00128'
+  tag satisfies: ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']
+  tag gid: 'V-204428'
+  tag rid: 'SV-204428r880845_rule'
+  tag stig_id: 'RHEL-07-010330'
+  tag fix_id: 'F-4552r880844_fix'
+  tag cci: ['CCI-002238']
   tag nist: ['AC-7 b']
   tag subsystems: ['pam']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
-  describe.one do
-    describe pam('/etc/pam.d/password-auth') do
-      its('lines') do
-        should match_pam_rule('auth .* pam_faillock.so preauth even_deny_root')
-      end
-      its('lines') do
-        should match_pam_rule('auth .* pam_faillock.so authfail even_deny_root')
-      end
+  describe pam('/etc/pam.d/password-auth') do
+    its('lines') do
+      should match_pam_rule('auth .* pam_faillock.so preauth even_deny_root')
+    end
+    its('lines') do
+      should match_pam_rule('auth .* pam_faillock.so authfail even_deny_root')
+    end
+  end
+  describe pam('/etc/pam.d/system-auth') do
+    its('lines') do
+      should match_pam_rule('auth .* pam_faillock.so preauth even_deny_root')
     end
-    describe pam('/etc/pam.d/system-auth') do
-      its('lines') do
-        should match_pam_rule('auth .* pam_faillock.so preauth even_deny_root')
-      end
-      its('lines') do
-        should match_pam_rule('auth .* pam_faillock.so authfail even_deny_root')
-      end
+    its('lines') do
+      should match_pam_rule('auth .* pam_faillock.so authfail even_deny_root')
     end
   end
 end
diff --git a/controls/SV-204429.rb b/controls/SV-204429.rb
index 1ded916fe..7b990c9df 100644
--- a/controls/SV-204429.rb
+++ b/controls/SV-204429.rb
@@ -5,31 +5,34 @@
     authorization.
     When operating systems provide the capability to escalate a functional capability, it is critical the user
     re-authenticate.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system requires users to supply a password for privilege escalation.
-    Check the configuration of the "/etc/sudoers" and "/etc/sudoers.d/*" files with the following command:
-    # grep -i nopasswd /etc/sudoers /etc/sudoers.d/*
-    If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the Information
-    System Security Officer (ISSO) as an organizationally defined administrative group utilizing MFA, this is a
-    finding.'
+
+Check the configuration of the "/etc/sudoers" and "/etc/sudoers.d/*" files with the following command:
+
+$ sudo grep -ir nopasswd /etc/sudoers /etc/sudoers.d
+
+If any occurrences of "NOPASSWD" are returned from the command and have not been documented with the Information System Security Officer (ISSO) as an organizationally defined administrative group utilizing MFA, this is a finding.'
   desc 'fix', 'Configure the operating system to require users to supply a password for privilege escalation.
-    Check the configuration of the "/etc/sudoers" file with the following command:
-    # visudo
-    Remove any occurrences of "NOPASSWD" tags in the file.
-    Check the configuration of the /etc/sudoers.d/* files with the following command:
-    # grep -i nopasswd /etc/sudoers.d/*
-    Remove any occurrences of "NOPASSWD" tags in the file.'
+
+Check the configuration of the "/etc/sudoers" file with the following command:
+$ sudo visudo
+
+Remove any occurrences of "NOPASSWD" tags in the file.
+
+Check the configuration of the /etc/sudoers.d/* files with the following command:
+$ sudo grep -ir nopasswd /etc/sudoers.d
+
+Remove any occurrences of "NOPASSWD" tags in the file.'
   impact 0.5
-  tag 'legacy': ['V-71947', 'SV-86571']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000373-GPOS-00156'
-  tag 'satisfies': ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157',
-                    'SRG-OS-000373-GPOS-00158']
-  tag 'gid': 'V-204429'
-  tag 'rid': 'SV-204429r603261_rule'
-  tag 'stig_id': 'RHEL-07-010340'
-  tag 'fix_id': 'F-36303r602619_fix'
-  tag 'cci': ['CCI-002038']
+  tag legacy: ['V-71947', 'SV-86571']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000373-GPOS-00156'
+  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157', 'SRG-OS-000373-GPOS-00158']
+  tag gid: 'V-204429'
+  tag rid: 'SV-204429r861003_rule'
+  tag stig_id: 'RHEL-07-010340'
+  tag fix_id: 'F-36303r861002_fix'
+  tag cci: ['CCI-002038']
   tag nist: ['IA-11']
   tag subsystems: ['sudo']
   tag 'host'
diff --git a/controls/SV-204430.rb b/controls/SV-204430.rb
index 39d2fa48d..958f59996 100644
--- a/controls/SV-204430.rb
+++ b/controls/SV-204430.rb
@@ -5,7 +5,6 @@
     authorization.
     When operating systems provide the capability to escalate a functional capability, it is critical the user
     reauthenticate.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system requires users to reauthenticate for privilege escalation.
     Check the configuration of the "/etc/sudoers" and "/etc/sudoers.d/*" files with the following command:
     # grep -i authenticate /etc/sudoers /etc/sudoers.d/*
@@ -18,16 +17,15 @@
     # grep -i authenticate /etc/sudoers /etc/sudoers.d/*
     Remove any occurrences of "!authenticate" tags in the file(s).'
   impact 0.5
-  tag 'legacy': ['V-71949', 'SV-86573']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000373-GPOS-00156'
-  tag 'satisfies': ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157',
-                    'SRG-OS-000373-GPOS-00158']
-  tag 'gid': 'V-204430'
-  tag 'rid': 'SV-204430r603261_rule'
-  tag 'stig_id': 'RHEL-07-010350'
-  tag 'fix_id': 'F-4554r88483_fix'
-  tag 'cci': ['CCI-002038']
+  tag legacy: ['V-71949', 'SV-86573']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000373-GPOS-00156'
+  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157', 'SRG-OS-000373-GPOS-00158']
+  tag gid: 'V-204430'
+  tag rid: 'SV-204430r853885_rule'
+  tag stig_id: 'RHEL-07-010350'
+  tag fix_id: 'F-4554r88483_fix'
+  tag cci: ['CCI-002038']
   tag nist: ['IA-11']
   tag subsystems: ['sudo']
   tag 'host'
diff --git a/controls/SV-204431.rb b/controls/SV-204431.rb
index 6d2e80ee2..2b084a3b1 100644
--- a/controls/SV-204431.rb
+++ b/controls/SV-204431.rb
@@ -9,7 +9,6 @@
     those parameters impacting the security state of the system, including the parameters required to satisfy other
     security control requirements. Security-related parameters include, for example, registry settings; account, file,
     and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system enforces a delay of at least four seconds between console logon prompts
     following a failed logon attempt.
     Check the value of the "fail_delay" parameter in the "/etc/login.defs" file with the following command:
@@ -21,20 +20,20 @@
     Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to "4" or greater:
     FAIL_DELAY 4'
   impact 0.5
-  tag 'legacy': ['SV-86575', 'V-71951']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00226'
-  tag 'gid': 'V-204431'
-  tag 'rid': 'SV-204431r603261_rule'
-  tag 'stig_id': 'RHEL-07-010430'
-  tag 'fix_id': 'F-4555r88486_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86575', 'V-71951']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00226'
+  tag gid: 'V-204431'
+  tag rid: 'SV-204431r603261_rule'
+  tag stig_id: 'RHEL-07-010430'
+  tag fix_id: 'F-4555r88486_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['login_defs']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe login_defs do
-    its('FAIL_DELAY') { should cmp input('fail_delay') }
-    its('FAIL_DELAY') { should cmp >= input('min_fail_delay') }
+    its('FAIL_DELAY') { should cmp >= input('fail_delay') }
   end
 end
diff --git a/controls/SV-204432.rb b/controls/SV-204432.rb
index 20d16d5f3..f0abda5d2 100644
--- a/controls/SV-204432.rb
+++ b/controls/SV-204432.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system
     via a graphical user interface.'
   desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system does not allow an unattended or automatic logon to the system via a
     graphical user interface.
     Note: If the system does not have GNOME installed, this requirement is Not Applicable.
@@ -18,14 +17,14 @@
     [daemon]
     AutomaticLoginEnable=false'
   impact 0.7
-  tag 'legacy': ['V-71953', 'SV-86577']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00229'
-  tag 'gid': 'V-204432'
-  tag 'rid': 'SV-204432r603261_rule'
-  tag 'stig_id': 'RHEL-07-010440'
-  tag 'fix_id': 'F-4556r88489_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-71953', 'SV-86577']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00229'
+  tag gid: 'V-204432'
+  tag rid: 'SV-204432r877377_rule'
+  tag stig_id: 'RHEL-07-010440'
+  tag fix_id: 'F-4556r88489_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['gdm']
   tag 'host'
diff --git a/controls/SV-204433.rb b/controls/SV-204433.rb
index 5f87cef54..4b2a0f049 100644
--- a/controls/SV-204433.rb
+++ b/controls/SV-204433.rb
@@ -1,7 +1,6 @@
 control 'SV-204433' do
   title 'The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.'
   desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system does not allow an unrestricted logon to the system via a graphical user
     interface.
     Note: If the system does not have GNOME installed, this requirement is Not Applicable.
@@ -16,14 +15,15 @@
     to "false":
     [daemon]
     TimedLoginEnable=false'
-  tag 'legacy': ['V-71955', 'SV-86579']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00229'
-  tag 'gid': 'V-204433'
-  tag 'rid': 'SV-204433r603261_rule'
-  tag 'stig_id': 'RHEL-07-010450'
-  tag 'fix_id': 'F-4557r88492_fix'
-  tag 'cci': ['CCI-000366']
+  impact 0.7
+  tag legacy: ['V-71955', 'SV-86579']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00229'
+  tag gid: 'V-204433'
+  tag rid: 'SV-204433r877377_rule'
+  tag stig_id: 'RHEL-07-010450'
+  tag fix_id: 'F-4557r88492_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['gdm']
   tag 'host'
diff --git a/controls/SV-204434.rb b/controls/SV-204434.rb
index 8c21c74ec..43cf17bda 100644
--- a/controls/SV-204434.rb
+++ b/controls/SV-204434.rb
@@ -1,7 +1,6 @@
 control 'SV-204434' do
   title 'The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.'
   desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system does not allow users to override environment variables to the SSH
     daemon.
     Check for the value of the "PermitUserEnvironment" keyword with the following command:
@@ -14,14 +13,14 @@
     PermitUserEnvironment no
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86581', 'V-71957']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00229'
-  tag 'gid': 'V-204434'
-  tag 'rid': 'SV-204434r603261_rule'
-  tag 'stig_id': 'RHEL-07-010460'
-  tag 'fix_id': 'F-4558r88495_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86581', 'V-71957']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00229'
+  tag gid: 'V-204434'
+  tag rid: 'SV-204434r877377_rule'
+  tag stig_id: 'RHEL-07-010460'
+  tag fix_id: 'F-4558r88495_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204435.rb b/controls/SV-204435.rb
index 9d671bb6e..86b432aed 100644
--- a/controls/SV-204435.rb
+++ b/controls/SV-204435.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to
     the system.'
   desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.
     Check for the value of the "HostbasedAuthentication" keyword with the following command:
     # grep -i hostbasedauthentication /etc/ssh/sshd_config
@@ -14,14 +13,14 @@
     HostbasedAuthentication no
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86583', 'V-71959']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00229'
-  tag 'gid': 'V-204435'
-  tag 'rid': 'SV-204435r603261_rule'
-  tag 'stig_id': 'RHEL-07-010470'
-  tag 'fix_id': 'F-4559r88498_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86583', 'V-71959']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00229'
+  tag gid: 'V-204435'
+  tag rid: 'SV-204435r877377_rule'
+  tag stig_id: 'RHEL-07-010470'
+  tag fix_id: 'F-4559r88498_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204437.rb b/controls/SV-204437.rb
index 0b14bcb9c..53361e97c 100644
--- a/controls/SV-204437.rb
+++ b/controls/SV-204437.rb
@@ -3,7 +3,6 @@
     maintenance modes.'
   desc 'If the system does not require valid root authentication before it boots into single-user or maintenance
     mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system must require authentication upon booting into single-user and
     maintenance modes.
     Check that the operating system requires authentication upon booting into single-user mode with the following
@@ -16,17 +15,18 @@
     Add or modify the "ExecStart" line in "/usr/lib/systemd/system/rescue.service" to include "/usr/sbin/sulogin":
     ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"'
   impact 0.5
-  tag 'legacy': ['V-77823', 'SV-92519']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000080-GPOS-00048'
-  tag 'gid': 'V-204437'
-  tag 'rid': 'SV-204437r603261_rule'
-  tag 'stig_id': 'RHEL-07-010481'
-  tag 'fix_id': 'F-4561r88504_fix'
-  tag 'cci': ['CCI-000213']
+  tag legacy: ['V-77823', 'SV-92519']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000080-GPOS-00048'
+  tag gid: 'V-204437'
+  tag rid: 'SV-204437r603261_rule'
+  tag stig_id: 'RHEL-07-010481'
+  tag fix_id: 'F-4561r88504_fix'
+  tag cci: ['CCI-000213']
   tag nist: ['AC-3']
   tag subsystems: ['root', 'sulogin']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe command('grep -i execstart /usr/lib/systemd/system/rescue.service') do
     its('stdout.strip') { should match %r{/usr/sbin/sulogin} }
diff --git a/controls/SV-204438.rb b/controls/SV-204438.rb
index fbbc23c05..2b3a271af 100644
--- a/controls/SV-204438.rb
+++ b/controls/SV-204438.rb
@@ -5,7 +5,6 @@
     anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2
     is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make
     modifications to the boot menu.'
-  desc 'rationale', ''
   desc 'check', 'For systems that use UEFI, this is Not Applicable.
     For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.
     Check to see if an encrypted grub superusers password is set. On systems that use a BIOS, use the following command:
@@ -19,14 +18,14 @@
     Enter password:
     Confirm password:'
   impact 0.7
-  tag 'legacy': ['SV-95717', 'V-81005']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000080-GPOS-00048'
-  tag 'gid': 'V-204438'
-  tag 'rid': 'SV-204438r744095_rule'
-  tag 'stig_id': 'RHEL-07-010482'
-  tag 'fix_id': 'F-4562r744094_fix'
-  tag 'cci': ['CCI-000213']
+  tag legacy: ['SV-95717', 'V-81005']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000080-GPOS-00048'
+  tag gid: 'V-204438'
+  tag rid: 'SV-204438r744095_rule'
+  tag stig_id: 'RHEL-07-010482'
+  tag fix_id: 'F-4562r744094_fix'
+  tag cci: ['CCI-000213']
   tag nist: ['AC-3']
   tag subsystems: ['boot', 'bios']
   tag 'host'
diff --git a/controls/SV-204440.rb b/controls/SV-204440.rb
index bc7fc1c14..984e1bb93 100644
--- a/controls/SV-204440.rb
+++ b/controls/SV-204440.rb
@@ -5,7 +5,6 @@
     anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2
     is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make
     modifications to the boot menu.'
-  desc 'rationale', ''
   desc 'check', 'For systems that use BIOS, this is Not Applicable.
     For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.
     Check to see if an encrypted grub superusers password is set. On systems that use UEFI, use the following command:
@@ -19,14 +18,14 @@
     Enter password:
     Confirm password:'
   impact 0.7
-  tag 'legacy': ['SV-95719', 'V-81007']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000080-GPOS-00048'
-  tag 'gid': 'V-204440'
-  tag 'rid': 'SV-204440r744098_rule'
-  tag 'stig_id': 'RHEL-07-010491'
-  tag 'fix_id': 'F-4564r744097_fix'
-  tag 'cci': ['CCI-000213']
+  tag legacy: ['SV-95719', 'V-81007']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000080-GPOS-00048'
+  tag gid: 'V-204440'
+  tag rid: 'SV-204440r744098_rule'
+  tag stig_id: 'RHEL-07-010491'
+  tag fix_id: 'F-4564r744097_fix'
+  tag cci: ['CCI-000213']
   tag nist: ['AC-3']
   tag subsystems: ['boot', 'uefi']
   tag 'host'
diff --git a/controls/SV-204441.rb b/controls/SV-204441.rb
index 90207cc57..f310f9434 100644
--- a/controls/SV-204441.rb
+++ b/controls/SV-204441.rb
@@ -12,17 +12,21 @@
     2) Accesses that occur through authorized use of group authenticators without individual authentication.
     Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts)
     or for detailed accountability of individual activity.'
-  tag  'rationale': ''
-  desc 'check', 'Verify the operating system requires multifactor authentication to uniquely identify organizational
-    users using multifactor authentication.
-    Check to see if smartcard authentication is enforced on the system:
-    # authconfig --test | grep "pam_pkcs11 is enabled"
-    If no results are returned, this is a finding.
-    # authconfig --test | grep "smartcard removal action"
-    If "smartcard removal action" is blank, this is a finding.
-    # authconfig --test | grep "smartcard module"
-    If "smartcard module" is blank, ask the administrator to indicate the AO-approved multifactor authentication in use
-    and the configuration to support it. If there is no evidence of multifactor authentication, this is a finding.'
+  desc 'check', 'Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.
+
+Check to see if smartcard authentication is enforced on the system:
+
+# authconfig --test | grep "pam_pkcs11 is enabled"
+
+If no results are returned, this is a finding.
+
+# authconfig --test | grep "smartcard removal action"
+
+If "smartcard removal action" is blank, this is a finding.
+
+# authconfig --test | grep "smartcard module"
+
+If any of the above checks are not configured, ask the administrator to indicate the AO-approved multifactor authentication in use and the configuration to support it. If there is no evidence of multifactor authentication, this is a finding.'
   desc 'fix', 'Configure the operating system to require individuals to be authenticated with a multifactor
     authenticator.
     Enable smartcard logons with the following commands:
@@ -31,16 +35,16 @@
     Modify the "/etc/pam_pkcs11/pkcs11_eventmgr.conf" file to uncomment the following line:
     #/usr/X11R6/bin/xscreensaver-command -lock
     Modify the "/etc/pam_pkcs11/pam_pkcs11.conf" file to use the cackey module if required.'
-  tag 'legacy': ['V-71965', 'SV-86589']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000104-GPOS-00051'
-  tag 'satisfies': ['SRG-OS-000104-GPOS-00051', 'SRG-OS-000106-GPOS-00053', 'SRG-OS-000107-GPOS-00054',
-                    'SRG-OS-000109-GPOS-00056', 'SRG-OS-000108-GPOS-00055', 'SRG-OS-000108-GPOS-00057', 'SRG-OS-000108-GPOS-00058']
-  tag 'gid': 'V-204441'
-  tag 'rid': 'SV-204441r792823_rule'
-  tag 'stig_id': 'RHEL-07-010500'
-  tag 'fix_id': 'F-4565r88516_fix'
-  tag 'cci': ['CCI-000766']
+  impact 0.5
+  tag legacy: ['V-71965', 'SV-86589']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000104-GPOS-00051'
+  tag satisfies: ['SRG-OS-000104-GPOS-00051', 'SRG-OS-000106-GPOS-00053', 'SRG-OS-000107-GPOS-00054', 'SRG-OS-000109-GPOS-00056', 'SRG-OS-000108-GPOS-00055', 'SRG-OS-000108-GPOS-00057', 'SRG-OS-000108-GPOS-00058']
+  tag gid: 'V-204441'
+  tag rid: 'SV-204441r818813_rule'
+  tag stig_id: 'RHEL-07-010500'
+  tag fix_id: 'F-4565r88516_fix'
+  tag cci: ['CCI-000766']
   tag nist: ['IA-2 (2)']
   tag subsystems: ['pam', 'smartcard']
   tag 'host'
@@ -54,10 +58,11 @@
     smart_card_status = input('smart_card_status')
     if smart_card_status.eql?('enabled')
       impact 0.5
+      describe command("authconfig --test | grep 'pam_pkcs11'") do
+        its('stdout') { should match(/pam_pkcs11\sis\senabled/) }
+      end
       describe command('authconfig --test | grep -i smartcard') do
-        its('stdout') do
-          should match(/use\sonly\ssmartcard\sfor\slogin\sis\s#{smart_card_status}/)
-        end
+        its('stdout') { should match(/use\sonly\ssmartcard\sfor\slogin\sis\s#{smart_card_status}/) }
         its('stdout') { should match(/smartcard\smodule\s=\s".+"/) }
         its('stdout') { should match(/smartcard\sremoval\saction\s=\s".+"/) }
       end
diff --git a/controls/SV-204442.rb b/controls/SV-204442.rb
index 5c1625b35..d344a08c6 100644
--- a/controls/SV-204442.rb
+++ b/controls/SV-204442.rb
@@ -9,7 +9,6 @@
     The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality
     and integrity of user passwords or the remote session and has very weak authentication.
     If a privileged user were to log on using this service, the privileged user password could be compromised.'
-  tag  'rationale': ''
   desc 'check', 'Check to see if the rsh-server package is installed with the following command:
     # yum list installed rsh-server
     If the rsh-server package is installed, this is a finding.'
@@ -17,17 +16,18 @@
     package from the system with the following command:
     # yum remove rsh-server'
   impact 0.7
-  tag 'legacy': ['V-71967', 'SV-86591']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000095-GPOS-00049'
-  tag 'gid': 'V-204442'
-  tag 'rid': 'SV-204442r603261_rule'
-  tag 'stig_id': 'RHEL-07-020000'
-  tag 'fix_id': 'F-4566r88519_fix'
-  tag 'cci': ['CCI-000381']
+  tag legacy: ['V-71967', 'SV-86591']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000095-GPOS-00049'
+  tag gid: 'V-204442'
+  tag rid: 'SV-204442r603261_rule'
+  tag stig_id: 'RHEL-07-020000'
+  tag fix_id: 'F-4566r88519_fix'
+  tag cci: ['CCI-000381']
   tag nist: ['CM-7 a']
   tag subsystems: ['packages']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe package('rsh-server') do
     it { should_not be_installed }
diff --git a/controls/SV-204443.rb b/controls/SV-204443.rb
index 5f25ac0fc..50d260a75 100644
--- a/controls/SV-204443.rb
+++ b/controls/SV-204443.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must not have the ypserv package installed.'
   desc 'Removing the "ypserv" package decreases the risk of the accidental (or intentional) activation of NIS or
     NIS+ services.'
-  desc 'rationale', ''
   desc 'check', 'The NIS service provides an unencrypted authentication service that does not provide for the
     confidentiality and integrity of user passwords or the remote session.
     Check to see if the "ypserve" package is installed with the following command:
@@ -12,17 +11,18 @@
     from the system with the following command:
     # yum remove ypserv'
   impact 0.7
-  tag 'legacy': ['V-71969', 'SV-86593']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000095-GPOS-00049'
-  tag 'gid': 'V-204443'
-  tag 'rid': 'SV-204443r603261_rule'
-  tag 'stig_id': 'RHEL-07-020010'
-  tag 'fix_id': 'F-4567r88522_fix'
-  tag 'cci': ['CCI-000381']
+  tag legacy: ['V-71969', 'SV-86593']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000095-GPOS-00049'
+  tag gid: 'V-204443'
+  tag rid: 'SV-204443r603261_rule'
+  tag stig_id: 'RHEL-07-020010'
+  tag fix_id: 'F-4567r88522_fix'
+  tag cci: ['CCI-000381']
   tag nist: ['CM-7 a']
   tag subsystems: ['packages']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe package('ypserv') do
     it { should_not be_installed }
diff --git a/controls/SV-204444.rb b/controls/SV-204444.rb
index e777c3c56..8c8a11985 100644
--- a/controls/SV-204444.rb
+++ b/controls/SV-204444.rb
@@ -7,7 +7,6 @@
     administering cryptographic key management activities. Non-privileged users are individuals who do not possess
     appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection
     mechanisms are examples of privileged functions that require protection from non-privileged users.'
-  desc 'rationale', ''
   desc 'check', 'Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL)
     in conjunction with SELinux.
     Verify the operating system prevents non-privileged users from executing privileged functions to include disabling,
@@ -39,14 +38,14 @@
     Use the following command to map an existing user to the "user_u" SELinux user:
     $ sudo semanage login -m -s user_u <username>'
   impact 0.5
-  tag 'legacy': ['SV-86595', 'V-71971']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000324-GPOS-00125'
-  tag 'gid': 'V-204444'
-  tag 'rid': 'SV-204444r792826_rule'
-  tag 'stig_id': 'RHEL-07-020020'
-  tag 'fix_id': 'F-4568r792825_fix'
-  tag 'cci': ['CCI-002165', 'CCI-002235']
+  tag legacy: ['SV-86595', 'V-71971']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000324-GPOS-00125'
+  tag gid: 'V-204444'
+  tag rid: 'SV-204444r877392_rule'
+  tag stig_id: 'RHEL-07-020020'
+  tag fix_id: 'F-4568r792825_fix'
+  tag cci: ['CCI-002165', 'CCI-002235']
   tag nist: ['AC-3 (4)', 'AC-6 (10)']
   tag subsystems: ['selinux']
   tag 'host'
diff --git a/controls/SV-204445.rb b/controls/SV-204445.rb
index 73e492949..5e4687550 100644
--- a/controls/SV-204445.rb
+++ b/controls/SV-204445.rb
@@ -1,57 +1,56 @@
 control 'SV-204445' do
   title 'The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the
     baseline operating system configuration at least weekly.'
-  desc "Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or
-    allow unauthorized access to the operating system. Changes to operating system configurations can have unintended
-    side effects, some of which may be relevant to security.
-    Detecting such changes and providing an automated response can help avoid unintended, negative consequences that
-    could ultimately affect the security state of the operating system. The operating system's Information Management
-    Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email
-    and/or monitoring system trap when there is an unauthorized modification of a configuration item."
-  desc 'rationale', ''
+  desc "Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.
+
+Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item."
   desc 'check', 'Verify the operating system routinely checks the baseline configuration for unauthorized changes.
-    Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool
-    must be executed at least once per week.
-    Check to see if AIDE is installed on the system with the following command:
-    # yum list installed aide
-    If AIDE is not installed, ask the SA how file integrity checks are performed on the system.
-    Check for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for
-    changes to the system baseline. The command used in the example will use a daily occurrence.
-    Check the cron directories for a script file controlling the execution of the file integrity application. For
-    example, if AIDE is installed on the system, use the following command:
-    # ls -al /etc/cron.* | grep aide
-    -rwxr-xr-x 1 root root 29 Nov 22 2015 aide
-    # grep aide /etc/crontab /var/spool/cron/root
-    /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check
-    /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check
-    If the file integrity application does not exist, or a script file controlling the execution of the file integrity
-    application does not exist, this is a finding.'
-  desc 'fix', 'Configure the file integrity tool to run automatically on the system at least weekly. The following
-    example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:
-    # more /etc/cron.daily/aide
-    #!/bin/bash
-    /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil'
+
+Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.
+
+Check for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.
+
+Check the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:
+
+     # ls -al /etc/cron.* | grep aide
+     -rwxr-xr-x 1 root root 602 Mar 6 20:02 aide
+
+     # grep aide /etc/crontab /var/spool/cron/root
+     /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check
+     /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check
+
+If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.'
+  desc 'fix', 'Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:
+
+     # more /etc/cron.daily/aide
+     #!/bin/bash
+
+     /usr/sbin/aide --check | /var/spool/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil'
   impact 0.5
-  tag 'legacy': ['SV-86597', 'V-71973']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000363-GPOS-00150'
-  tag 'gid': 'V-204445'
-  tag 'rid': 'SV-204445r603261_rule'
-  tag 'stig_id': 'RHEL-07-020030'
-  tag 'fix_id': 'F-36304r602622_fix'
-  tag 'cci': ['CCI-001744']
+  tag legacy: ['SV-86597', 'V-71973']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000363-GPOS-00150'
+  tag gid: 'V-204445'
+  tag rid: 'SV-204445r880848_rule'
+  tag stig_id: 'RHEL-07-020030'
+  tag fix_id: 'F-36304r880847_fix'
+  tag cci: ['CCI-001744']
   tag nist: ['CM-3 (5)']
   tag subsystems: ['file_integrity_tool']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   file_integrity_tool = input('file_integrity_tool')
   file_integrity_interval = input('file_integrity_interval')
 
-  describe package(file_integrity_tool) do
-    it { should be_installed }
-  end
-
-  if file_integrity_interval == 'monthly'
+  if file_integrity_tool != 'aide'
+    describe 'The system is not set to ' do
+      skip "The system is set to a `disconnected` state and you must validate
+        the state of the system packages manually, or through another process, if you
+        have an established update and patch process, please set this control as
+        `Not Applicable` with a `caevat` via an overlay."
+    end
+  elsif file_integrity_interval == 'monthly'
     describe.one do
       describe file("/etc/cron.daily/#{file_integrity_tool}") do
         it { should exist }
diff --git a/controls/SV-204446.rb b/controls/SV-204446.rb
index 7a6b7fc89..e653ee455 100644
--- a/controls/SV-204446.rb
+++ b/controls/SV-204446.rb
@@ -1,76 +1,70 @@
 control 'SV-204446' do
   title 'The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified
     if baseline configurations are changed in an unauthorized manner.'
-  desc "Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or
-    allow unauthorized access to the operating system. Changes to operating system configurations can have unintended
-    side effects, some of which may be relevant to security.
-    Detecting such changes and providing an automated response can help avoid unintended, negative consequences that
-    could ultimately affect the security state of the operating system. The operating system's Information Management
-    Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email
-    and/or monitoring system trap when there is an unauthorized modification of a configuration item."
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system notifies designated personnel if baseline configurations are changed in
-    an unauthorized manner.
-    Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool
-    must be executed and notify specified individuals via email or an alert.
-    Check to see if AIDE is installed on the system with the following command:
-    # yum list installed aide
-    If AIDE is not installed, ask the SA how file integrity checks are performed on the system.
-    Check for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the
-    system baseline. The commands used in the example will use a daily occurrence.
-    Check the cron directories for a "crontab" script file controlling the execution of the file integrity application.
-    For example, if AIDE is installed on the system, use the following command:
-    # ls -al /etc/cron.* | grep aide
-    -rwxr-xr-x 1 root root 32 Jul 1 2011 aide
-    # grep aide /etc/crontab /var/spool/cron/root
-    /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check
-    /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check
-    AIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the
-    system to email the results of the file integrity run as in the following example:
-    # more /etc/cron.daily/aide
-    #!/bin/bash
-    /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil
-    If the file integrity application does not notify designated personnel of changes, this is a finding.'
-  desc 'fix', 'Configure the operating system to notify designated personnel if baseline configurations are changed
-    in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron
-    system.
-    The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of
-    the analysis.
-    # more /etc/cron.daily/aide
-    /usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil'
+  desc "Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.
+
+Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item."
+  desc 'check', 'Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.
+
+Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.
+
+Check for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.
+
+Check the cron directories for a "crontab" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:
+
+     # ls -al /etc/cron.* | grep aide
+     -rwxr-xr-x 1 root root 602 Mar 6 20:02 aide
+
+     # grep aide /etc/crontab /var/spool/cron/root
+     /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check
+     /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check
+
+AIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:
+
+     # more /etc/cron.daily/aide
+     #!/bin/bash
+
+     /usr/sbin/aide --check | /var/spool/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil
+
+If the file integrity application does not notify designated personnel of changes, this is a finding.'
+  desc 'fix', 'Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system.
+
+The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis.
+
+     # more /etc/cron.daily/aide
+
+     /usr/sbin/aide --check | /var/spool/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil'
   impact 0.5
-  tag 'legacy': ['V-71975', 'SV-86599']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000363-GPOS-00150'
-  tag 'gid': 'V-204446'
-  tag 'rid': 'SV-204446r603261_rule'
-  tag 'stig_id': 'RHEL-07-020040'
-  tag 'fix_id': 'F-36305r602625_fix'
-  tag 'cci': ['CCI-001744']
+  tag legacy: ['V-71975', 'SV-86599']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000363-GPOS-00150'
+  tag gid: 'V-204446'
+  tag rid: 'SV-204446r880851_rule'
+  tag stig_id: 'RHEL-07-020040'
+  tag fix_id: 'F-36305r880850_fix'
+  tag cci: ['CCI-001744']
   tag nist: ['CM-3 (5)']
   tag subsystems: ['file_integrity_tool']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   file_integrity_tool = input('file_integrity_tool')
 
-  describe package(file_integrity_tool) do
-    it { should be_installed }
-  end
   describe.one do
     describe file("/etc/cron.daily/#{file_integrity_tool}") do
-      its('content') { should match %r{/bin/mail} }
+      its('content') { should match %r{/var/spool/mail} }
     end
     describe file("/etc/cron.weekly/#{file_integrity_tool}") do
-      its('content') { should match %r{/bin/mail} }
+      its('content') { should match %r{/var/spool/mail} }
     end
     describe crontab('root').where {
                command =~ /#{file_integrity_tool}/
              } do
-      its('commands.flatten') { should include(match %r{/bin/mail}) }
+      its('commands.flatten') { should include(match %r{/var/spool/mail}) }
     end
     if file("/etc/cron.d/#{file_integrity_tool}").exist?
       describe crontab(path: "/etc/cron.d/#{file_integrity_tool}") do
-        its('commands') { should include(match %r{/bin/mail}) }
+        its('commands') { should include(match %r{/var/spool/mail}) }
       end
     end
   end
diff --git a/controls/SV-204447.rb b/controls/SV-204447.rb
index 4733485ce..a66ae77fa 100644
--- a/controls/SV-204447.rb
+++ b/controls/SV-204447.rb
@@ -13,7 +13,6 @@
     trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to
     verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the
     certificate used to verify the software must be from an approved CA.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system prevents the installation of patches, service packs, device drivers, or
     operating system components from a repository without verification that they have been digitally signed using a
     certificate that is recognized and approved by the organization.
@@ -27,17 +26,18 @@
     by setting the following option in the "/etc/yum.conf" file:
     gpgcheck=1'
   impact 0.7
-  tag 'legacy': ['V-71977', 'SV-86601']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000366-GPOS-00153'
-  tag 'gid': 'V-204447'
-  tag 'rid': 'SV-204447r603261_rule'
-  tag 'stig_id': 'RHEL-07-020050'
-  tag 'fix_id': 'F-4571r88534_fix'
-  tag 'cci': ['CCI-001749']
+  tag legacy: ['V-71977', 'SV-86601']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000366-GPOS-00153'
+  tag gid: 'V-204447'
+  tag rid: 'SV-204447r877463_rule'
+  tag stig_id: 'RHEL-07-020050'
+  tag fix_id: 'F-4571r88534_fix'
+  tag cci: ['CCI-001749']
   tag nist: ['CM-5 (3)']
   tag subsystems: ['yum']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   yum_conf = '/etc/yum.conf'
 
diff --git a/controls/SV-204448.rb b/controls/SV-204448.rb
index 11ff5aeab..98f64e180 100644
--- a/controls/SV-204448.rb
+++ b/controls/SV-204448.rb
@@ -13,7 +13,6 @@
     trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to
     verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the
     certificate used to verify the software must be from an approved CA.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system prevents the installation of patches, service packs, device drivers, or
     operating system components of local packages without verification that they have been digitally signed using a
     certificate that is recognized and approved by the organization.
@@ -28,17 +27,18 @@
     the following option in the "/etc/yum.conf" file:
     localpkg_gpgcheck=1'
   impact 0.7
-  tag 'legacy': ['V-71979', 'SV-86603']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000366-GPOS-00153'
-  tag 'gid': 'V-204448'
-  tag 'rid': 'SV-204448r603261_rule'
-  tag 'stig_id': 'RHEL-07-020060'
-  tag 'fix_id': 'F-4572r88537_fix'
-  tag 'cci': ['CCI-001749']
+  tag legacy: ['V-71979', 'SV-86603']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000366-GPOS-00153'
+  tag gid: 'V-204448'
+  tag rid: 'SV-204448r877463_rule'
+  tag stig_id: 'RHEL-07-020060'
+  tag fix_id: 'F-4572r88537_fix'
+  tag cci: ['CCI-001749']
   tag nist: ['CM-5 (3)']
   tag subsystems: ['yum']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   yum_conf = '/etc/yum.conf'
 
diff --git a/controls/SV-204449.rb b/controls/SV-204449.rb
index 0dcb2536c..3b8278097 100644
--- a/controls/SV-204449.rb
+++ b/controls/SV-204449.rb
@@ -1,7 +1,6 @@
 control 'SV-204449' do
   title 'The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.'
   desc 'USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system disables the ability to load the USB Storage kernel module.
     # grep -r usb-storage /etc/modprobe.d/* | grep -i "/bin/true" | grep -v "^#"
     install usb-storage /bin/true
@@ -24,16 +23,15 @@
     Add or update the line:
     blacklist usb-storage'
   impact 0.5
-  tag 'legacy': ['SV-86607', 'V-71983']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000114-GPOS-00059'
-  tag 'satisfies': ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163',
-                    'SRG-OS-000480-GPOS-00227']
-  tag 'gid': 'V-204449'
-  tag 'rid': 'SV-204449r603261_rule'
-  tag 'stig_id': 'RHEL-07-020100'
-  tag 'fix_id': 'F-4573r462538_fix'
-  tag 'cci': ['CCI-000366', 'CCI-000778', 'CCI-001958']
+  tag legacy: ['SV-86607', 'V-71983']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000114-GPOS-00059'
+  tag satisfies: ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163', 'SRG-OS-000480-GPOS-00227']
+  tag gid: 'V-204449'
+  tag rid: 'SV-204449r853891_rule'
+  tag stig_id: 'RHEL-07-020100'
+  tag fix_id: 'F-4573r462538_fix'
+  tag cci: ['CCI-000366', 'CCI-000778', 'CCI-001958']
   tag nist: ['CM-6 b', 'IA-3', 'IA-3']
   tag subsystems: ['usb', 'kernel_module']
   tag 'host'
diff --git a/controls/SV-204450.rb b/controls/SV-204450.rb
index 7f70ec335..6a60abb4e 100644
--- a/controls/SV-204450.rb
+++ b/controls/SV-204450.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control
     Protocol (DCCP) kernel module is disabled unless required.'
   desc 'Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system disables the ability to load the DCCP kernel module.
     # grep -r dccp /etc/modprobe.d/* | grep -i "/bin/true" | grep -v "^#"
     install dccp /bin/true
@@ -25,14 +24,14 @@
     Add or update the line:
     blacklist dccp'
   impact 0.5
-  tag 'legacy': ['V-77821', 'SV-92517']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000378-GPOS-00163'
-  tag 'gid': 'V-204450'
-  tag 'rid': 'SV-204450r603261_rule'
-  tag 'stig_id': 'RHEL-07-020101'
-  tag 'fix_id': 'F-4574r88543_fix'
-  tag 'cci': ['CCI-001958']
+  tag legacy: ['V-77821', 'SV-92517']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000378-GPOS-00163'
+  tag gid: 'V-204450'
+  tag rid: 'SV-204450r853892_rule'
+  tag stig_id: 'RHEL-07-020101'
+  tag fix_id: 'F-4574r88543_fix'
+  tag cci: ['CCI-001958']
   tag nist: ['IA-3']
   tag subsystems: ['dccp', 'kernel_module']
   tag 'host'
diff --git a/controls/SV-204451.rb b/controls/SV-204451.rb
index 93ce70f22..b3bdfaf20 100644
--- a/controls/SV-204451.rb
+++ b/controls/SV-204451.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.'
   desc 'Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating
     malicious activity.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system disables the ability to automount devices.
     Check to see if automounter service is active with the following command:
     # systemctl status autofs
@@ -17,19 +16,19 @@
     # systemctl disable autofs
     If "autofs" is required for Network File System (NFS), it must be documented with the ISSO.'
   impact 0.5
-  tag 'legacy': ['V-71985', 'SV-86609']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000114-GPOS-00059'
-  tag 'satisfies': ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163',
-                    'SRG-OS-000480-GPOS-00227']
-  tag 'gid': 'V-204451'
-  tag 'rid': 'SV-204451r603261_rule'
-  tag 'stig_id': 'RHEL-07-020110'
-  tag 'fix_id': 'F-4575r88546_fix'
-  tag 'cci': ['CCI-000366', 'CCI-000778', 'CCI-001958']
+  tag legacy: ['V-71985', 'SV-86609']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000114-GPOS-00059'
+  tag satisfies: ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163', 'SRG-OS-000480-GPOS-00227']
+  tag gid: 'V-204451'
+  tag rid: 'SV-204451r853893_rule'
+  tag stig_id: 'RHEL-07-020110'
+  tag fix_id: 'F-4575r88546_fix'
+  tag cci: ['CCI-000366', 'CCI-000778', 'CCI-001958']
   tag nist: ['CM-6 b', 'IA-3', 'IA-3']
   tag subsystems: ['file_system', 'nfs', 'autofs']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe systemd_service('autofs.service') do
     it { should_not be_running }
diff --git a/controls/SV-204452.rb b/controls/SV-204452.rb
index ec4a11d0e..8e6986d6d 100644
--- a/controls/SV-204452.rb
+++ b/controls/SV-204452.rb
@@ -4,7 +4,6 @@
   desc 'Previous versions of software components that are not removed from the information system after updates have
     been installed may be exploited by adversaries. Some information technology products may remove older versions of
     software automatically from the information system.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system removes all software components after updated versions have been
     installed.
     Check if yum is configured to remove unneeded packages with the following command:
@@ -17,17 +16,18 @@
     Set the "clean_requirements_on_remove" option to "1" in the "/etc/yum.conf" file:
     clean_requirements_on_remove=1'
   impact 0.3
-  tag 'legacy': ['V-71987', 'SV-86611']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000437-GPOS-00194'
-  tag 'gid': 'V-204452'
-  tag 'rid': 'SV-204452r603261_rule'
-  tag 'stig_id': 'RHEL-07-020200'
-  tag 'fix_id': 'F-4576r88549_fix'
-  tag 'cci': ['CCI-002617']
+  tag legacy: ['V-71987', 'SV-86611']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000437-GPOS-00194'
+  tag gid: 'V-204452'
+  tag rid: 'SV-204452r853894_rule'
+  tag stig_id: 'RHEL-07-020200'
+  tag fix_id: 'F-4576r88549_fix'
+  tag cci: ['CCI-002617']
   tag nist: ['SI-2 (6)']
   tag subsystems: ['yum']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe parse_config_file('/etc/yum.conf') do
     its('main.clean_requirements_on_remove') { should match(/1|True|yes/i) }
diff --git a/controls/SV-204453.rb b/controls/SV-204453.rb
index 9aaf54759..c1b55232a 100644
--- a/controls/SV-204453.rb
+++ b/controls/SV-204453.rb
@@ -8,7 +8,6 @@
     intrusion detection parameters.
     This requirement applies to operating systems performing security function verification/testing and/or systems and
     environments that require this functionality.'
-  desc 'rationale', ''
   desc 'check', 'Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in
     conjunction with SELinux.
     Verify the operating system verifies correct operation of all security functions.
@@ -22,14 +21,14 @@
     SELINUX=enforcing
     A reboot is required for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-71989', 'SV-86613']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000445-GPOS-00199'
-  tag 'gid': 'V-204453'
-  tag 'rid': 'SV-204453r754746_rule'
-  tag 'stig_id': 'RHEL-07-020210'
-  tag 'fix_id': 'F-36306r602628_fix'
-  tag 'cci': ['CCI-002165', 'CCI-002696']
+  tag legacy: ['V-71989', 'SV-86613']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000445-GPOS-00199'
+  tag gid: 'V-204453'
+  tag rid: 'SV-204453r853895_rule'
+  tag stig_id: 'RHEL-07-020210'
+  tag fix_id: 'F-36306r602628_fix'
+  tag cci: ['CCI-002165', 'CCI-002696']
   tag nist: ['AC-3 (4)', 'SI-6 a']
   tag subsystems: ['selinux']
   tag 'host'
diff --git a/controls/SV-204454.rb b/controls/SV-204454.rb
index 7d51e0d02..db9cfc97b 100644
--- a/controls/SV-204454.rb
+++ b/controls/SV-204454.rb
@@ -8,8 +8,7 @@
     intrusion detection parameters.
     This requirement applies to operating systems performing security function verification/testing and/or systems and
     environments that require this functionality.'
-  desc 'rationale', ''
-  desc 'check', %q{Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in
+  desc 'check', %q(Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in
     conjunction with SELinux.
     Verify the operating system verifies correct operation of all security functions.
     Check if "SELinux" is active and is enforcing the targeted policy with the following command:
@@ -27,21 +26,21 @@
     Verify that the /etc/selinux/config file is configured to the "SELINUXTYPE" to "targeted":
     # grep -i "selinuxtype" /etc/selinux/config | grep -v '^#'
     SELINUXTYPE = targeted
-    If no results are returned or "SELINUXTYPE" is not set to "targeted", this is a finding.}
+    If no results are returned or "SELINUXTYPE" is not set to "targeted", this is a finding.)
   desc 'fix', 'Configure the operating system to verify correct operation of all security functions.
     Set the "SELinuxtype" to the "targeted" policy by modifying the "/etc/selinux/config" file to have the following
     line:
     SELINUXTYPE=targeted
     A reboot is required for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-71991', 'SV-86615']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000445-GPOS-00199'
-  tag 'gid': 'V-204454'
-  tag 'rid': 'SV-204454r754748_rule'
-  tag 'stig_id': 'RHEL-07-020220'
-  tag 'fix_id': 'F-36307r602631_fix'
-  tag 'cci': ['CCI-002165', 'CCI-002696']
+  tag legacy: ['V-71991', 'SV-86615']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000445-GPOS-00199'
+  tag gid: 'V-204454'
+  tag rid: 'SV-204454r853896_rule'
+  tag stig_id: 'RHEL-07-020220'
+  tag fix_id: 'F-36307r602631_fix'
+  tag cci: ['CCI-002165', 'CCI-002696']
   tag nist: ['AC-3 (4)', 'SI-6 a']
   tag subsystems: ['selinux']
   tag 'host'
diff --git a/controls/SV-204455.rb b/controls/SV-204455.rb
index b3adf2ec6..4f5af6a0e 100644
--- a/controls/SV-204455.rb
+++ b/controls/SV-204455.rb
@@ -6,27 +6,33 @@
     loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of
     unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any
     action is taken.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.
-    Check that the ctrl-alt-del.target is masked and not active with the following command:
-    # systemctl status ctrl-alt-del.target
-    ctrl-alt-del.target
-    Loaded: masked (/dev/null; bad)
-    Active: inactive (dead)
-    If the ctrl-alt-del.target is not masked, this is a finding.
-    If the ctrl-alt-del.target is active, this is a finding.'
-  desc 'fix', 'Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following
-    command:
-    # systemctl mask ctrl-alt-del.target'
+
+Check that the ctrl-alt-del.target is masked and not active with the following command:
+
+$ sudo systemctl status ctrl-alt-del.target
+
+ctrl-alt-del.target
+Loaded: masked (/dev/null; bad)
+Active: inactive (dead)
+
+If the ctrl-alt-del.target is not masked, this is a finding.
+
+If the ctrl-alt-del.target is active, this is a finding.'
+  desc 'fix', 'Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following commands:
+
+$ sudo systemctl disable ctrl-alt-del.target
+
+$ sudo systemctl mask ctrl-alt-del.target'
   impact 0.7
-  tag 'legacy': ['SV-86617', 'V-71993']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204455'
-  tag 'rid': 'SV-204455r603261_rule'
-  tag 'stig_id': 'RHEL-07-020230'
-  tag 'fix_id': 'F-4579r88558_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86617', 'V-71993']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204455'
+  tag rid: 'SV-204455r833106_rule'
+  tag stig_id: 'RHEL-07-020230'
+  tag fix_id: 'F-4579r833105_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['gui', 'general']
   tag 'host'
@@ -37,9 +43,19 @@
       skip 'Control not applicable to a container'
     end
   else
-    describe systemd_service('ctrl-alt-del.target') do
-      it { should_not be_running }
-      it { should_not be_enabled }
+    service_load_state = systemd_service('ctrl-alt-del.target').params.LoadState
+    service_active_state = systemd_service('ctrl-alt-del.target').params.ActiveState
+
+    describe 'ctrl-alt-del.target' do
+      it 'should be masked' do
+        expect(service_load_state).to cmp('masked')
+      end
+    end
+
+    describe 'ctrl-alt-del.target' do
+      it 'should be inactive' do
+        expect(service_active_state).to cmp('inactive')
+      end
     end
   end
 end
diff --git a/controls/SV-204456.rb b/controls/SV-204456.rb
index 49c6c27da..2e6b3215d 100644
--- a/controls/SV-204456.rb
+++ b/controls/SV-204456.rb
@@ -5,7 +5,6 @@
     accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term
     loss of availability of systems due to unintentional reboot. In the graphical environment, risk of unintentional
     reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.'
-  desc 'rationale', ''
   desc 'check', %q(Note: If the operating system does not have a graphical user interface installed, this requirement
     is Not Applicable.
     Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.
@@ -21,14 +20,14 @@
     [org/gnome/settings-daemon/plugins/media-keys]
     logout=''"
   impact 0.7
-  tag 'legacy': ['V-94843', 'SV-104673']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204456'
-  tag 'rid': 'SV-204456r603261_rule'
-  tag 'stig_id': 'RHEL-07-020231'
-  tag 'fix_id': 'F-4580r590041_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-94843', 'SV-104673']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204456'
+  tag rid: 'SV-204456r603261_rule'
+  tag stig_id: 'RHEL-07-020231'
+  tag fix_id: 'F-4580r590041_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['gui', 'general']
   tag 'host'
diff --git a/controls/SV-204457.rb b/controls/SV-204457.rb
index a7b8b5fdb..4e7aaadbc 100644
--- a/controls/SV-204457.rb
+++ b/controls/SV-204457.rb
@@ -3,7 +3,6 @@
     in such a way that the user can only read and modify their own files.'
   desc 'Setting the most restrictive default permissions ensures that when new accounts are created, they do not
     have unnecessary access.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system defines default permissions for all authenticated users in such a way
     that the user can only read and modify their own files.
     Check for the value of the "UMASK" parameter in "/etc/login.defs" file with the following command:
@@ -17,17 +16,19 @@
     that the user can only read and modify their own files.
     Add or edit the line for the "UMASK" parameter in "/etc/login.defs" file to "077":
     UMASK  077'
-  tag 'legacy': ['SV-86619', 'V-71995']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00228'
-  tag 'gid': 'V-204457'
-  tag 'rid': 'SV-204457r603261_rule'
-  tag 'stig_id': 'RHEL-07-020240'
-  tag 'fix_id': 'F-4581r88564_fix'
-  tag 'cci': ['CCI-000366']
+  impact 0.5
+  tag legacy: ['SV-86619', 'V-71995']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00228'
+  tag gid: 'V-204457'
+  tag rid: 'SV-204457r603261_rule'
+  tag stig_id: 'RHEL-07-020240'
+  tag fix_id: 'F-4581r88564_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['login_defs']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if login_defs.read_params['UMASK'].eql?('000')
     impact 0.5
diff --git a/controls/SV-204458.rb b/controls/SV-204458.rb
index 79232a5f3..de7a45058 100644
--- a/controls/SV-204458.rb
+++ b/controls/SV-204458.rb
@@ -6,7 +6,6 @@
     Red Hat offers the Extended Update Support (EUS) Add-On to a Red Hat Enterprise Linux subscription, for a fee, for
     those customers who wish to standardize on a specific minor release for an extended period. RHEL 7.7 marks the final
     minor release that EUS will be available, while 7.9 is the final minor release overall.'
-  desc 'rationale', ''
   desc 'check', 'Verify the version of the operating system is vendor supported.
     Check the version of the operating system with the following command:
     # cat /etc/redhat-release
@@ -17,31 +16,41 @@
     If the release is not supported by the vendor, this is a finding.'
   desc 'fix', 'Upgrade to a supported version of the operating system.'
   impact 0.7
-  tag 'legacy': ['SV-86621', 'V-71997']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204458'
-  tag 'rid': 'SV-204458r744100_rule'
-  tag 'stig_id': 'RHEL-07-020250'
-  tag 'fix_id': 'F-4582r462547_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86621', 'V-71997']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204458'
+  tag rid: 'SV-204458r744100_rule'
+  tag stig_id: 'RHEL-07-020250'
+  tag fix_id: 'F-4582r462547_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['redhat_release']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   release = os.release
+  supported_releases = ['7.6', '7.7', '7.9']
 
-  EOMS_DATE = case release
-              when /^7\.6/
-                '31 May 2021'
-              when /^7\.7/
-                '30 August 2021'
-              when /^7\.9/
-                '30 June 2024'
-              end
+  if !supported_releases.include? release
+    describe "RHEL \"#{release}\" is not a supported release" do
+      subject { release }
+      it { should be_in supported_releases }
+    end
 
-  describe "The release \"#{release}\" must still be within the support window, ending #{EOMS_DATE}" do
-    subject { Date.today <= Date.parse(EOMS_DATE) }
-    it { should be true }
+  else
+    EOMS_DATE = case release
+                when /^7\.6/
+                  '31 May 2021'
+                when /^7\.7/
+                  '30 August 2021'
+                when /^7\.9/
+                  '30 June 2024'
+                end
+
+    describe "The release \"#{release}\" must still be within the support window, ending #{EOMS_DATE}" do
+      subject { Date.today <= Date.parse(EOMS_DATE) }
+      it { should be true }
+    end
   end
 end
diff --git a/controls/SV-204459.rb b/controls/SV-204459.rb
index 8674864dd..aa6128002 100644
--- a/controls/SV-204459.rb
+++ b/controls/SV-204459.rb
@@ -8,54 +8,42 @@
     exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches
     and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The
     lack of prompt attention to patching could result in a system compromise.'
+  desc 'check', 'Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO).
 
-  desc 'check', "Verify the operating system security patches and updates are installed and
-      up to date. Updates are required to be applied with a frequency determined by
-      the site or Program Management Office (PMO).
+Obtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.
 
-      Obtain the list of available package security updates from Red Hat. The URL
-      for updates is https://rhn.redhat.com/errata/. It is important to note that
-      updates provided by Red Hat may not be present on the system if the underlying
-      packages are not installed.
+Check that the available package security updates have been installed on the system with the following command:
 
-      Check that the available package security updates have been installed on
-      the system with the following command:
+# yum history list | more
+Loaded plugins: langpacks, product-id, subscription-manager
+ID     | Command line             | Date and time    | Action(s)      | Altered
+-------------------------------------------------------------------------------
+    70 | install aide             | 2016-05-05 10:58 | Install       |     1
+    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE
+    68 | install vlc                | 2016-04-21 17:12 | Install        |   21
+    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE
+    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE
 
-          # yum history list | more
-          Loaded plugins: langpacks, product-id, subscription-manager
-          ID     | Command line             | Date and time    | Action(s)      |
-      Altered
+If package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding.
 
-      -------------------------------------------------------------------------------
-              70 | install aide             | 2016-05-05 10:58 | Install       |
-      1
-              69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE
-              68 | install vlc                | 2016-04-21 17:12 | Install        |
-      21
-              67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE
-              66 | update -y                | 2016-04-15 16:47 | E, I, U         |
-      84 EE
+Typical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.
 
-          If package updates have not been performed on the system within the
-      timeframe that the site/program documentation requires, this is a finding.
-
-    If the operating system is in non-compliance with the Information Assurance
-Vulnerability Management (IAVM) process, this is a finding.
-  "
+If the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.'
   desc 'fix', 'Install the operating system patches or updated packages available from Red Hat within 30 days or
     sooner as local policy dictates.'
   impact 0.5
-  tag 'legacy': ['SV-86623', 'V-71999']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204459'
-  tag 'rid': 'SV-204459r603261_rule'
-  tag 'stig_id': 'RHEL-07-020260'
-  tag 'fix_id': 'F-4583r88570_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86623', 'V-71999']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204459'
+  tag rid: 'SV-204459r603261_rule'
+  tag stig_id: 'RHEL-07-020260'
+  tag fix_id: 'F-4583r88570_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['packages']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if input('disconnected_system')
     describe "The system is set to a `disconnected` state and you must validate
diff --git a/controls/SV-204460.rb b/controls/SV-204460.rb
index 87dcdc5d1..a8efb2090 100644
--- a/controls/SV-204460.rb
+++ b/controls/SV-204460.rb
@@ -3,7 +3,6 @@
   desc 'Accounts providing no operational purpose provide additional opportunities for system compromise.
     Unnecessary accounts include user accounts for individuals not requiring access to the system and application
     accounts for applications not installed on the system.'
-  desc 'rationale', ''
   desc 'check', 'Verify all accounts on the system are assigned to an active system, application, or user account.
     Obtain the list of authorized system accounts from the Information System Security Officer (ISSO).
     Check the system accounts on the system with the following command:
@@ -26,17 +25,18 @@
     administrative-level actions.
     Document all authorized accounts on the system.'
   impact 0.5
-  tag 'legacy': ['SV-86625', 'V-72001']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204460'
-  tag 'rid': 'SV-204460r603261_rule'
-  tag 'stig_id': 'RHEL-07-020270'
-  tag 'fix_id': 'F-4584r88573_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86625', 'V-72001']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204460'
+  tag rid: 'SV-204460r603261_rule'
+  tag stig_id: 'RHEL-07-020270'
+  tag fix_id: 'F-4584r88573_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['accounts']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   known_system_accounts = input('known_system_accounts')
   user_accounts = input('user_accounts')
diff --git a/controls/SV-204461.rb b/controls/SV-204461.rb
index 2b0cfd038..a69042e1d 100644
--- a/controls/SV-204461.rb
+++ b/controls/SV-204461.rb
@@ -3,7 +3,6 @@
     referenced in the /etc/passwd file are defined in the /etc/group file.'
   desc 'If a user is assigned the GID of a group not existing on the system, and a group with the GID is
     subsequently created, the user may have unintended rights to any files associated with the group.'
-  desc 'rationale', ''
   desc 'check', 'Verify all GIDs referenced in the "/etc/passwd" file are defined in the "/etc/group" file.
     Check that all referenced GIDs exist with the following command:
     # pwck -r
@@ -12,17 +11,18 @@
     file to add any non-existent group referenced in the "/etc/passwd" file, or change the GIDs referenced in the
     "/etc/passwd" file to a group that exists in "/etc/group".'
   impact 0.3
-  tag 'legacy': ['V-72003', 'SV-86627']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000104-GPOS-00051'
-  tag 'gid': 'V-204461'
-  tag 'rid': 'SV-204461r603261_rule'
-  tag 'stig_id': 'RHEL-07-020300'
-  tag 'fix_id': 'F-4585r88576_fix'
-  tag 'cci': ['CCI-000764']
+  tag legacy: ['V-72003', 'SV-86627']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000104-GPOS-00051'
+  tag gid: 'V-204461'
+  tag rid: 'SV-204461r603261_rule'
+  tag stig_id: 'RHEL-07-020300'
+  tag fix_id: 'F-4585r88576_fix'
+  tag cci: ['CCI-000764']
   tag nist: ['IA-2']
   tag subsystems: ['accounts']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe 'All group identifiers in /etc/passwd' do
     it 'should be defined in /etc/groups' do
diff --git a/controls/SV-204462.rb b/controls/SV-204462.rb
index 864365a35..3bfeb41c3 100644
--- a/controls/SV-204462.rb
+++ b/controls/SV-204462.rb
@@ -4,7 +4,6 @@
   desc 'If an account other than root also has a User Identifier (UID) of "0", it has root authority, giving that
     account unrestricted access to the entire operating system. Multiple accounts with a UID of "0" afford an
     opportunity for potential intruders to guess a password for a privileged account.'
-  desc 'rationale', ''
   desc 'check', %q(Check the system for duplicate UID "0" assignments with the following command:
     # awk -F: '$3 == 0 {print $1}' /etc/passwd
     If any accounts other than root have a UID of "0", this is a finding.)
@@ -12,17 +11,18 @@
     If the account is associated with system commands or applications, the UID should be changed to one greater than "0"
     but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.'
   impact 0.7
-  tag 'legacy': ['SV-86629', 'V-72005']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204462'
-  tag 'rid': 'SV-204462r603261_rule'
-  tag 'stig_id': 'RHEL-07-020310'
-  tag 'fix_id': 'F-4586r88579_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86629', 'V-72005']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204462'
+  tag rid: 'SV-204462r603261_rule'
+  tag stig_id: 'RHEL-07-020310'
+  tag fix_id: 'F-4586r88579_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['accounts']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe passwd.uids(0) do
     its('users') { should cmp 'root' }
diff --git a/controls/SV-204463.rb b/controls/SV-204463.rb
index 916624196..0ed7ed093 100644
--- a/controls/SV-204463.rb
+++ b/controls/SV-204463.rb
@@ -3,7 +3,6 @@
     valid owner.'
   desc 'Unowned files and directories may be unintentionally inherited if a user is assigned the same User
     Identifier "UID" as the UID of the un-owned files.'
-  desc 'rationale', ''
   desc 'check', 'Verify all files and directories on the system have a valid owner.
     Check the owner of all files and directories with the following command:
     Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.
@@ -13,17 +12,18 @@
     valid user to all unowned files and directories on the system with the "chown" command:
     # chown <user> <file>'
   impact 0.5
-  tag 'legacy': ['SV-86631', 'V-72007']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204463'
-  tag 'rid': 'SV-204463r603261_rule'
-  tag 'stig_id': 'RHEL-07-020320'
-  tag 'fix_id': 'F-4587r88582_fix'
-  tag 'cci': ['CCI-002165']
+  tag legacy: ['SV-86631', 'V-72007']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204463'
+  tag rid: 'SV-204463r853897_rule'
+  tag stig_id: 'RHEL-07-020320'
+  tag fix_id: 'F-4587r88582_fix'
+  tag cci: ['CCI-002165']
   tag nist: ['AC-3 (4)']
   tag subsystems: ['file_system', 'users', 'files']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   command('grep -v "nodev" /proc/filesystems | awk \'NF{ print $NF }\'')
     .stdout.strip.split("\n").each do |fs|
diff --git a/controls/SV-204464.rb b/controls/SV-204464.rb
index 7539f982a..8157e89e8 100644
--- a/controls/SV-204464.rb
+++ b/controls/SV-204464.rb
@@ -3,7 +3,6 @@
     valid group owner.'
   desc 'Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group
     Identifier (GID) as the GID of the files without a valid group owner.'
-  desc 'rationale', ''
   desc 'check', 'Verify all files and directories on the system have a valid group.
     Check the owner of all files and directories with the following command:
     Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.
@@ -13,17 +12,18 @@
     valid group to all files and directories on the system with the "chgrp" command:
     # chgrp <group> <file>'
   impact 0.5
-  tag 'legacy': ['V-72009', 'SV-86633']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204464'
-  tag 'rid': 'SV-204464r603261_rule'
-  tag 'stig_id': 'RHEL-07-020330'
-  tag 'fix_id': 'F-4588r88585_fix'
-  tag 'cci': ['CCI-002165']
+  tag legacy: ['V-72009', 'SV-86633']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204464'
+  tag rid: 'SV-204464r853898_rule'
+  tag stig_id: 'RHEL-07-020330'
+  tag fix_id: 'F-4588r88585_fix'
+  tag cci: ['CCI-002165']
   tag nist: ['AC-3 (4)']
   tag subsystems: ['file_system', 'groups', 'files']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   command('grep -v "nodev" /proc/filesystems | awk \'NF{ print $NF }\'')
     .stdout.strip.split("\n").each do |fs|
diff --git a/controls/SV-204466.rb b/controls/SV-204466.rb
index c9cf25772..9312b1bde 100644
--- a/controls/SV-204466.rb
+++ b/controls/SV-204466.rb
@@ -3,7 +3,6 @@
     accounts, upon creation, are assigned a home directory.'
   desc 'If local interactive users are not assigned a valid home directory, there is no place for the storage and
     control of files they should own.'
-  desc 'rationale', ''
   desc 'check', 'Verify all local interactive users on the system are assigned a home directory upon creation.
     Check to see if the system is configured to create home directories for local interactive users with the following
     command:
@@ -15,17 +14,18 @@
     setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows.
     CREATE_HOME yes'
   impact 0.5
-  tag 'legacy': ['V-72013', 'SV-86637']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204466'
-  tag 'rid': 'SV-204466r603261_rule'
-  tag 'stig_id': 'RHEL-07-020610'
-  tag 'fix_id': 'F-4590r88591_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72013', 'SV-86637']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204466'
+  tag rid: 'SV-204466r603261_rule'
+  tag stig_id: 'RHEL-07-020610'
+  tag fix_id: 'F-4590r88591_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['login_defs']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe login_defs do
     its('CREATE_HOME') { should eq 'yes' }
diff --git a/controls/SV-204467.rb b/controls/SV-204467.rb
index 6543f8a44..b6a37c51b 100644
--- a/controls/SV-204467.rb
+++ b/controls/SV-204467.rb
@@ -7,8 +7,7 @@
     access to the / directory as the current working directory upon logon. This could create a Denial of Service because
     the user would not be able to access their logon configuration files, and it may give them visibility to system
     files they normally would not be able to access.'
-  desc 'rationale', ''
-  desc 'check', %q{Verify local interactive users on the system have a home directory assigned and the directory
+  desc 'check', %q(Verify local interactive users on the system have a home directory assigned and the directory
     exists.
     Check the home directory assignment for all local interactive non-privileged users on the system with the following
     command:
@@ -20,7 +19,7 @@
     # pwck -r
     user 'smithj': directory '/home/smithj' does not exist
     If any home directories referenced in "/etc/passwd" are returned as not defined, or if any interactive users do not
-    have a home directory assigned, this is a finding.}
+    have a home directory assigned, this is a finding.)
   desc 'fix', 'Create home directories to all local interactive users that currently do not have a home directory
     assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd":
     Note: The example will be for the user smithj, who has a home directory of "/home/smithj", a UID of "smithj", and a
@@ -30,14 +29,14 @@
     # chgrp users /home/smithj
     # chmod 0750 /home/smithj'
   impact 0.5
-  tag 'legacy': ['V-72015', 'SV-86639']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204467'
-  tag 'rid': 'SV-204467r603826_rule'
-  tag 'stig_id': 'RHEL-07-020620'
-  tag 'fix_id': 'F-4591r462550_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72015', 'SV-86639']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204467'
+  tag rid: 'SV-204467r603826_rule'
+  tag stig_id: 'RHEL-07-020620'
+  tag fix_id: 'F-4591r462550_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['accounts']
   tag 'host'
diff --git a/controls/SV-204468.rb b/controls/SV-204468.rb
index 56257dc87..d46831625 100644
--- a/controls/SV-204468.rb
+++ b/controls/SV-204468.rb
@@ -3,28 +3,27 @@
     directories have mode 0750 or less permissive.'
   desc 'Excessive permissions on local interactive user home directories may allow unauthorized access to user files
     by other users.'
-  tag  'rationale': ''
-  desc 'check', %q{Verify the assigned home directory of all local interactive users has a mode of "0750" or less
+  desc 'check', %q(Verify the assigned home directory of all local interactive users has a mode of "0750" or less
     permissive.
     Check the home directory assignment for all non-privileged users on the system with the following command:
     Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of
     interactive use may be obtained from a number of log files containing system logon information.
     # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
     -rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj
-    If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.}
+    If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.)
   desc 'fix', %q(Change the mode of interactive user's home directories to "0750". To change the mode of a local
     interactive user's home directory, use the following command:
     Note: The example will be for the user "smithj".
     # chmod 0750 /home/smithj)
   impact 0.5
-  tag 'legacy': ['SV-86641', 'V-72017']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204468'
-  tag 'rid': 'SV-204468r603828_rule'
-  tag 'stig_id': 'RHEL-07-020630'
-  tag 'fix_id': 'F-4592r88597_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86641', 'V-72017']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204468'
+  tag rid: 'SV-204468r603828_rule'
+  tag stig_id: 'RHEL-07-020630'
+  tag fix_id: 'F-4592r88597_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs']
   tag 'host'
diff --git a/controls/SV-204469.rb b/controls/SV-204469.rb
index 80161715a..47d878a52 100644
--- a/controls/SV-204469.rb
+++ b/controls/SV-204469.rb
@@ -3,25 +3,24 @@
     directories are owned by their respective users.'
   desc "If a local interactive user does not own their home directory, unauthorized users could access or modify the
     user's files, and the users may not be able to access their own files."
-  desc 'rationale', ''
-  desc 'check', %q{Verify the assigned home directory of all local interactive users on the system exists.
+  desc 'check', %q(Verify the assigned home directory of all local interactive users on the system exists.
     Check the home directory assignment for all local interactive users on the system with the following command:
     # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
     -rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj
-    If any home directories referenced in "/etc/passwd" are not owned by the interactive user, this is a finding.}
+    If any home directories referenced in "/etc/passwd" are not owned by the interactive user, this is a finding.)
   desc 'fix', %q(Change the owner of a local interactive user's home directories to that owner. To change the owner of
     a local interactive user's home directory, use the following command:
     Note: The example will be for the user smithj, who has a home directory of "/home/smithj".
     # chown smithj /home/smithj)
   impact 0.5
-  tag 'legacy': ['SV-86643', 'V-72019']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204469'
-  tag 'rid': 'SV-204469r603830_rule'
-  tag 'stig_id': 'RHEL-07-020640'
-  tag 'fix_id': 'F-4593r88600_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86643', 'V-72019']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204469'
+  tag rid: 'SV-204469r603830_rule'
+  tag stig_id: 'RHEL-07-020640'
+  tag fix_id: 'F-4593r88600_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs']
   tag 'host'
diff --git a/controls/SV-204470.rb b/controls/SV-204470.rb
index 29584d8fa..bf3371a34 100644
--- a/controls/SV-204470.rb
+++ b/controls/SV-204470.rb
@@ -4,31 +4,33 @@
   desc "If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary
     GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may
     not be able to access files that they legitimately should."
-  desc 'rationale', ''
-  desc 'check', %q{Verify the assigned home directory of all local interactive users is group-owned by that user's
-    primary GID.
-    Check the home directory assignment for all local interactive users on the system with the following command:
-    # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
-    -rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj
-    Check the user's primary group with the following command:
-    # grep $(grep smithj /etc/passwd | awk -F: ‘{print $4}’) /etc/group
-    users:x:250:smithj,jonesj,jacksons
-    If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a
-    finding.}
+  desc 'check', %q(Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.
+
+Check the home directory assignment for all local interactive users on the system with the following command:
+
+     # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
+     -rwxr-x--- 1 smithj users 13 Apr 1 04:20 /home/smithj
+
+Check the user's primary group with the following command:
+
+     # grep $(grep smithj /etc/passwd | awk -F: '{print $4}') /etc/group
+     users:x:250:smithj,marinc,chongt
+
+If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.)
   desc 'fix', %q(Change the group owner of a local interactive user's home directory to the group found in
     "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command:
     Note: The example will be for the user "smithj", who has a home directory of "/home/smithj", and has a primary group
     of users.
     # chgrp users /home/smithj)
   impact 0.5
-  tag 'legacy': ['SV-86645', 'V-72021']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204470'
-  tag 'rid': 'SV-204470r744102_rule'
-  tag 'stig_id': 'RHEL-07-020650'
-  tag 'fix_id': 'F-4594r88603_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86645', 'V-72021']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204470'
+  tag rid: 'SV-204470r880764_rule'
+  tag stig_id: 'RHEL-07-020650'
+  tag fix_id: 'F-4594r880763_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs']
   tag 'host'
diff --git a/controls/SV-204471.rb b/controls/SV-204471.rb
index fb853abb2..c2e896832 100644
--- a/controls/SV-204471.rb
+++ b/controls/SV-204471.rb
@@ -3,7 +3,6 @@
     contained in local interactive user home directories have a valid owner.'
   desc 'Unowned files and directories may be unintentionally inherited if a user is assigned the same User
     Identifier "UID" as the UID of the un-owned files.'
-  desc 'rationale', ''
   desc 'check', %q(Verify all files and directories in a local interactive user's home directory have a valid owner.
     Check the owner of all files and directories in a local interactive user's home directory with the following
     command:
@@ -18,14 +17,14 @@
     Note: The example will be for the user smithj, who has a home directory of "/home/smithj".
     $ sudo chown smithj /home/smithj/<file or directory>'
   impact 0.5
-  tag 'legacy': ['SV-86647', 'V-72023']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204471'
-  tag 'rid': 'SV-204471r744105_rule'
-  tag 'stig_id': 'RHEL-07-020660'
-  tag 'fix_id': 'F-4595r744104_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86647', 'V-72023']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204471'
+  tag rid: 'SV-204471r744105_rule'
+  tag stig_id: 'RHEL-07-020660'
+  tag fix_id: 'F-4595r744104_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs']
   tag 'host'
diff --git a/controls/SV-204472.rb b/controls/SV-204472.rb
index b4a70f8de..d6b527b41 100644
--- a/controls/SV-204472.rb
+++ b/controls/SV-204472.rb
@@ -4,8 +4,7 @@
     a member.'
   desc "If a local interactive user's files are group-owned by a group of which the user is not a member, unintended
     users may be able to access them."
-  desc 'rationale', ''
-  desc 'check', %q{Verify all files and directories in a local interactive user home directory are group-owned by a
+  desc 'check', %q(Verify all files and directories in a local interactive user home directory are group-owned by a
     group the user is a member of.
     Check the group owner of all files and directories in a local interactive user's home directory with the following
     command:
@@ -20,7 +19,7 @@
     sa:x:100:juan,shelley,bob,smithj
     smithj:x:521:smithj
     If the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is
-    a finding.}
+    a finding.)
   desc 'fix', %q(Change the group of a local interactive user's files and directories to a group that the interactive
     user is a member of. To change the group owner of a local interactive user's files and directories, use the
     following command:
@@ -28,14 +27,14 @@
     users group.
     # chgrp users /home/smithj/<file>)
   impact 0.5
-  tag 'legacy': ['V-72025', 'SV-86649']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204472'
-  tag 'rid': 'SV-204472r603261_rule'
-  tag 'stig_id': 'RHEL-07-020670'
-  tag 'fix_id': 'F-4596r88609_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72025', 'SV-86649']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204472'
+  tag rid: 'SV-204472r603261_rule'
+  tag stig_id: 'RHEL-07-020670'
+  tag fix_id: 'F-4596r88609_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs']
   tag 'host'
diff --git a/controls/SV-204473.rb b/controls/SV-204473.rb
index 76ef4a220..2a56b2e12 100644
--- a/controls/SV-204473.rb
+++ b/controls/SV-204473.rb
@@ -3,7 +3,6 @@
     contained in local interactive user home directories have a mode of 0750 or less permissive.'
   desc 'If a local interactive user files have excessive permissions, unintended users may be able to access or
     modify them.'
-  desc 'rationale', ''
   desc 'check', 'Verify all files and directories contained in a local interactive user home directory, excluding
     local initialization files, have a mode of "0750".
     Check the mode of all non-initialization files in a local interactive user home directory with the following
@@ -15,27 +14,26 @@
     -rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2
     -rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3
     If any files are found with a mode more permissive than "0750", this is a finding.'
-  desc  'fix', "
-    Set the mode on files and directories in the local interactive user home
+  desc 'fix', 'Set the mode on files and directories in the local interactive user home
 directory with the following command:
 
     Note: The example will be for the user smithj, who has a home directory of
-\"/home/smithj\" and is a member of the users group.
+"/home/smithj" and is a member of the users group.
 
-    # chmod 0750 /home/smithj/<file>
-  "
+    # chmod 0750 /home/smithj/<file>'
   impact 0.5
-  tag 'legacy': ['V-72027', 'SV-86651']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204473'
-  tag 'rid': 'SV-204473r603261_rule'
-  tag 'stig_id': 'RHEL-07-020680'
-  tag 'fix_id': 'F-4597r88612_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72027', 'SV-86651']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204473'
+  tag rid: 'SV-204473r603261_rule'
+  tag stig_id: 'RHEL-07-020680'
+  tag fix_id: 'F-4597r88612_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if virtualization.system.eql?('docker')
     impact 0.0
diff --git a/controls/SV-204474.rb b/controls/SV-204474.rb
index 382ae75dd..fc71370a3 100644
--- a/controls/SV-204474.rb
+++ b/controls/SV-204474.rb
@@ -3,8 +3,7 @@
     interactive users are owned by the home directory user or root.'
   desc "Local initialization files are used to configure the user's shell environment upon logon. Malicious
     modification of these files could compromise accounts upon logon."
-  desc 'rationale', ''
-  desc 'check', %q{Verify the local initialization files of all local interactive users are owned by that user.
+  desc 'check', %q(Verify the local initialization files of all local interactive users are owned by that user.
     Check the home directory assignment for all non-privileged users on the system with the following command:
     Note: The example will be for the smithj user, who has a home directory of "/home/smithj".
     # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd
@@ -16,25 +15,23 @@
     -rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile
     -rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login
     -rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something
-    If all local interactive user's initialization files are not owned by that user or root, this is a finding.}
-  desc  'fix', "
-    Set the owner of the local initialization files for interactive users to
+    If all local interactive user's initialization files are not owned by that user or root, this is a finding.)
+  desc 'fix', 'Set the owner of the local initialization files for interactive users to
 either the directory owner or root with the following command:
 
     Note: The example will be for the smithj user, who has a home directory of
-\"/home/smithj\".
+"/home/smithj".
 
-    # chown smithj /home/smithj/.[^.]*
-  "
+    # chown smithj /home/smithj/.[^.]*'
   impact 0.5
-  tag 'legacy': ['V-72029', 'SV-86653']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204474'
-  tag 'rid': 'SV-204474r603834_rule'
-  tag 'stig_id': 'RHEL-07-020690'
-  tag 'fix_id': 'F-4598r462464_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72029', 'SV-86653']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204474'
+  tag rid: 'SV-204474r603834_rule'
+  tag stig_id: 'RHEL-07-020690'
+  tag fix_id: 'F-4598r462464_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['init_files']
   tag 'host'
diff --git a/controls/SV-204475.rb b/controls/SV-204475.rb
index 368517ccf..34f15d06a 100644
--- a/controls/SV-204475.rb
+++ b/controls/SV-204475.rb
@@ -3,8 +3,7 @@
     local interactive users are be group-owned by the users primary group or root.'
   desc "Local initialization files for interactive users are used to configure the user's shell environment upon
     logon. Malicious modification of these files could compromise accounts upon logon."
-  desc 'rationale', ''
-  desc 'check', %q{Verify the local initialization files of all local interactive users are group-owned by that user's
+  desc 'check', %q(Verify the local initialization files of all local interactive users are group-owned by that user's
     primary Group Identifier (GID).
     Check the home directory assignment for all non-privileged users on the system with the following command:
     Note: The example will be for the smithj user, who has a home directory of "/home/smithj" and a primary group of
@@ -21,21 +20,21 @@
     -rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login
     -rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something
     If all local interactive user's initialization files are not group-owned by that user's primary GID, this is a
-    finding.}
+    finding.)
   desc 'fix', %q(Change the group owner of a local interactive user's files to the group found in "/etc/passwd" for the
     user. To change the group owner of a local interactive user's home directory, use the following command:
     Note: The example will be for the user smithj, who has a home directory of "/home/smithj", and has a primary group
     of users.
     # chgrp users /home/smithj/.[^.]*)
   impact 0.5
-  tag 'legacy': ['V-72031', 'SV-86655']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204475'
-  tag 'rid': 'SV-204475r603836_rule'
-  tag 'stig_id': 'RHEL-07-020700'
-  tag 'fix_id': 'F-4599r88618_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72031', 'SV-86655']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204475'
+  tag rid: 'SV-204475r603836_rule'
+  tag stig_id: 'RHEL-07-020700'
+  tag fix_id: 'F-4599r88618_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['init_files']
   tag 'host'
diff --git a/controls/SV-204476.rb b/controls/SV-204476.rb
index 1212b0ab3..6d8f8807b 100644
--- a/controls/SV-204476.rb
+++ b/controls/SV-204476.rb
@@ -3,7 +3,6 @@
     have mode 0740 or less permissive.'
   desc "Local initialization files are used to configure the user's shell environment upon logon. Malicious
     modification of these files could compromise accounts upon logon."
-  desc 'rationale', ''
   desc 'check', 'Verify that all local initialization files have a mode of "0740" or less permissive.
     Check the mode on all local initialization files with the following command:
     Note: The example will be for the "smithj" user, who has a home directory of "/home/smithj".
@@ -12,24 +11,22 @@
     -rwxr----- 1 smithj users 497 Jan 6 2007 .login
     -rwxr----- 1 smithj users 886 Jan 6 2007 .something
     If any local initialization files have a mode more permissive than "0740", this is a finding.'
-  desc  'fix', "
-    Set the mode of the local initialization files to \"0740\" with the
+  desc 'fix', 'Set the mode of the local initialization files to "0740" with the
 following command:
 
-    Note: The example will be for the \"smithj\" user, who has a home directory
-of \"/home/smithj\".
+    Note: The example will be for the "smithj" user, who has a home directory
+of "/home/smithj".
 
-    # chmod 0740 /home/smithj/.[^.]*
-  "
+    # chmod 0740 /home/smithj/.[^.]*'
   impact 0.5
-  tag 'legacy': ['SV-86657', 'V-72033']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204476'
-  tag 'rid': 'SV-204476r603261_rule'
-  tag 'stig_id': 'RHEL-07-020710'
-  tag 'fix_id': 'F-4600r88621_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86657', 'V-72033']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204476'
+  tag rid: 'SV-204476r603261_rule'
+  tag stig_id: 'RHEL-07-020710'
+  tag fix_id: 'F-4600r88621_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['init_files']
   tag 'host'
diff --git a/controls/SV-204477.rb b/controls/SV-204477.rb
index f2ec7b869..3ab04b979 100644
--- a/controls/SV-204477.rb
+++ b/controls/SV-204477.rb
@@ -8,7 +8,6 @@
     consecutive colons, this is interpreted as the current working directory. If deviations from the default system
     search path for the local interactive user are required, they must be documented with the Information System
     Security Officer (ISSO)."
-  desc 'rationale', ''
   desc 'check', %q(Verify that all local interactive user initialization files' executable search path statements do
     not contain statements that will reference a working directory other than the user's home directory.
     Check the executable search path statement for all local interactive user initialization files in the user's home
@@ -23,14 +22,14 @@
     If a local interactive user requires path variables to reference a directory owned by the application, it must be
     documented with the ISSO.'
   impact 0.5
-  tag 'legacy': ['V-72035', 'SV-86659']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204477'
-  tag 'rid': 'SV-204477r792828_rule'
-  tag 'stig_id': 'RHEL-07-020720'
-  tag 'fix_id': 'F-4601r88624_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72035', 'SV-86659']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204477'
+  tag rid: 'SV-204477r792828_rule'
+  tag stig_id: 'RHEL-07-020720'
+  tag fix_id: 'F-4601r88624_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['init_files']
   tag 'host'
diff --git a/controls/SV-204478.rb b/controls/SV-204478.rb
index 1962d8be4..36749179d 100644
--- a/controls/SV-204478.rb
+++ b/controls/SV-204478.rb
@@ -1,12 +1,11 @@
 control 'SV-204478' do
   title 'The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not
     execute world-writable programs.'
-  desc "If user start-up files execute world-writable programs, especially in
+  desc 'If user start-up files execute world-writable programs, especially in
     unprotected directories, they could be maliciously modified to destroy user
     files or otherwise compromise the system at the user level. If the system is
     compromised at the user level, it is easier to elevate privileges to eventually
-    compromise the system at the root and network level."
-  desc 'rationale', ''
+    compromise the system at the root and network level.'
   desc 'check', %q(Verify that local initialization files do not execute world-writable programs.
     Check the system for world-writable files with the following command:
     # find / -xdev -perm -002 -type f -exec ls -ld {} \; | more
@@ -15,21 +14,19 @@
     directory.
     # grep <file> /home/*/.*
     If any local initialization files are found to reference world-writable files, this is a finding.)
-  desc  'fix', "
-    Set the mode on files being executed by the local initialization files with
+  desc 'fix', 'Set the mode on files being executed by the local initialization files with
 the following command:
 
-    # chmod 0755 <file>
-  "
+    # chmod 0755 <file>'
   impact 0.5
-  tag 'legacy': ['SV-86661', 'V-72037']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204478'
-  tag 'rid': 'SV-204478r603261_rule'
-  tag 'stig_id': 'RHEL-07-020730'
-  tag 'fix_id': 'F-4602r88627_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86661', 'V-72037']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204478'
+  tag rid: 'SV-204478r603261_rule'
+  tag stig_id: 'RHEL-07-020730'
+  tag fix_id: 'F-4602r88627_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['init_files']
   tag 'host'
diff --git a/controls/SV-204479.rb b/controls/SV-204479.rb
index 8bf8b5c38..021c5b44d 100644
--- a/controls/SV-204479.rb
+++ b/controls/SV-204479.rb
@@ -3,19 +3,20 @@
     correctly labeled to prevent unauthorized modification.'
   desc 'If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system
     may perform unintended or unauthorized operations.'
-  desc 'rationale', ''
-  desc 'check', %q{Verify that all system device files are correctly labeled to prevent unauthorized modification.
-    List all device files on the system that are incorrectly labeled with the following commands:
-    Note: Device files are normally found under "/dev", but applications may place device files in other directories and
-    may necessitate a search of the entire system.
-    #find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
-    #find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
-    Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual
-    machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device
-    files are not a finding.
-    If there is output from either of these commands, other than already noted, this is a finding.}
-  desc  'fix', "
-    Run the following command to determine which package owns the device file:
+  desc 'check', %q(Verify that all system device files are correctly labeled to prevent unauthorized modification.
+
+List all device files on the system that are incorrectly labeled with the following commands:
+
+Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system.
+
+#find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
+
+#find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
+
+Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding.
+
+If there is output from either of these commands, other than already noted, this is a finding.)
+  desc 'fix', 'Run the following command to determine which package owns the device file:
 
     # rpm -qf <filename>
 
@@ -26,19 +27,17 @@
     Alternatively, the package can be reinstalled from trusted media using the
 command:
 
-    # sudo rpm -Uvh <packagename>
-  "
+    # sudo rpm -Uvh <packagename>'
   impact 0.5
-  tag 'legacy': ['SV-86663', 'V-72039']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204479'
-  tag 'rid': 'SV-204479r603261_rule'
-  tag 'stig_id': 'RHEL-07-020900'
-  tag 'fix_id': 'F-4603r88630_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['SV-86663', 'V-72039']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204479'
+  tag rid: 'SV-204479r853899_rule'
+  tag stig_id: 'RHEL-07-020900'
+  tag fix_id: 'F-4603r88630_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['system_device', 'device_files']
   tag 'host'
 
diff --git a/controls/SV-204480.rb b/controls/SV-204480.rb
index 8aa3b7004..5dbd5bd13 100644
--- a/controls/SV-204480.rb
+++ b/controls/SV-204480.rb
@@ -5,8 +5,7 @@
     This option must be used for mounting any file system not containing approved setuid and setguid files. Executing
     files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized
     administrative access.'
-  desc 'rationale', ''
-  desc 'check', %q{Verify file systems that contain user home directories are mounted with the "nosuid" option.
+  desc 'check', %q(Verify file systems that contain user home directories are mounted with the "nosuid" option.
     Find the file system(s) that contain the user home directories with the following command:
     Note: If a separate file system has not been created for the user home directories (user home directories are
     mounted under "/"), this is not a finding as the "nosuid" option cannot be used on the "/" system.
@@ -17,18 +16,18 @@
     # more /etc/fstab
     UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2
     If a file system found in "/etc/fstab" refers to the user home directory file system and it does not have the
-    "nosuid" option set, this is a finding.}
+    "nosuid" option set, this is a finding.)
   desc 'fix', 'Configure the "/etc/fstab" to use the "nosuid" option on file systems that contain user home
     directories.'
   impact 0.5
-  tag 'legacy': ['SV-86665', 'V-72041']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204480'
-  tag 'rid': 'SV-204480r603838_rule'
-  tag 'stig_id': 'RHEL-07-021000'
-  tag 'fix_id': 'F-4604r88633_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86665', 'V-72041']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204480'
+  tag rid: 'SV-204480r603838_rule'
+  tag stig_id: 'RHEL-07-021000'
+  tag fix_id: 'F-4604r88633_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs', 'file_system']
   tag 'host'
diff --git a/controls/SV-204481.rb b/controls/SV-204481.rb
index 0afbfa2b3..e3bfb683b 100644
--- a/controls/SV-204481.rb
+++ b/controls/SV-204481.rb
@@ -5,7 +5,6 @@
     privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid"
     files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain
     unauthorized administrative access.'
-  desc 'rationale', ''
   desc 'check', 'Verify file systems that are used for removable media are mounted with the "nosuid" option.
     Check the file systems that are mounted at boot time with the following command:
     # more /etc/fstab
@@ -15,14 +14,14 @@
   desc 'fix', 'Configure the "/etc/fstab" to use the "nosuid" option on file systems that are associated with
     removable media.'
   impact 0.5
-  tag 'legacy': ['SV-86667', 'V-72043']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204481'
-  tag 'rid': 'SV-204481r603261_rule'
-  tag 'stig_id': 'RHEL-07-021010'
-  tag 'fix_id': 'F-4605r88636_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86667', 'V-72043']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204481'
+  tag rid: 'SV-204481r603261_rule'
+  tag stig_id: 'RHEL-07-021010'
+  tag fix_id: 'F-4605r88636_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['file_system', 'removable_media']
   tag 'host'
diff --git a/controls/SV-204482.rb b/controls/SV-204482.rb
index 64744abe6..39e1bdd9a 100644
--- a/controls/SV-204482.rb
+++ b/controls/SV-204482.rb
@@ -5,7 +5,6 @@
     privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid"
     files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain
     unauthorized administrative access.'
-  desc 'rationale', ''
   desc 'check', 'Verify file systems that are being NFS imported are configured with the "nosuid" option.
     Find the file system(s) that contain the directories being exported with the following command:
     # more /etc/fstab | grep nfs
@@ -18,17 +17,18 @@
   desc 'fix', 'Configure the "/etc/fstab" to use the "nosuid" option on file systems that are being imported via
     NFS.'
   impact 0.5
-  tag 'legacy': ['SV-86669', 'V-72045']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204482'
-  tag 'rid': 'SV-204482r603261_rule'
-  tag 'stig_id': 'RHEL-07-021020'
-  tag 'fix_id': 'F-4606r88639_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86669', 'V-72045']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204482'
+  tag rid: 'SV-204482r603261_rule'
+  tag stig_id: 'RHEL-07-021020'
+  tag fix_id: 'F-4606r88639_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['etc_fstab']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   nfs_systems = etc_fstab.nfs_file_systems.entries
 
diff --git a/controls/SV-204483.rb b/controls/SV-204483.rb
index 4200a28f6..fe725dadc 100644
--- a/controls/SV-204483.rb
+++ b/controls/SV-204483.rb
@@ -5,7 +5,6 @@
     mounting any file system not containing approved binary files as they may be incompatible. Executing files from
     untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative
     access.'
-  desc 'rationale', ''
   desc 'check', 'Verify file systems that are being NFS imported are configured with the "noexec" option.
     Find the file system(s) that contain the directories being imported with the following command:
     # more /etc/fstab | grep nfs
@@ -20,17 +19,18 @@
   desc 'fix', 'Configure the "/etc/fstab" to use the "noexec" option on file systems that are being imported via
     NFS.'
   impact 0.5
-  tag 'legacy': ['SV-87813', 'V-73161']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204483'
-  tag 'rid': 'SV-204483r603261_rule'
-  tag 'stig_id': 'RHEL-07-021021'
-  tag 'fix_id': 'F-4607r88642_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-87813', 'V-73161']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204483'
+  tag rid: 'SV-204483r603261_rule'
+  tag stig_id: 'RHEL-07-021021'
+  tag fix_id: 'F-4607r88642_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['etc_fstab']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   nfs_systems = etc_fstab.nfs_file_systems.entries
 
diff --git a/controls/SV-204486.rb b/controls/SV-204486.rb
index 8805a22df..5f9dde488 100644
--- a/controls/SV-204486.rb
+++ b/controls/SV-204486.rb
@@ -11,7 +11,6 @@
     option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing
     files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized
     administrative access.'
-  desc 'rationale', ''
   desc 'check', 'Verify that the "nodev","nosuid", and "noexec" options are configured for /dev/shm:
     # cat /etc/fstab | grep /dev/shm
     tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0
@@ -24,17 +23,18 @@
     adding /modifying the /etc/fstab with the following line:
     tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0'
   impact 0.3
-  tag 'legacy': ['SV-95725', 'V-81013']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000368-GPOS-00154'
-  tag 'gid': 'V-204486'
-  tag 'rid': 'SV-204486r603261_rule'
-  tag 'stig_id': 'RHEL-07-021024'
-  tag 'fix_id': 'F-4610r462553_fix'
-  tag 'cci': ['CCI-001764']
+  tag legacy: ['SV-95725', 'V-81013']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000368-GPOS-00154'
+  tag gid: 'V-204486'
+  tag rid: 'SV-204486r853900_rule'
+  tag stig_id: 'RHEL-07-021024'
+  tag fix_id: 'F-4610r462553_fix'
+  tag cci: ['CCI-001764']
   tag nist: ['CM-7 (2)']
   tag subsystems: ['etc_fstab', 'mount']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if mount('/dev/shm').mounted?
 
diff --git a/controls/SV-204487.rb b/controls/SV-204487.rb
index 3d7429d40..5c65b6e4a 100644
--- a/controls/SV-204487.rb
+++ b/controls/SV-204487.rb
@@ -6,7 +6,6 @@
     The only authorized public directories are those temporary directories supplied with the system or those designed to
     be temporary file repositories. The setting is normally reserved for directories used by the system and by users for
     temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.'
-  desc 'rationale', ''
   desc 'check', 'The following command will discover and print world-writable directories that are not group-owned by
     a system account, assuming only system accounts have a GID lower than 1000. Run it once for each local partition
     [PART]:
@@ -16,14 +15,14 @@
     system account. If any world-writable directories are not group-owned by a system account, this should be
     investigated. Following this, the directories should be deleted or assigned to an appropriate group.'
   impact 0.5
-  tag 'legacy': ['V-72047', 'SV-86671']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204487'
-  tag 'rid': 'SV-204487r744106_rule'
-  tag 'stig_id': 'RHEL-07-021030'
-  tag 'fix_id': 'F-36308r602634_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72047', 'SV-86671']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204487'
+  tag rid: 'SV-204487r744106_rule'
+  tag stig_id: 'RHEL-07-021030'
+  tag fix_id: 'F-36308r602634_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['world_writable', 'ww_dirs']
   tag 'host'
diff --git a/controls/SV-204488.rb b/controls/SV-204488.rb
index 8bca7f424..c051e0901 100644
--- a/controls/SV-204488.rb
+++ b/controls/SV-204488.rb
@@ -5,30 +5,32 @@
     to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit
     representing special access modes is typically ignored or required to be "0". This requirement applies to the
     globally configured system defaults and the local interactive user defaults for each account on the system.'
-  desc 'rationale', ''
-  desc 'check', 'Verify that the default umask for all local interactive users is "077".
-    Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file.
-    Check all local interactive user initialization files for interactive users with the following command:
-    Note: The example is for a system that is configured to create users home directories in the "/home" directory.
-    # grep -i umask /home/*/.*
-    If any local interactive user initialization files are found to have a umask statement that has a value less
-    restrictive than "077", this is a finding.'
+  desc 'check', %q(Verify that the default umask for all local interactive users is "077".
+
+Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file.
+
+Check all local interactive user initialization files for interactive users with the following command:
+
+Note: The example is for a system that is configured to create users home directories in the "/home" directory.
+
+$ sudo grep -ir ^umask /home | grep -v '.bash_history'
+
+If any local interactive user initialization files are found to have a umask statement that has a value less restrictive than "077", this is a finding.)
   desc 'fix', %q(Remove the umask statement from all local interactive user's initialization files.
     If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with
     the Information System Security Officer, but the user agreement for access to the account must specify that the
     local interactive user must log on to their account first and then switch the user to the application account with
     the correct option to gain the account's environment variables.)
   impact 0.5
-  tag 'legacy': ['V-72049', 'SV-86673']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204488'
-  tag 'rid': 'SV-204488r603261_rule'
-  tag 'stig_id': 'RHEL-07-021040'
-  tag 'fix_id': 'F-4612r88657_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['V-72049', 'SV-86673']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204488'
+  tag rid: 'SV-204488r861006_rule'
+  tag stig_id: 'RHEL-07-021040'
+  tag fix_id: 'F-4612r88657_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['init_files', 'home_dirs']
   tag 'host'
 
@@ -69,7 +71,7 @@
 
       if is_local == 0
         # Get user's initialization files
-        dotfiles += command("find #{u.home} -xdev -maxdepth 2 ( -name '.*' ! -name '.bash_history' ) -type f").stdout.split("\n")
+        dotfiles << command("find #{u.home} -xdev -maxdepth 2 -name '.*' ! -name '.bash_history' -type f").stdout.split("\n")
 
         # Get user's umask
         umasks.store(u.username,
@@ -77,14 +79,14 @@
 
         # Check all local initialization files to see whether or not they are less restrictive than the input UMASK.
         dotfiles.each do |df|
-          findings += df if file(df).more_permissive_than?(input('user_umask'))
+          findings << df if file(df).more_permissive_than?(input('user_umask'))
         end
 
         # Check umask for all interactive users
         umasks.each do |key, value|
           max_mode = (input('user_umask')).to_i(8)
-          inv_mode = 0777 ^ max_mode
-          umask_findings += key if inv_mode & (value).to_i(8) != 0
+          inverse_mode = 0777 ^ max_mode
+          umask_findings << key if inverse_mode & (value).to_i(8) != 0
         end
       else
         describe 'This control skips non-local filesystems' do
diff --git a/controls/SV-204489.rb b/controls/SV-204489.rb
index 33fa2a016..cfc8dc3c1 100644
--- a/controls/SV-204489.rb
+++ b/controls/SV-204489.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must have cron logging implemented.'
   desc 'Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used
     to spot intrusions into the use of the cron facility by unauthorized and malicious users.'
-  tag  'rationale': ''
   desc 'check', 'Verify that "rsyslog" is configured to log cron events.
     Check the configuration of "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files for the cron facility with the
     following command:
@@ -21,17 +20,18 @@
     The rsyslog daemon must be restarted for the changes to take effect:
     $ sudo systemctl restart rsyslog.service'
   impact 0.5
-  tag 'legacy': ['V-72051', 'SV-86675']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204489'
-  tag 'rid': 'SV-204489r744109_rule'
-  tag 'stig_id': 'RHEL-07-021100'
-  tag 'fix_id': 'F-4613r744108_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72051', 'SV-86675']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204489'
+  tag rid: 'SV-204489r744109_rule'
+  tag stig_id: 'RHEL-07-021100'
+  tag fix_id: 'F-4613r744108_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['cron', 'rsyslog']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   log_pkg_paths = input('log_pkg_paths').join(' ')
   cron_log = command("grep cron #{log_pkg_paths}").stdout.strip
diff --git a/controls/SV-204490.rb b/controls/SV-204490.rb
index 4d9e2e581..ca88f1b37 100644
--- a/controls/SV-204490.rb
+++ b/controls/SV-204490.rb
@@ -3,30 +3,28 @@
     is owned by root.'
   desc 'If the owner of the "cron.allow" file is not set to root, the possibility exists for an unauthorized user to
     view or to edit sensitive information.'
-  desc 'rationale', ''
   desc 'check', 'Verify that the "cron.allow" file is owned by root.
     Check the owner of the "cron.allow" file with the following command:
     # ls -al /etc/cron.allow
     -rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow
     If the "cron.allow" file exists and has an owner other than root, this is a finding.'
-  desc  'fix', "
-    Set the owner on the \"/etc/cron.allow\" file to root with the following
+  desc 'fix', 'Set the owner on the "/etc/cron.allow" file to root with the following
 command:
 
-    # chown root /etc/cron.allow
-  "
+    # chown root /etc/cron.allow'
   impact 0.5
-  tag 'legacy': ['V-72053', 'SV-86677']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204490'
-  tag 'rid': 'SV-204490r603261_rule'
-  tag 'stig_id': 'RHEL-07-021110'
-  tag 'fix_id': 'F-4614r88663_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72053', 'SV-86677']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204490'
+  tag rid: 'SV-204490r603261_rule'
+  tag stig_id: 'RHEL-07-021110'
+  tag fix_id: 'F-4614r88663_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['cron']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe.one do
     # case where file doesn't exist
diff --git a/controls/SV-204491.rb b/controls/SV-204491.rb
index 71fa6e618..e5c598688 100644
--- a/controls/SV-204491.rb
+++ b/controls/SV-204491.rb
@@ -3,30 +3,28 @@
     is group-owned by root.'
   desc 'If the group owner of the "cron.allow" file is not set to root, sensitive information could be viewed or
     edited by unauthorized users.'
-  desc 'rationale', ''
   desc 'check', 'Verify that the "cron.allow" file is group-owned by root.
     Check the group owner of the "cron.allow" file with the following command:
     # ls -al /etc/cron.allow
     -rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow
     If the "cron.allow" file exists and has a group owner other than root, this is a finding.'
-  desc  'fix', "
-    Set the group owner on the \"/etc/cron.allow\" file to root with the
+  desc 'fix', 'Set the group owner on the "/etc/cron.allow" file to root with the
 following command:
 
-    # chgrp root /etc/cron.allow
-  "
+    # chgrp root /etc/cron.allow'
   impact 0.5
-  tag 'legacy': ['SV-86679', 'V-72055']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204491'
-  tag 'rid': 'SV-204491r603261_rule'
-  tag 'stig_id': 'RHEL-07-021120'
-  tag 'fix_id': 'F-4615r88666_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86679', 'V-72055']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204491'
+  tag rid: 'SV-204491r603261_rule'
+  tag stig_id: 'RHEL-07-021120'
+  tag fix_id: 'F-4615r88666_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['cron']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe.one do
     # case where file doesn't exist
diff --git a/controls/SV-204492.rb b/controls/SV-204492.rb
index 384984d7c..de5a6ab55 100644
--- a/controls/SV-204492.rb
+++ b/controls/SV-204492.rb
@@ -3,7 +3,6 @@
   desc 'Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps
     may consume a considerable amount of disk space and may result in denial of service by exhausting the available
     space on the target file system partition.'
-  desc 'rationale', ''
   desc 'check', 'Verify that kernel core dumps are disabled unless needed.
     Check the status of the "kdump" service with the following command:
     # systemctl status kdump.service
@@ -19,14 +18,14 @@
     # systemctl disable kdump.service
     If kernel core dumps are required, document the need with the ISSO.'
   impact 0.5
-  tag 'legacy': ['SV-86681', 'V-72057']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204492'
-  tag 'rid': 'SV-204492r603261_rule'
-  tag 'stig_id': 'RHEL-07-021300'
-  tag 'fix_id': 'F-4616r88669_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86681', 'V-72057']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204492'
+  tag rid: 'SV-204492r603261_rule'
+  tag stig_id: 'RHEL-07-021300'
+  tag fix_id: 'F-4616r88669_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kdump', 'kernel']
   tag 'host'
diff --git a/controls/SV-204493.rb b/controls/SV-204493.rb
index 410d52021..e4e28b0f6 100644
--- a/controls/SV-204493.rb
+++ b/controls/SV-204493.rb
@@ -3,7 +3,6 @@
     user home directories (such as /home or an equivalent).'
   desc 'The use of separate file systems for different paths can protect the system from failures resulting from a
     file system becoming full or failing.'
-  desc 'rationale', ''
   desc 'check', "Verify that a separate file system/partition has been created for non-privileged local interactive
     user home directories.
     Check the home directory assignment for all non-privileged users (those with a UID of 1000 or greater) on the system
@@ -24,14 +23,14 @@
     directories does not exist, this is a finding."
   desc 'fix', 'Migrate the "/home" directory onto a separate file system/partition.'
   impact 0.3
-  tag 'legacy': ['SV-86683', 'V-72059']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204493'
-  tag 'rid': 'SV-204493r603840_rule'
-  tag 'stig_id': 'RHEL-07-021310'
-  tag 'fix_id': 'F-4617r88672_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86683', 'V-72059']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204493'
+  tag rid: 'SV-204493r603840_rule'
+  tag stig_id: 'RHEL-07-021310'
+  tag fix_id: 'F-4617r88672_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['home_dirs', 'file_system']
   tag 'host'
diff --git a/controls/SV-204494.rb b/controls/SV-204494.rb
index dd1fbc2f7..7fa2fc433 100644
--- a/controls/SV-204494.rb
+++ b/controls/SV-204494.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must use a separate file system for /var.'
   desc 'The use of separate file systems for different paths can protect the system from failures resulting from a
     file system becoming full or failing.'
-  desc 'rationale', ''
   desc 'check', 'Verify that a separate file system/partition has been created for "/var".
     Check that a file system/partition has been created for "/var" with the following command:
     # grep /var /etc/fstab
@@ -10,14 +9,14 @@
     If a separate entry for "/var" is not in use, this is a finding.'
   desc 'fix', 'Migrate the "/var" path onto a separate file system.'
   impact 0.3
-  tag 'legacy': ['V-72061', 'SV-86685']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204494'
-  tag 'rid': 'SV-204494r603261_rule'
-  tag 'stig_id': 'RHEL-07-021320'
-  tag 'fix_id': 'F-4618r88675_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72061', 'SV-86685']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204494'
+  tag rid: 'SV-204494r603261_rule'
+  tag stig_id: 'RHEL-07-021320'
+  tag fix_id: 'F-4618r88675_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['/var', 'file_system']
   tag 'host'
diff --git a/controls/SV-204495.rb b/controls/SV-204495.rb
index 95dc23297..d3358d129 100644
--- a/controls/SV-204495.rb
+++ b/controls/SV-204495.rb
@@ -3,7 +3,6 @@
     path.'
   desc 'The use of separate file systems for different paths can protect the system from failures resulting from a
     file system becoming full or failing.'
-  desc 'rationale', ''
   desc 'check', 'Determine if the operating system is configured to have the "/var/log/audit" path is on a separate
     file system.
     # grep /var/log/audit /etc/fstab
@@ -14,14 +13,14 @@
     If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding.'
   desc 'fix', 'Migrate the system audit data path onto a separate file system.'
   impact 0.3
-  tag 'legacy': ['SV-86687', 'V-72063']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204495'
-  tag 'rid': 'SV-204495r603261_rule'
-  tag 'stig_id': 'RHEL-07-021330'
-  tag 'fix_id': 'F-4619r88678_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86687', 'V-72063']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204495'
+  tag rid: 'SV-204495r603261_rule'
+  tag stig_id: 'RHEL-07-021330'
+  tag fix_id: 'F-4619r88678_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['file_system', 'audit']
   tag 'host'
diff --git a/controls/SV-204496.rb b/controls/SV-204496.rb
index af796c543..39cf926e9 100644
--- a/controls/SV-204496.rb
+++ b/controls/SV-204496.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).'
   desc 'The use of separate file systems for different paths can protect the system from failures resulting from a
     file system becoming full or failing.'
-  desc 'rationale', ''
   desc 'check', 'Verify that a separate file system/partition has been created for "/tmp".
     Check that a file system/partition has been created for "/tmp" with the following command:
     # systemctl is-enabled tmp.mount
@@ -12,20 +11,20 @@
     # grep -i /tmp /etc/fstab
     UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0
     If "tmp.mount" service is not enabled or the "/tmp" directory is not defined in the fstab with a device and mount
-    point, this is a finding. '
+    point, this is a finding.'
   desc 'fix', 'Start the "tmp.mount" service with the following command:
     # systemctl enable tmp.mount
     OR
     Edit the "/etc/fstab" file and ensure the "/tmp" directory is defined in the fstab with a device and mount point.'
   impact 0.3
-  tag 'legacy': ['SV-86689', 'V-72065']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204496'
-  tag 'rid': 'SV-204496r603261_rule'
-  tag 'stig_id': 'RHEL-07-021340'
-  tag 'fix_id': 'F-36309r602637_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86689', 'V-72065']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204496'
+  tag rid: 'SV-204496r603261_rule'
+  tag stig_id: 'RHEL-07-021340'
+  tag fix_id: 'F-36309r602637_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['file_system', 'tmp']
   tag 'host'
diff --git a/controls/SV-204497.rb b/controls/SV-204497.rb
index c121ff683..dbb9049f8 100644
--- a/controls/SV-204497.rb
+++ b/controls/SV-204497.rb
@@ -6,7 +6,6 @@
   desc 'Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.
     The operating system must implement cryptographic modules adhering to the higher standards approved by the federal
     government since this provides assurance they have been tested and validated.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system implements DoD-approved encryption to protect the confidentiality of
     remote access sessions.
     Check to see if the "dracut-fips" package is installed with the following command:
@@ -68,19 +67,19 @@
     # touch /etc/ system-fips
     Reboot the system for the changes to take effect.'
   impact 0.7
-  tag 'legacy': ['SV-86691', 'V-72067']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000033-GPOS-00014'
-  tag 'satisfies': ['SRG-OS-000033-GPOS-00014', 'SRG-OS-000185-GPOS-00079', 'SRG-OS-000396-GPOS-00176',
-                    'SRG-OS-000405-GPOS-00184', 'SRG-OS-000478-GPOS-00223']
-  tag 'gid': 'V-204497'
-  tag 'rid': 'SV-204497r603261_rule'
-  tag 'stig_id': 'RHEL-07-021350'
-  tag 'fix_id': 'F-36310r602640_fix'
-  tag 'cci': ['CCI-000068', 'CCI-001199', 'CCI-002450', 'CCI-002476']
-  tag nist: ['AC-17 (2)', 'SC-28', 'SC-13', 'SC-28 (1)']
+  tag legacy: ['SV-86691', 'V-72067']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000033-GPOS-00014'
+  tag satisfies: ['SRG-OS-000033-GPOS-00014', 'SRG-OS-000185-GPOS-00079', 'SRG-OS-000396-GPOS-00176', 'SRG-OS-000405-GPOS-00184', 'SRG-OS-000478-GPOS-00223']
+  tag gid: 'V-204497'
+  tag rid: 'SV-204497r877398_rule'
+  tag stig_id: 'RHEL-07-021350'
+  tag fix_id: 'F-36310r602640_fix'
+  tag cci: ['CCI-000068', 'CCI-001199', 'CCI-002450', 'CCI-002476']
+  tag nist: ['AC-17 (2)', 'SC-28', 'SC-13', 'SC-28 (1)', 'SC-13 b']
   tag subsystems: ['fips']
   tag 'host'
+
   if virtualization.system.eql?('docker')
     impact 0.0
     describe 'Control not applicable - Kernel config for FIPS capability must be done on the host' do
diff --git a/controls/SV-204498.rb b/controls/SV-204498.rb
index d94d4a7a8..e6c30be74 100644
--- a/controls/SV-204498.rb
+++ b/controls/SV-204498.rb
@@ -3,60 +3,60 @@
     configured to verify Access Control Lists (ACLs).'
   desc 'ACLs can provide permissions beyond those permitted through the file mode and must be verified by file
     integrity tools.'
-  desc 'rationale', ''
   desc 'check', 'Verify the file integrity tool is configured to verify ACLs.
-    Check to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following
-    command:
-    # yum list installed aide
-    If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.
-    If there is no application installed to perform file integrity checks, this is a finding.
-    Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc"
-    directory.
-    Use the following command to determine if the file is in another location:
-    # find / -name aide.conf
-    Check the "aide.conf" file to determine if the "acl" rule has been added to the rule list being applied to the files
-    and directories selection lists.
-    An example rule that includes the "acl" rule is below:
-    All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
-    /bin All # apply the custom rule to the files in bin
-    /sbin All # apply the same custom rule to the files in sbin
-    If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not
-    being checked by another file integrity tool, this is a finding.'
+
+Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc" directory.
+
+Use the following command to determine if the file is in another location:
+
+     # find / -name aide.conf
+
+Check the "aide.conf" file to determine if the "acl" rule has been added to the rule list being applied to the files and directories selection lists.
+
+An example rule that includes the "acl" rule is below:
+
+     All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
+     /bin All # apply the custom rule to the files in bin
+     /sbin All # apply the same custom rule to the files in sbin
+
+If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.'
   desc 'fix', 'Configure the file integrity tool to check file and directory ACLs.
     If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.'
   impact 0.3
-  tag 'legacy': ['SV-86693', 'V-72069']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204498'
-  tag 'rid': 'SV-204498r603261_rule'
-  tag 'stig_id': 'RHEL-07-021600'
-  tag 'fix_id': 'F-4622r88687_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86693', 'V-72069']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204498'
+  tag rid: 'SV-204498r880856_rule'
+  tag stig_id: 'RHEL-07-021600'
+  tag fix_id: 'F-4622r88687_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['file_integrity_tool']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   file_integrity_tool = input('file_integrity_tool')
+  aide_conf_file_path = input('aide_conf_path')
 
   if file_integrity_tool == 'aide'
-
-    describe package('aide') do
-      it { should be_installed }
-    end
-
-    findings = []
-    aide_conf.where do
-      !selection_line.start_with? '!'
-    end.entries.each do |selection|
-      unless selection.rules.include? 'acl'
-        findings.append(selection.selection_line)
+    if aide_conf(aide_conf_file_path).exist?
+      findings = []
+      aide_conf.where { !selection_line.start_with? '!' }.entries.each do |selection|
+        unless selection.rules.include? 'acl'
+          findings.append(selection.selection_line)
+        end
       end
-    end
 
-    describe "List of monitored files/directories without 'acl' rule" do
-      subject { findings }
-      it { should be_empty }
+      describe "List of monitored files/directories without 'acl' rule" do
+        subject { findings }
+        it { should be_empty }
+      end
+    else
+      describe "AIDE configuration file at: #{aide_conf_file_path}" do
+        subject { aide_conf(aide_conf_file_path) }
+        it { should exist }
+      end
     end
   else
     describe 'Need manual review of file integrity tool' do
diff --git a/controls/SV-204499.rb b/controls/SV-204499.rb
index 2b0c41bdd..8df178fd8 100644
--- a/controls/SV-204499.rb
+++ b/controls/SV-204499.rb
@@ -3,60 +3,59 @@
     configured to verify extended attributes.'
   desc 'Extended attributes in file systems are used to contain arbitrary data and file metadata with security
     implications.'
-  desc 'rationale', ''
   desc 'check', 'Verify the file integrity tool is configured to verify extended attributes.
-    Check to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following
-    command:
-    # yum list installed aide
-    If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.
-    If there is no application installed to perform file integrity checks, this is a finding.
-    Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc"
-    directory.
-    Use the following command to determine if the file is in another location:
-    # find / -name aide.conf
-    Check the "aide.conf" file to determine if the "xattrs" rule has been added to the rule list being applied to the
-    files and directories selection lists.
-    An example rule that includes the "xattrs" rule follows:
-    All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
-    /bin All # apply the custom rule to the files in bin
-    /sbin All # apply the same custom rule to the files in sbin
-    If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended
-    attributes are not being checked by another file integrity tool, this is a finding.'
+
+Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc" directory.
+
+Use the following command to determine if the file is in another location:
+     # find / -name aide.conf
+
+Check the "aide.conf" file to determine if the "xattrs" rule has been added to the rule list being applied to the files and directories selection lists.
+
+An example rule that includes the "xattrs" rule follows:
+
+     All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
+     /bin All # apply the custom rule to the files in bin
+     /sbin All # apply the same custom rule to the files in sbin
+
+If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding.'
   desc 'fix', 'Configure the file integrity tool to check file and directory extended attributes.
     If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.'
   impact 0.3
-  tag 'legacy': ['SV-86695', 'V-72071']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204499'
-  tag 'rid': 'SV-204499r603261_rule'
-  tag 'stig_id': 'RHEL-07-021610'
-  tag 'fix_id': 'F-4623r88690_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86695', 'V-72071']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204499'
+  tag rid: 'SV-204499r880858_rule'
+  tag stig_id: 'RHEL-07-021610'
+  tag fix_id: 'F-4623r88690_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['file_integrity_tool']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   file_integrity_tool = input('file_integrity_tool')
+  aide_conf_file_path = input('aide_conf_path')
 
   if file_integrity_tool == 'aide'
-
-    describe package('aide') do
-      it { should be_installed }
-    end
-
-    findings = []
-    aide_conf.where do
-      !selection_line.start_with? '!'
-    end.entries.each do |selection|
-      unless selection.rules.include? 'xattrs'
-        findings.append(selection.selection_line)
+    if aide_conf(aide_conf_file_path).exist?
+      findings = []
+      aide_conf.where { !selection_line.start_with? '!' }.entries.each do |selection|
+        unless selection.rules.include? 'xattrs'
+          findings.append(selection.selection_line)
+        end
       end
-    end
 
-    describe "List of monitored files/directories without 'xattrs' rule" do
-      subject { findings }
-      it { should be_empty }
+      describe "List of monitored files/directories without 'xattrs' rule" do
+        subject { findings }
+        it { should be_empty }
+      end
+    else
+      describe "AIDE configuration file at: #{aide_conf_file_path}" do
+        subject { aide_conf(aide_conf_file_path) }
+        it { should exist }
+      end
     end
   else
     describe 'Need manual review of file integrity tool' do
diff --git a/controls/SV-204500.rb b/controls/SV-204500.rb
index b720433fb..b059ea286 100644
--- a/controls/SV-204500.rb
+++ b/controls/SV-204500.rb
@@ -6,61 +6,61 @@
     Red Hat Enterprise Linux operating system installation media ships with an optional file integrity tool called
     Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement
     assumes the "aide.conf" file is under the "/etc" directory.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the file integrity tool is configured to use FIPS 140-2-approved cryptographic hashes for
-    validating file contents and directories.
-    Check to see if AIDE is installed on the system with the following command:
-    # yum list installed aide
-    If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.
-    If there is no application installed to perform file integrity checks, this is a finding.
-    Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc"
-    directory.
-    Use the following command to determine if the file is in another location:
-    # find / -name aide.conf
-    Check the "aide.conf" file to determine if the "sha512" rule has been added to the rule list being applied to the
-    files and directories selection lists. Exclude any log files, or files expected to change frequently, to reduce
-    unnecessary notifications.
-    An example rule that includes the "sha512" rule follows:
-    All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
-    /bin All # apply the custom rule to the files in bin
-    /sbin All # apply the same custom rule to the files in sbin
-    If the "sha512" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or another
-    file integrity tool is not using FIPS 140-2-approved cryptographic hashes for validating file contents and
-    directories, this is a finding.'
+  desc 'check', 'Verify the file integrity tool is configured to use FIPS 140-2-approved cryptographic hashes for validating file contents and directories.
+
+Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc" directory.
+
+Use the following command to determine if the file is in another location:
+
+     # find / -name aide.conf
+
+Check the "aide.conf" file to determine if the "sha512" rule has been added to the rule list being applied to the files and directories selection lists. Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications.
+
+An example rule that includes the "sha512" rule follows:
+
+     All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux
+     /bin All # apply the custom rule to the files in bin
+     /sbin All # apply the same custom rule to the files in sbin
+
+If the "sha512" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or another file integrity tool is not using FIPS 140-2-approved cryptographic hashes for validating file contents and directories, this is a finding.'
   desc 'fix', 'Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and
     directory contents.
     If AIDE is installed, ensure the "sha512" rule is present on all uncommented file and directory selection lists.
     Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications.'
   impact 0.5
-  tag 'legacy': ['SV-86697', 'V-72073']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204500'
-  tag 'rid': 'SV-204500r792831_rule'
-  tag 'stig_id': 'RHEL-07-021620'
-  tag 'fix_id': 'F-4624r792830_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86697', 'V-72073']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204500'
+  tag rid: 'SV-204500r880860_rule'
+  tag stig_id: 'RHEL-07-021620'
+  tag fix_id: 'F-4624r792830_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['file_integrity_tool']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   file_integrity_tool = input('file_integrity_tool')
+  aide_conf_file_path = input('aide_conf_path')
 
   if file_integrity_tool == 'aide'
+    if aide_conf(aide_conf_file_path).exist?
+      exclude_patterns = input('aide_exclude_patterns')
 
-    describe package('aide') do
-      it { should be_installed }
-    end
-
-    exclude_patterns = input('aide_exclude_patterns')
-
-    findings = aide_conf.where do
-      !selection_line.start_with?('!') && !exclude_patterns.include?(selection_line) && !rules.include?('sha512')
-    end
+      findings = aide_conf.where do
+        !selection_line.start_with?('!') && !exclude_patterns.include?(selection_line) && !rules.include?('sha512')
+      end
 
-    describe "List of monitored files/directories without 'sha512' rule" do
-      subject { findings.selection_lines }
-      it { should be_empty }
+      describe "List of monitored files/directories without 'sha512' rule" do
+        subject { findings.selection_lines }
+        it { should be_empty }
+      end
+    else
+      describe "AIDE configuration file at: #{aide_conf_file_path}" do
+        subject { aide_conf(aide_conf_file_path) }
+        it { should exist }
+      end
     end
   else
     describe 'Need manual review of file integrity tool' do
diff --git a/controls/SV-204501.rb b/controls/SV-204501.rb
index eb0c690b4..cbb7badcf 100644
--- a/controls/SV-204501.rb
+++ b/controls/SV-204501.rb
@@ -4,35 +4,37 @@
   desc 'Malicious users with removable boot media can gain access to a system configured to use removable media as
     the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented
     with the Information System Security Officer (ISSO).'
-  desc 'rationale', ''
-  desc 'check', %q{Verify the system is not configured to use a boot loader on removable media.
-    Note: GRUB 2 reads its configuration from the "/boot/grub2/grub.cfg" file on traditional BIOS-based machines and
-    from the "/boot/efi/EFI/redhat/grub.cfg" file on UEFI machines.
-    Check for the existence of alternate boot loader configuration files with the following command:
-    # find / -name grub.cfg
-    /boot/grub2/grub.cfg
-    If a "grub.cfg" is found in any subdirectories other than "/boot/grub2" and "/boot/efi/EFI/redhat", ask the System
-    Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader.
-    Check that the grub configuration file has the set root command in each menu entry with the following commands:
-    # grep -c menuentry /boot/grub2/grub.cfg
-    1
-    # grep 'set root' /boot/grub2/grub.cfg
-    set root=(hd0,1)
-    If the system is using an alternate boot loader on removable media, and documentation does not exist approving the
-    alternate configuration, this is a finding.}
+  desc 'check', %q(Verify the system is not configured to use a boot loader on removable media.
+
+Note: GRUB 2 reads its configuration from the "/boot/grub2/grub.cfg" file on traditional BIOS-based machines and from the "/boot/efi/EFI/redhat/grub.cfg" file on UEFI machines.
+
+Check for the existence of alternate boot loader configuration files with the following command:
+
+# find / -name grub.cfg
+/boot/grub2/grub.cfg
+
+If a "grub.cfg" is found in any subdirectories other than "/boot/grub2" and "/boot/efi/EFI/redhat", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader.
+
+Check that the grub configuration file has the set root command in each menu entry with the following commands:
+
+# grep -cw menuentry /boot/grub2/grub.cfg
+1
+# grep 'set root' /boot/grub2/grub.cfg
+set root=(hd0,1)
+
+If the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.)
   desc 'fix', 'Remove alternate methods of booting the system from removable media or document the configuration to
     boot from removable media with the ISSO.'
   impact 0.5
-  tag 'legacy': ['SV-86699', 'V-72075']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000364-GPOS-00151'
-  tag 'gid': 'V-204501'
-  tag 'rid': 'SV-204501r603261_rule'
-  tag 'stig_id': 'RHEL-07-021700'
-  tag 'fix_id': 'F-4625r88696_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['SV-86699', 'V-72075']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000364-GPOS-00151'
+  tag gid: 'V-204501'
+  tag rid: 'SV-204501r861008_rule'
+  tag stig_id: 'RHEL-07-021700'
+  tag fix_id: 'F-4625r88696_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['grub', 'removable_media']
   tag 'host'
 
diff --git a/controls/SV-204502.rb b/controls/SV-204502.rb
index 7eaf04201..af9ea3283 100644
--- a/controls/SV-204502.rb
+++ b/controls/SV-204502.rb
@@ -9,7 +9,6 @@
     Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and
     demonstration software not related to requirements or providing a wide array of functionality not required for every
     mission, but which cannot be disabled.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system is configured to disable non-essential capabilities. The most secure way
     of ensuring a non-essential capability is disabled is to not have the capability installed.
     The telnet service provides an unencrypted remote access service that does not provide for the confidentiality and
@@ -22,17 +21,18 @@
     package from the system with the following command:
     # yum remove telnet-server'
   impact 0.7
-  tag 'legacy': ['V-72077', 'SV-86701']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000095-GPOS-00049'
-  tag 'gid': 'V-204502'
-  tag 'rid': 'SV-204502r603261_rule'
-  tag 'stig_id': 'RHEL-07-021710'
-  tag 'fix_id': 'F-4626r88699_fix'
-  tag 'cci': ['CCI-000381']
+  tag legacy: ['V-72077', 'SV-86701']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000095-GPOS-00049'
+  tag gid: 'V-204502'
+  tag rid: 'SV-204502r603261_rule'
+  tag stig_id: 'RHEL-07-021710'
+  tag fix_id: 'F-4626r88699_fix'
+  tag cci: ['CCI-000381']
   tag nist: ['CM-7 a']
   tag subsystems: ['packages']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe package('telnet-server') do
     it { should_not be_installed }
diff --git a/controls/SV-204503.rb b/controls/SV-204503.rb
index bf6682da4..aef6a9d71 100644
--- a/controls/SV-204503.rb
+++ b/controls/SV-204503.rb
@@ -11,7 +11,6 @@
     Associating event types with detected events in the operating system audit logs provides a means of investigating an
     attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating
     system.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system produces audit records containing information to establish when (date
     and time) the events occurred.
     Check to see if auditing is active by issuing the following command:
@@ -23,17 +22,16 @@
     Enable the auditd service with the following command:
     # systemctl start auditd.service'
   impact 0.5
-  tag 'legacy': ['SV-86703', 'V-72079']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000038-GPOS-00016'
-  tag 'satisfies': ['SRG-OS-000038-GPOS-00016', 'SRG-OS-000039-GPOS-00017', 'SRG-OS-000042-GPOS-00021',
-                    'SRG-OS-000254-GPOS-00095', 'SRG-OS-000255-GPOS-00096']
-  tag 'gid': 'V-204503'
-  tag 'rid': 'SV-204503r603261_rule'
-  tag 'stig_id': 'RHEL-07-030000'
-  tag 'fix_id': 'F-36311r602643_fix'
-  tag 'cci': ['CCI-000126', 'CCI-000131']
-  tag nist: ['AU-2 d', 'AU-3']
+  tag legacy: ['SV-86703', 'V-72079']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000038-GPOS-00016'
+  tag satisfies: ['SRG-OS-000038-GPOS-00016', 'SRG-OS-000039-GPOS-00017', 'SRG-OS-000042-GPOS-00021', 'SRG-OS-000254-GPOS-00095', 'SRG-OS-000255-GPOS-00096']
+  tag gid: 'V-204503'
+  tag rid: 'SV-204503r603261_rule'
+  tag stig_id: 'RHEL-07-030000'
+  tag fix_id: 'F-36311r602643_fix'
+  tag cci: ['CCI-000126', 'CCI-000131']
+  tag nist: ['AU-2 d', 'AU-3', 'AU-2 c', 'AU-3 b']
   tag subsystems: ['audit', 'auditd']
   tag 'host'
 
diff --git a/controls/SV-204504.rb b/controls/SV-204504.rb
index ad2678b2c..ae2825ecc 100644
--- a/controls/SV-204504.rb
+++ b/controls/SV-204504.rb
@@ -11,18 +11,20 @@
     This requirement applies to each audit data storage repository (i.e., distinct information system component where
     audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage
     repositories combined), or both.'
-  desc 'rationale', ''
   desc 'check', 'Confirm the audit configuration regarding how auditing processing failures are handled.
-    Check to see what level "auditctl" is set to with following command:
-    # auditctl -s | grep -i "fail"
-    failure 2
-    Note: If the value of "failure" is set to "2", the system is configured to panic (shut down) in the event of an
-    auditing failure. If the value of "failure" is set to "1", the system is configured to only send information to the
-    kernel log regarding the failure.
-    If the "failure" setting is set to any value other than "1" or "2", this is a finding.
-    If the "failure" setting is not set, this should be upgraded to a CAT I finding.
-    If the "failure" setting is set to "1" but the availability concern is not documented or there is no monitoring of
-    the kernel log, this should be downgraded to a CAT III finding.'
+
+Check to see what level "auditctl" is set to with following command:
+
+     # auditctl -s | grep -i "fail"
+     failure 2
+
+Note: If the value of "failure" is set to "2", the system is configured to panic (shut down) in the event of an auditing failure. If the value of "failure" is set to "1", the system will not shut down and instead will record the audit failure in the kernel log. If the system is configured as per requirement RHEL-07-031000, the kernel log will be sent to a log aggregation server and generate an alert.
+
+If the "failure" setting is set to any value other than "1" or "2", this is a finding.
+
+If the "failure" setting is not set, this should be upgraded to a CAT I finding.
+
+If the "failure" setting is set to "1" but the availability concern is not documented or there is no monitoring of the kernel log, this should be downgraded to a CAT III finding.'
   desc 'fix', 'Configure the operating system to shut down in the event of an audit processing failure.
     Add or correct the option to shut down the operating system with the following command:
     # auditctl -f 2
@@ -36,15 +38,16 @@
     -f 1
     Kernel log monitoring must also be configured to properly alert designated staff.
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72081', 'SV-86705']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000046-GPOS-00022'
-  tag 'satisfies': ['SRG-OS-000046-GPOS-00022', 'SRG-OS-000047-GPOS-00023']
-  tag 'gid': 'V-204504'
-  tag 'rid': 'SV-204504r603261_rule'
-  tag 'stig_id': 'RHEL-07-030010'
-  tag 'fix_id': 'F-4628r462467_fix'
-  tag 'cci': ['CCI-000139']
+  impact 0.5
+  tag legacy: ['V-72081', 'SV-86705']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000046-GPOS-00022'
+  tag satisfies: ['SRG-OS-000046-GPOS-00022', 'SRG-OS-000047-GPOS-00023']
+  tag gid: 'V-204504'
+  tag rid: 'SV-204504r880761_rule'
+  tag stig_id: 'RHEL-07-030010'
+  tag fix_id: 'F-4628r880760_fix'
+  tag cci: ['CCI-000139']
   tag nist: ['AU-5 a']
   tag subsystems: ['audit', 'auditd']
   tag 'host'
@@ -61,8 +64,6 @@
       impact 0.5
     elsif auditd.status['failure'].match?(/^1$/) && !monitor_kernel_log
       impact 0.3
-    else
-      impact 0.5
     end
 
     if !monitor_kernel_log
diff --git a/controls/SV-204506.rb b/controls/SV-204506.rb
index 9aaba6ded..5ad00cb7c 100644
--- a/controls/SV-204506.rb
+++ b/controls/SV-204506.rb
@@ -6,7 +6,6 @@
     One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.
     Without the configuration of the "au-remote" plugin, the audisp-remote daemon will not off load the logs from the
     system being audited.'
-  desc 'rationale', ''
   desc 'check', 'Verify the "au-remote" plugin is configured to always off-load audit logs using the audisp-remote
     daemon:
     # cat /etc/audisp/plugins.d/au-remote.conf | grep -v "^#"
@@ -21,21 +20,25 @@
     If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,
     this is a finding.'
   desc 'fix', 'Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:
-    direction = out
-    path = /sbin/audisp-remote
-    type = always
-    The audit daemon must be restarted for changes to take effect:
-    # service auditd restart'
+
+active = yes
+direction = out
+path = /sbin/audisp-remote
+type = always
+
+The audit daemon must be restarted for changes to take effect:
+
+# service auditd restart'
   impact 0.5
-  tag 'legacy': ['SV-95729', 'V-81017']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'satisfies': ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
-  tag 'gid': 'V-204506'
-  tag 'rid': 'SV-204506r603261_rule'
-  tag 'stig_id': 'RHEL-07-030201'
-  tag 'fix_id': 'F-4630r462470_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['SV-95729', 'V-81017']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
+  tag gid: 'V-204506'
+  tag rid: 'SV-204506r877390_rule'
+  tag stig_id: 'RHEL-07-030201'
+  tag fix_id: 'F-4630r858479_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204507.rb b/controls/SV-204507.rb
index a85c46453..6d628a142 100644
--- a/controls/SV-204507.rb
+++ b/controls/SV-204507.rb
@@ -5,7 +5,6 @@
     Off-loading is a common process in information systems with limited audit storage capacity.
     One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When
     the remote buffer is full, audit logs will not be collected and sent to the central log server.'
-  desc 'rationale', ''
   desc 'check', 'Verify the audisp daemon is configured to take an appropriate action when the internal queue is
     full:
     # grep "overflow_action" /etc/audisp/audispd.conf
@@ -20,15 +19,15 @@
     The audit daemon must be restarted for changes to take effect:
     # service auditd restart'
   impact 0.5
-  tag 'legacy': ['V-81019', 'SV-95731']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'satisfies': ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
-  tag 'gid': 'V-204507'
-  tag 'rid': 'SV-204507r603261_rule'
-  tag 'stig_id': 'RHEL-07-030210'
-  tag 'fix_id': 'F-36312r602646_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['V-81019', 'SV-95731']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
+  tag gid: 'V-204507'
+  tag rid: 'SV-204507r877390_rule'
+  tag stig_id: 'RHEL-07-030210'
+  tag fix_id: 'F-36312r602646_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204508.rb b/controls/SV-204508.rb
index 6023dfb70..632259759 100644
--- a/controls/SV-204508.rb
+++ b/controls/SV-204508.rb
@@ -6,7 +6,6 @@
     One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When
     audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be
     analyzed and tied back to the correct system.'
-  desc 'rationale', ''
   desc 'check', 'Verify the audisp daemon is configured to label all off-loaded audit logs:
     # grep "name_format" /etc/audisp/audispd.conf
     name_format = hostname
@@ -20,15 +19,15 @@
     The audit daemon must be restarted for changes to take effect:
     # service auditd restart'
   impact 0.5
-  tag 'legacy': ['SV-95733', 'V-81021']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'satisfies': ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
-  tag 'gid': 'V-204508'
-  tag 'rid': 'SV-204508r603261_rule'
-  tag 'stig_id': 'RHEL-07-030211'
-  tag 'fix_id': 'F-36313r602649_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['SV-95733', 'V-81021']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
+  tag gid: 'V-204508'
+  tag rid: 'SV-204508r877390_rule'
+  tag stig_id: 'RHEL-07-030211'
+  tag fix_id: 'F-36313r602649_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204509.rb b/controls/SV-204509.rb
index 910c387fb..cc6561778 100644
--- a/controls/SV-204509.rb
+++ b/controls/SV-204509.rb
@@ -3,7 +3,6 @@
     from the system being audited.'
   desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
     Off-loading is a common process in information systems with limited audit storage capacity.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system off-loads audit records onto a different system or media from the system
     being audited.
     To determine the remote server that the records are being sent to, use the following command:
@@ -16,15 +15,15 @@
     system being audited.
     Set the remote server option in "/etc/audisp/audisp-remote.conf" with the IP address of the log aggregation server.'
   impact 0.5
-  tag 'legacy': ['V-72083', 'SV-86707']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'satisfies': ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
-  tag 'gid': 'V-204509'
-  tag 'rid': 'SV-204509r603261_rule'
-  tag 'stig_id': 'RHEL-07-030300'
-  tag 'fix_id': 'F-4633r88720_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['V-72083', 'SV-86707']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
+  tag gid: 'V-204509'
+  tag rid: 'SV-204509r877390_rule'
+  tag stig_id: 'RHEL-07-030300'
+  tag fix_id: 'F-4633r88720_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204510.rb b/controls/SV-204510.rb
index 7bec94371..7994964ba 100644
--- a/controls/SV-204510.rb
+++ b/controls/SV-204510.rb
@@ -3,7 +3,6 @@
     different system or media from the system being audited.'
   desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
     Off-loading is a common process in information systems with limited audit storage capacity.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system encrypts audit records off-loaded onto a different system or media from
     the system being audited.
     To determine if the transfer is encrypted, use the following command:
@@ -18,15 +17,15 @@
     Uncomment the "enable_krb5" option in "/etc/audisp/audisp-remote.conf" and set it with the following line:
     enable_krb5 = yes'
   impact 0.5
-  tag 'legacy': ['V-72085', 'SV-86709']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'satisfies': ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
-  tag 'gid': 'V-204510'
-  tag 'rid': 'SV-204510r603261_rule'
-  tag 'stig_id': 'RHEL-07-030310'
-  tag 'fix_id': 'F-4634r88723_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['V-72085', 'SV-86709']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']
+  tag gid: 'V-204510'
+  tag rid: 'SV-204510r877390_rule'
+  tag stig_id: 'RHEL-07-030310'
+  tag fix_id: 'F-4634r88723_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204511.rb b/controls/SV-204511.rb
index a8e36476c..159868675 100644
--- a/controls/SV-204511.rb
+++ b/controls/SV-204511.rb
@@ -4,7 +4,6 @@
   desc 'Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing
     audit records.
     One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.'
-  desc 'rationale', ''
   desc 'check', 'Verify the action the operating system takes if the disk the audit records are written to becomes
     full.
     To determine the action that takes place if the disk is full on the remote server, use the following command:
@@ -22,14 +21,14 @@
     "single", or "halt", such as the following line:
     disk_full_action = single'
   impact 0.5
-  tag 'legacy': ['V-72087', 'SV-86711']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'gid': 'V-204511'
-  tag 'rid': 'SV-204511r603261_rule'
-  tag 'stig_id': 'RHEL-07-030320'
-  tag 'fix_id': 'F-36314r602652_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['V-72087', 'SV-86711']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag gid: 'V-204511'
+  tag rid: 'SV-204511r877390_rule'
+  tag stig_id: 'RHEL-07-030320'
+  tag fix_id: 'F-36314r602652_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204512.rb b/controls/SV-204512.rb
index 4af6c5bb5..f50c357aa 100644
--- a/controls/SV-204512.rb
+++ b/controls/SV-204512.rb
@@ -4,7 +4,6 @@
   desc 'Taking appropriate action when there is an error sending audit records to a remote system will minimize the
     possibility of losing audit records.
     One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.'
-  desc 'rationale', ''
   desc 'check', 'Verify the action the operating system takes if there is an error sending audit records to a remote
     system.
     Check the action that takes place if there is an error sending audit records to a remote system with the following
@@ -23,14 +22,14 @@
     or "halt".
     network_failure_action = syslog'
   impact 0.5
-  tag 'legacy': ['V-73163', 'SV-87815']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000342-GPOS-00133'
-  tag 'gid': 'V-204512'
-  tag 'rid': 'SV-204512r603261_rule'
-  tag 'stig_id': 'RHEL-07-030321'
-  tag 'fix_id': 'F-36315r602655_fix'
-  tag 'cci': ['CCI-001851']
+  tag legacy: ['V-73163', 'SV-87815']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000342-GPOS-00133'
+  tag gid: 'V-204512'
+  tag rid: 'SV-204512r877390_rule'
+  tag stig_id: 'RHEL-07-030321'
+  tag fix_id: 'F-36315r602655_fix'
+  tag cci: ['CCI-001851']
   tag nist: ['AU-4 (1)']
   tag subsystems: ['audit', 'audisp']
   tag 'host'
diff --git a/controls/SV-204513.rb b/controls/SV-204513.rb
index bdb6d5e4d..918d518ef 100644
--- a/controls/SV-204513.rb
+++ b/controls/SV-204513.rb
@@ -4,7 +4,6 @@
     75% of the repository maximum audit record storage capacity.'
   desc 'If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they
     are unable to plan for audit record storage capacity expansion.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when
     allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
     Check the system configuration to determine the partition the audit records are being written to with the following
@@ -22,14 +21,14 @@
     space_left = 25%
     Reload the auditd daemon to apply changes made to the "/etc/audit/auditd.conf" file.'
   impact 0.5
-  tag 'legacy': ['V-72089', 'SV-86713']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000343-GPOS-00134'
-  tag 'gid': 'V-204513'
-  tag 'rid': 'SV-204513r744112_rule'
-  tag 'stig_id': 'RHEL-07-030330'
-  tag 'fix_id': 'F-4637r744111_fix'
-  tag 'cci': ['CCI-001855']
+  tag legacy: ['V-72089', 'SV-86713']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000343-GPOS-00134'
+  tag gid: 'V-204513'
+  tag rid: 'SV-204513r877389_rule'
+  tag stig_id: 'RHEL-07-030330'
+  tag fix_id: 'F-4637r744111_fix'
+  tag cci: ['CCI-001855']
   tag nist: ['AU-5 (1)']
   tag subsystems: ['audit', 'auditd']
   tag 'host'
diff --git a/controls/SV-204514.rb b/controls/SV-204514.rb
index 03219c606..5315869f4 100644
--- a/controls/SV-204514.rb
+++ b/controls/SV-204514.rb
@@ -5,7 +5,6 @@
   desc 'If security personnel are not notified immediately when the threshold for the repository maximum audit
     record storage capacity is reached, they are unable to expand the audit record storage capacity before records are
     lost.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the
     allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.
     Check what action the operating system takes when the threshold for the repository maximum audit record storage
@@ -18,14 +17,14 @@
     Uncomment or edit the "space_left_action" keyword in "/etc/audit/auditd.conf" and set it to "email".
     space_left_action = email'
   impact 0.5
-  tag 'legacy': ['V-72091', 'SV-86715']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000343-GPOS-00134'
-  tag 'gid': 'V-204514'
-  tag 'rid': 'SV-204514r603261_rule'
-  tag 'stig_id': 'RHEL-07-030340'
-  tag 'fix_id': 'F-4638r88735_fix'
-  tag 'cci': ['CCI-001855']
+  tag legacy: ['V-72091', 'SV-86715']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000343-GPOS-00134'
+  tag gid: 'V-204514'
+  tag rid: 'SV-204514r877389_rule'
+  tag stig_id: 'RHEL-07-030340'
+  tag fix_id: 'F-4638r88735_fix'
+  tag cci: ['CCI-001855']
   tag nist: ['AU-5 (1)']
   tag subsystems: ['audit', 'auditd']
   tag 'host'
diff --git a/controls/SV-204515.rb b/controls/SV-204515.rb
index d6b4f79c3..46a992de4 100644
--- a/controls/SV-204515.rb
+++ b/controls/SV-204515.rb
@@ -5,7 +5,6 @@
   desc 'If security personnel are not notified immediately when the threshold for the repository maximum audit
     record storage capacity is reached, they are unable to expand the audit record storage capacity before records are
     lost.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the
     threshold for the repository maximum audit record storage capacity is reached.
     Check what account the operating system emails when the threshold for the repository maximum audit record storage
@@ -20,14 +19,14 @@
     accounts associated with security personnel.
     action_mail_acct = root'
   impact 0.5
-  tag 'legacy': ['V-72093', 'SV-86717']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000343-GPOS-00134'
-  tag 'gid': 'V-204515'
-  tag 'rid': 'SV-204515r603261_rule'
-  tag 'stig_id': 'RHEL-07-030350'
-  tag 'fix_id': 'F-4639r88738_fix'
-  tag 'cci': ['CCI-001855']
+  tag legacy: ['V-72093', 'SV-86717']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000343-GPOS-00134'
+  tag gid: 'V-204515'
+  tag rid: 'SV-204515r877389_rule'
+  tag stig_id: 'RHEL-07-030350'
+  tag fix_id: 'F-4639r88738_fix'
+  tag cci: ['CCI-001855']
   tag nist: ['AU-5 (1)']
   tag subsystems: ['audit', 'auditd']
   tag 'host'
diff --git a/controls/SV-204516.rb b/controls/SV-204516.rb
index e59d462fb..7efdfd075 100644
--- a/controls/SV-204516.rb
+++ b/controls/SV-204516.rb
@@ -4,7 +4,6 @@
     unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern
     and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to
     detect such misuse and identify the risk from insider threats and the advanced persistent threat.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system audits the execution of privileged functions using the following
     command:
     # grep -iw execve /etc/audit/audit.rules
@@ -22,14 +21,14 @@
     -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
     The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72095', 'SV-86719']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000327-GPOS-00127'
-  tag 'gid': 'V-204516'
-  tag 'rid': 'SV-204516r603261_rule'
-  tag 'stig_id': 'RHEL-07-030360'
-  tag 'fix_id': 'F-4640r88741_fix'
-  tag 'cci': ['CCI-002234']
+  tag legacy: ['V-72095', 'SV-86719']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000327-GPOS-00127'
+  tag gid: 'V-204516'
+  tag rid: 'SV-204516r853914_rule'
+  tag stig_id: 'RHEL-07-030360'
+  tag fix_id: 'F-4640r88741_fix'
+  tag cci: ['CCI-002234']
   tag nist: ['AC-6 (9)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
diff --git a/controls/SV-204517.rb b/controls/SV-204517.rb
index 3b34f7d4a..f76ae81fe 100644
--- a/controls/SV-204517.rb
+++ b/controls/SV-204517.rb
@@ -13,7 +13,6 @@
     system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect
     performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining
     syscalls into one rule whenever possible.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the
     "chown", "fchown", "fchownat", and "lchown" syscalls.
     Check the file system rules in "/etc/audit/audit.rules" with the following commands:
@@ -22,29 +21,24 @@
     -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod
     If both the "b32" and "b64" audit rules are not defined for the "chown", "fchown", "fchownat", and "lchown"
     syscalls, this is a finding.'
-  desc 'fix', "
-    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":
+  desc 'fix', 'Add or update the following rule in "/etc/audit/rules.d/audit.rules":
 
-    -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k
-perm_mod
+-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod
 
-    -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k
-perm_mod
+-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod
 
-    The audit daemon must be restarted for the changes to take effect.
-  "
+The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86721', 'V-72097']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000064-GPOS-00033'
-  tag 'satisfies': ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000458-GPOS-00203',
-                    'SRG-OS-000474-GPOS-00219']
-  tag 'gid': 'V-204517'
-  tag 'rid': 'SV-204517r809570_rule'
-  tag 'stig_id': 'RHEL-07-030370'
-  tag 'fix_id': 'F-4641r809192_fix'
-  tag 'cci': ['CCI-000126', 'CCI-000172']
-  tag nist: ['AU-2 d', 'AU-12 c']
+  tag legacy: ['SV-86721', 'V-72097']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000064-GPOS-00033'
+  tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000458-GPOS-00203', 'SRG-OS-000474-GPOS-00219']
+  tag gid: 'V-204517'
+  tag rid: 'SV-204517r809570_rule'
+  tag stig_id: 'RHEL-07-030370'
+  tag fix_id: 'F-4641r809192_fix'
+  tag cci: ['CCI-000126', 'CCI-000172']
+  tag nist: ['AU-2 d', 'AU-12 c', 'AU-2 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
@@ -69,7 +63,7 @@
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
           expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-          expect(audit_rule.key.uniq).to cmp 'perm_mod'
+          expect(audit_rule.key.uniq).to include('perm_mod')
         end
       end
     end
diff --git a/controls/SV-204521.rb b/controls/SV-204521.rb
index 0d83b331a..7205b25e9 100644
--- a/controls/SV-204521.rb
+++ b/controls/SV-204521.rb
@@ -13,7 +13,6 @@
     system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect
     performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining
     syscalls into one rule whenever possible.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the
     "chmod", "fchmod", and "fchmodat" syscalls.
     Check the file system rules in "/etc/audit/audit.rules" with the following command:
@@ -29,16 +28,15 @@
     -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod
     The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86729', 'V-72105']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000458-GPOS-00203'
-  tag 'satisfies': ['SRG-OS-000458-GPOS-00203', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000064-GPOS-00033']
-  tag 'gid': 'V-204521'
-  tag 'rid': 'SV-204521r809772_rule'
-  tag 'stig_id': 'RHEL-07-030410'
-  tag 'fix_id': 'F-4645r809771_fix'
-  tag 'cci': ['CCI-000172']
+  tag legacy: ['SV-86729', 'V-72105']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000458-GPOS-00203'
+  tag satisfies: ['SRG-OS-000458-GPOS-00203', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000064-GPOS-00033']
+  tag gid: 'V-204521'
+  tag rid: 'SV-204521r809772_rule'
+  tag stig_id: 'RHEL-07-030410'
+  tag fix_id: 'F-4645r809771_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -64,7 +62,7 @@
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
           expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-          expect(audit_rule.key.uniq).to cmp 'perm_mod'
+          expect(audit_rule.key.uniq).to include('perm_mod')
         end
       end
     end
diff --git a/controls/SV-204524.rb b/controls/SV-204524.rb
index 67c82fb2d..94302fa2c 100644
--- a/controls/SV-204524.rb
+++ b/controls/SV-204524.rb
@@ -13,7 +13,6 @@
     system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect
     performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining
     syscalls into one rule whenever possible.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the
     "setxattr", "fsetxattr", "lsetxattr", "removexattr", "fremovexattr", and "lremovexattr" syscalls.
     Check the file system rules in "/etc/audit/audit.rules" with the following commands:
@@ -33,16 +32,15 @@
     auid!=unset -k perm_mod
     The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86735', 'V-72111']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000458-GPOS-00203'
-  tag 'satisfies': ['SRG-OS-000458-GPOS-00203', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000064-GPOS-00033']
-  tag 'gid': 'V-204524'
-  tag 'rid': 'SV-204524r809775_rule'
-  tag 'stig_id': 'RHEL-07-030440'
-  tag 'fix_id': 'F-4648r809774_fix'
-  tag 'cci': ['CCI-000172']
+  tag legacy: ['SV-86735', 'V-72111']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000458-GPOS-00203'
+  tag satisfies: ['SRG-OS-000458-GPOS-00203', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000064-GPOS-00033']
+  tag gid: 'V-204524'
+  tag rid: 'SV-204524r809775_rule'
+  tag stig_id: 'RHEL-07-030440'
+  tag fix_id: 'F-4648r809774_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -68,7 +66,7 @@
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
           expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-          expect(audit_rule.key.uniq).to cmp 'perm_mod'
+          expect(audit_rule.key.uniq).to include('perm_mod')
         end
       end
     end
diff --git a/controls/SV-204531.rb b/controls/SV-204531.rb
index e0e107095..f16908e9a 100644
--- a/controls/SV-204531.rb
+++ b/controls/SV-204531.rb
@@ -13,7 +13,6 @@
     system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect
     performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining
     syscalls into one rule whenever possible.'
-  desc 'rationale', ''
   desc 'check', %q(Verify the operating system generates audit records upon successful/unsuccessful attempts to use the
     "creat", "open", "openat", "open_by_handle_at", "truncate", and "ftruncate" syscalls.
     Check the file system rules in "/etc/audit/audit.rules" with the following commands:
@@ -43,19 +42,19 @@
     -F auid!=unset -k access
     The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86749', 'V-72125']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000064-GPOS-00033'
-  tag 'satisfies': ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000458-GPOS-00203', 'SRG-OS-000461-GPOS-00205',
-                    'SRG-OS-000392-GPOS-00172']
-  tag 'gid': 'V-204531'
-  tag 'rid': 'SV-204531r809815_rule'
-  tag 'stig_id': 'RHEL-07-030510'
-  tag 'fix_id': 'F-4655r809814_fix'
-  tag 'cci': ['CCI-000172', 'CCI-002884']
+  tag legacy: ['SV-86749', 'V-72125']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000064-GPOS-00033'
+  tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000458-GPOS-00203', 'SRG-OS-000461-GPOS-00205', 'SRG-OS-000392-GPOS-00172']
+  tag gid: 'V-204531'
+  tag rid: 'SV-204531r853917_rule'
+  tag stig_id: 'RHEL-07-030510'
+  tag fix_id: 'F-4655r853916_fix'
+  tag cci: ['CCI-000172', 'CCI-002884']
   tag nist: ['AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
+
   audit_syscalls = ['creat', 'open', 'openat', 'open_by_handle_at', 'truncate', 'ftruncate']
 
   if virtualization.system.eql?('docker')
@@ -77,7 +76,7 @@
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
           expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1', 'exit=-EACCES', 'exit=-EPERM')
-          expect(audit_rule.key.uniq).to cmp 'access'
+          expect(audit_rule.key.uniq).to include('access')
         end
       end
     end
diff --git a/controls/SV-204536.rb b/controls/SV-204536.rb
index f3d0a07c3..8939ad062 100644
--- a/controls/SV-204536.rb
+++ b/controls/SV-204536.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "semanage" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/sbin/semanage /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "semanage" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86759', 'V-72135']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000392-GPOS-00172'
-  tag 'satisfies': ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207',
-                    'SRG-OS-000465-GPOS-00209']
-  tag 'gid': 'V-204536'
-  tag 'rid': 'SV-204536r603261_rule'
-  tag 'stig_id': 'RHEL-07-030560'
-  tag 'fix_id': 'F-4660r462613_fix'
-  tag 'cci': ['CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "semanage" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/sbin/semanage" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "semanage" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86759', 'V-72135']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000392-GPOS-00172'
+  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']
+  tag gid: 'V-204536'
+  tag rid: 'SV-204536r861014_rule'
+  tag stig_id: 'RHEL-07-030560'
+  tag fix_id: 'F-4660r861013_fix'
+  tag cci: ['CCI-000172', 'CCI-002884']
   tag nist: ['AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204537.rb b/controls/SV-204537.rb
index 645a7a989..93e72b435 100644
--- a/controls/SV-204537.rb
+++ b/controls/SV-204537.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "setsebool" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/sbin/setsebool /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "setsebool" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72137', 'SV-86761']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000392-GPOS-00172'
-  tag 'satisfies': ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207',
-                    'SRG-OS-000465-GPOS-00209']
-  tag 'gid': 'V-204537'
-  tag 'rid': 'SV-204537r603261_rule'
-  tag 'stig_id': 'RHEL-07-030570'
-  tag 'fix_id': 'F-4661r462616_fix'
-  tag 'cci': ['CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "setsebool" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/sbin/setsebool" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setsebool" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72137', 'SV-86761']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000392-GPOS-00172'
+  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']
+  tag gid: 'V-204537'
+  tag rid: 'SV-204537r861017_rule'
+  tag stig_id: 'RHEL-07-030570'
+  tag fix_id: 'F-4661r861016_fix'
+  tag cci: ['CCI-000172', 'CCI-002884']
   tag nist: ['AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204538.rb b/controls/SV-204538.rb
index 71505d7d0..75de9a61b 100644
--- a/controls/SV-204538.rb
+++ b/controls/SV-204538.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "chcon" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/bin/chcon /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "chcon" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72139', 'SV-86763']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000392-GPOS-00172'
-  tag 'satisfies': ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207',
-                    'SRG-OS-000465-GPOS-00209']
-  tag 'gid': 'V-204538'
-  tag 'rid': 'SV-204538r603261_rule'
-  tag 'stig_id': 'RHEL-07-030580'
-  tag 'fix_id': 'F-4662r462619_fix'
-  tag 'cci': ['CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chcon" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/bin/chcon" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chcon" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72139', 'SV-86763']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000392-GPOS-00172'
+  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']
+  tag gid: 'V-204538'
+  tag rid: 'SV-204538r861020_rule'
+  tag stig_id: 'RHEL-07-030580'
+  tag fix_id: 'F-4662r861019_fix'
+  tag cci: ['CCI-000172', 'CCI-002884']
   tag nist: ['AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204539.rb b/controls/SV-204539.rb
index 663d2b1eb..4d628bce2 100644
--- a/controls/SV-204539.rb
+++ b/controls/SV-204539.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "setfiles" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -iw /usr/sbin/setfiles /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "setfiles" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72141', 'SV-86765']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000392-GPOS-00172'
-  tag 'satisfies': ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207',
-                    'SRG-OS-000465-GPOS-00209']
-  tag 'gid': 'V-204539'
-  tag 'rid': 'SV-204539r603261_rule'
-  tag 'stig_id': 'RHEL-07-030590'
-  tag 'fix_id': 'F-4663r462622_fix'
-  tag 'cci': ['CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "setfiles" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/sbin/setfiles" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setfiles" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72141', 'SV-86765']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000392-GPOS-00172'
+  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']
+  tag gid: 'V-204539'
+  tag rid: 'SV-204539r861023_rule'
+  tag stig_id: 'RHEL-07-030590'
+  tag fix_id: 'F-4663r861022_fix'
+  tag cci: ['CCI-000172', 'CCI-002884']
   tag nist: ['AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204540.rb b/controls/SV-204540.rb
index b345c596b..a9f682779 100644
--- a/controls/SV-204540.rb
+++ b/controls/SV-204540.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system generates audit records when unsuccessful account access events occur.
     Check the file system rule in "/etc/audit/audit.rules" with the following commands:
     # grep -i /var/run/faillock /etc/audit/audit.rules
@@ -17,17 +16,17 @@
     Add or update the following rule in "/etc/audit/rules.d/audit.rules":
     -w /var/run/faillock -p wa -k logins
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72145', 'SV-86769']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000392-GPOS-00172'
-  tag 'satisfies': ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000470-GPOS-00214',
-                    'SRG-OS-000473-GPOS-00218']
-  tag 'gid': 'V-204540'
-  tag 'rid': 'SV-204540r603261_rule'
-  tag 'stig_id': 'RHEL-07-030610'
-  tag 'fix_id': 'F-4664r88813_fix'
-  tag 'cci': ['CCI-000126', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-2 d', 'AU-12 c', 'MA-4 (1) (a)']
+  impact 0.5
+  tag legacy: ['V-72145', 'SV-86769']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000392-GPOS-00172'
+  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000470-GPOS-00214', 'SRG-OS-000473-GPOS-00218']
+  tag gid: 'V-204540'
+  tag rid: 'SV-204540r853930_rule'
+  tag stig_id: 'RHEL-07-030610'
+  tag fix_id: 'F-4664r88813_fix'
+  tag cci: ['CCI-000126', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-2 d', 'AU-12 c', 'MA-4 (1) (a)', 'AU-2 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
diff --git a/controls/SV-204541.rb b/controls/SV-204541.rb
index 4b2a436dd..6cd351314 100644
--- a/controls/SV-204541.rb
+++ b/controls/SV-204541.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system generates audit records when successful account access events occur.
     Check the file system rules in "/etc/audit/audit.rules" with the following commands:
     # grep -i /var/log/lastlog /etc/audit/audit.rules
@@ -16,17 +15,17 @@
     Add or update the following rule in "/etc/audit/rules.d/audit.rules":
     -w /var/log/lastlog -p wa -k logins
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72147', 'SV-86771']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000392-GPOS-00172'
-  tag 'satisfies': ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000470-GPOS-00214',
-                    'SRG-OS-000473-GPOS-00218']
-  tag 'gid': 'V-204541'
-  tag 'rid': 'SV-204541r603261_rule'
-  tag 'stig_id': 'RHEL-07-030620'
-  tag 'fix_id': 'F-4665r88816_fix'
-  tag 'cci': ['CCI-000126', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-2 d', 'AU-12 c', 'MA-4 (1) (a)']
+  impact 0.5
+  tag legacy: ['V-72147', 'SV-86771']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000392-GPOS-00172'
+  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000470-GPOS-00214', 'SRG-OS-000473-GPOS-00218']
+  tag gid: 'V-204541'
+  tag rid: 'SV-204541r853931_rule'
+  tag stig_id: 'RHEL-07-030620'
+  tag fix_id: 'F-4665r88816_fix'
+  tag cci: ['CCI-000126', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-2 d', 'AU-12 c', 'MA-4 (1) (a)', 'AU-2 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
diff --git a/controls/SV-204542.rb b/controls/SV-204542.rb
index a0f13be02..9a1e97d94 100644
--- a/controls/SV-204542.rb
+++ b/controls/SV-204542.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated.  Daemons are not user
     sessions and have the loginuid set to -1.  The auid representation is an unsigned 32-bit integer, which equals
     4294967295.  The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "passwd" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/bin/passwd /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -k privileged-passwd
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "passwd" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -k privileged-passwd
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86773', 'V-72149']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204542'
-  tag 'rid': 'SV-204542r603261_rule'
-  tag 'stig_id': 'RHEL-07-030630'
-  tag 'fix_id': 'F-4666r462625_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "passwd" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/bin/passwd" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "passwd" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86773', 'V-72149']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204542'
+  tag rid: 'SV-204542r861026_rule'
+  tag stig_id: 'RHEL-07-030630'
+  tag fix_id: 'F-4666r861025_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-passwd')
       end
     end
   end
diff --git a/controls/SV-204543.rb b/controls/SV-204543.rb
index cd3ca8403..c9e0c7772 100644
--- a/controls/SV-204543.rb
+++ b/controls/SV-204543.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "unix_chkpwd" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -iw /usr/sbin/unix_chkpwd /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -k privileged-passwd
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "unix_chkpwd" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -k privileged-passwd
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86775', 'V-72151']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204543'
-  tag 'rid': 'SV-204543r603261_rule'
-  tag 'stig_id': 'RHEL-07-030640'
-  tag 'fix_id': 'F-4667r462628_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/sbin/unix_chkpwd" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86775', 'V-72151']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204543'
+  tag rid: 'SV-204543r861029_rule'
+  tag stig_id: 'RHEL-07-030640'
+  tag fix_id: 'F-4667r861028_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-passwd')
       end
     end
   end
diff --git a/controls/SV-204544.rb b/controls/SV-204544.rb
index 610861698..e2f3036da 100644
--- a/controls/SV-204544.rb
+++ b/controls/SV-204544.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "gpasswd" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/bin/gpasswd /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -k privileged-passwd
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "gpasswd" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -k privileged-passwd
-    The audit daemon must be restarted for the changes to take effect. '
-  tag 'legacy': ['SV-86777', 'V-72153']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204544'
-  tag 'rid': 'SV-204544r603261_rule'
-  tag 'stig_id': 'RHEL-07-030650'
-  tag 'fix_id': 'F-4668r462631_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "gpasswd" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/bin/gpasswd" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "gpasswd" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86777', 'V-72153']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204544'
+  tag rid: 'SV-204544r861032_rule'
+  tag stig_id: 'RHEL-07-030650'
+  tag fix_id: 'F-4668r861031_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-passwd')
       end
     end
   end
diff --git a/controls/SV-204545.rb b/controls/SV-204545.rb
index b58638197..90dbd816b 100644
--- a/controls/SV-204545.rb
+++ b/controls/SV-204545.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "chage" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/bin/chage /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -k privileged-passwd
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "chage" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -k privileged-passwd
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86779', 'V-72155']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204545'
-  tag 'rid': 'SV-204545r603261_rule'
-  tag 'stig_id': 'RHEL-07-030660'
-  tag 'fix_id': 'F-4669r462634_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chage" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/bin/chage" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chage" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86779', 'V-72155']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204545'
+  tag rid: 'SV-204545r861035_rule'
+  tag stig_id: 'RHEL-07-030660'
+  tag fix_id: 'F-4669r861034_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-passwd')
       end
     end
   end
diff --git a/controls/SV-204546.rb b/controls/SV-204546.rb
index 94389c316..2e76bf889 100644
--- a/controls/SV-204546.rb
+++ b/controls/SV-204546.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "userhelper" command occur.
-    Check the file system rule in "/etc/audit/audit.rules" with the following command:
-    # grep -i /usr/sbin/userhelper /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=unset -k privileged-passwd
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "userhelper" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=unset -k privileged-passwd
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86781', 'V-72157']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204546'
-  tag 'rid': 'SV-204546r603261_rule'
-  tag 'stig_id': 'RHEL-07-030670'
-  tag 'fix_id': 'F-4670r462637_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "userhelper" command occur.
+
+Check the file system rule in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/sbin/userhelper" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "userhelper" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86781', 'V-72157']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204546'
+  tag rid: 'SV-204546r861038_rule'
+  tag stig_id: 'RHEL-07-030670'
+  tag fix_id: 'F-4670r861037_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-passwd')
       end
     end
   end
diff --git a/controls/SV-204547.rb b/controls/SV-204547.rb
index 57988d746..20852c117 100644
--- a/controls/SV-204547.rb
+++ b/controls/SV-204547.rb
@@ -8,30 +8,33 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "su" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -iw /usr/bin/su /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "su" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86783', 'V-72159']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000037-GPOS-00015'
-  tag 'satisfies': ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204547'
-  tag 'rid': 'SV-204547r603261_rule'
-  tag 'stig_id': 'RHEL-07-030680'
-  tag 'fix_id': 'F-4671r462640_fix'
-  tag 'cci': ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "su" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/bin/su" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "su" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86783', 'V-72159']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000037-GPOS-00015'
+  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204547'
+  tag rid: 'SV-204547r861041_rule'
+  tag stig_id: 'RHEL-07-030680'
+  tag fix_id: 'F-4671r861040_fix'
+  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
@@ -49,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204548.rb b/controls/SV-204548.rb
index 5dcff1cf3..f42016dae 100644
--- a/controls/SV-204548.rb
+++ b/controls/SV-204548.rb
@@ -8,30 +8,33 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "sudo" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -iw /usr/bin/sudo /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "sudo" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72161', 'SV-86785']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000037-GPOS-00015'
-  tag 'satisfies': ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204548'
-  tag 'rid': 'SV-204548r603261_rule'
-  tag 'stig_id': 'RHEL-07-030690'
-  tag 'fix_id': 'F-4672r462643_fix'
-  tag 'cci': ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "sudo" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/bin/sudo" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "sudo" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72161', 'SV-86785']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000037-GPOS-00015'
+  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204548'
+  tag rid: 'SV-204548r861044_rule'
+  tag stig_id: 'RHEL-07-030690'
+  tag fix_id: 'F-4672r861043_fix'
+  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
@@ -49,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204549.rb b/controls/SV-204549.rb
index b1da5aae7..cf12ecc00 100644
--- a/controls/SV-204549.rb
+++ b/controls/SV-204549.rb
@@ -6,7 +6,6 @@
     At a minimum, the organization must audit the full-text recording of privileged access commands. The organization
     must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of
     compromise.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to access
     the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory.
     Check for modification of the following files being audited by performing the following commands to check the file
@@ -22,17 +21,17 @@
     -w /etc/sudoers -p wa -k privileged-actions
     -w /etc/sudoers.d/ -p wa -k privileged-actions
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72163', 'SV-86787']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000037-GPOS-00015'
-  tag 'satisfies': ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204549'
-  tag 'rid': 'SV-204549r603261_rule'
-  tag 'stig_id': 'RHEL-07-030700'
-  tag 'fix_id': 'F-4673r88840_fix'
-  tag 'cci': ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
+  impact 0.5
+  tag legacy: ['V-72163', 'SV-86787']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000037-GPOS-00015'
+  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204549'
+  tag rid: 'SV-204549r853953_rule'
+  tag stig_id: 'RHEL-07-030700'
+  tag fix_id: 'F-4673r88840_fix'
+  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
diff --git a/controls/SV-204550.rb b/controls/SV-204550.rb
index 8c8c6a7a7..508abe1f2 100644
--- a/controls/SV-204550.rb
+++ b/controls/SV-204550.rb
@@ -8,30 +8,33 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "newgrp" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -i /usr/bin/newgrp /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "newgrp" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72165', 'SV-86789']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000037-GPOS-00015'
-  tag 'satisfies': ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204550'
-  tag 'rid': 'SV-204550r603261_rule'
-  tag 'stig_id': 'RHEL-07-030710'
-  tag 'fix_id': 'F-4674r462646_fix'
-  tag 'cci': ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "newgrp" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/bin/newgrp" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "newgrp" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72165', 'SV-86789']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000037-GPOS-00015'
+  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204550'
+  tag rid: 'SV-204550r861047_rule'
+  tag stig_id: 'RHEL-07-030710'
+  tag fix_id: 'F-4674r861046_fix'
+  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
@@ -49,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204551.rb b/controls/SV-204551.rb
index 04f351853..977cedf15 100644
--- a/controls/SV-204551.rb
+++ b/controls/SV-204551.rb
@@ -8,30 +8,33 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "chsh" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -i /usr/bin/chsh /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "chsh" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=unset -k privileged-priv_change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86791', 'V-72167']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000037-GPOS-00015'
-  tag 'satisfies': ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204551'
-  tag 'rid': 'SV-204551r603261_rule'
-  tag 'stig_id': 'RHEL-07-030720'
-  tag 'fix_id': 'F-4675r462649_fix'
-  tag 'cci': ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
-  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chsh" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/bin/chsh" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chsh" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86791', 'V-72167']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000037-GPOS-00015'
+  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204551'
+  tag rid: 'SV-204551r861050_rule'
+  tag stig_id: 'RHEL-07-030720'
+  tag fix_id: 'F-4675r861049_fix'
+  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']
+  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
 
@@ -49,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-priv_change')
       end
     end
   end
diff --git a/controls/SV-204552.rb b/controls/SV-204552.rb
index a5530e170..1a318e70a 100644
--- a/controls/SV-204552.rb
+++ b/controls/SV-204552.rb
@@ -8,34 +8,38 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "mount" command and syscall occur.
-    Check that the following system call is being audited by performing the following series of commands to check the
-    file system rules in "/etc/audit/audit.rules":
-    # grep -iw "mount" /etc/audit/audit.rules
-    -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
-    -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
-    -a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -k privileged-mount
-    If both the "b32" and "b64" audit rules are not defined for the "mount" syscall, this is a finding.
-    If all uses of the "mount" command are not being audited, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "mount" command and syscall occur.
-    Add or update the following rules in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
-    -a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
-    -a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -k privileged-mount
-    The audit daemon must be restarted for the changes to take effect.'
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur.
+
+Check that the following system call is being audited by performing the following series of commands to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "mount" /etc/audit/audit.rules
+
+-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
+-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount
+
+If both the "b32" and "b64" audit rules are not defined for the "mount" syscall, this is a finding.
+
+If all uses of the "mount" command are not being audited, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur.
+
+Add or update the following rules in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
+-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount
+
+The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72171', 'SV-86795']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
-  tag 'gid': 'V-204552'
-  tag 'rid': 'SV-204552r603261_rule'
-  tag 'stig_id': 'RHEL-07-030740'
-  tag 'fix_id': 'F-4676r462652_fix'
-  tag 'cci': ['CCI-000135', 'CCI-002884']
+  tag legacy: ['V-72171', 'SV-86795']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
+  tag gid: 'V-204552'
+  tag rid: 'SV-204552r861053_rule'
+  tag stig_id: 'RHEL-07-030740'
+  tag fix_id: 'F-4676r861052_fix'
+  tag cci: ['CCI-000135', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -61,7 +65,7 @@
           expect(audit_rule.arch.uniq).to cmp 'b32'
         end
         expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-mount'
+        expect(audit_rule.key.uniq).to include('privileged-mount')
       end
     end
     describe 'Command' do
@@ -70,8 +74,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-mount'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-mount')
       end
     end
   end
diff --git a/controls/SV-204553.rb b/controls/SV-204553.rb
index f8a06ba10..b05240400 100644
--- a/controls/SV-204553.rb
+++ b/controls/SV-204553.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "umount" command occur.
-    Check that the following system call is being audited by performing the following series of commands to check the
-    file system rules in "/etc/audit/audit.rules":
-    # grep -iw "/usr/bin/umount" /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -k privileged-mount
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "umount" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -k privileged-mount
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72173', 'SV-86797']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
-  tag 'gid': 'V-204553'
-  tag 'rid': 'SV-204553r603261_rule'
-  tag 'stig_id': 'RHEL-07-030750'
-  tag 'fix_id': 'F-4677r462655_fix'
-  tag 'cci': ['CCI-000135', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "umount" command occur.
+
+Check that the following system call is being audited by performing the following series of commands to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/bin/umount" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "umount" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72173', 'SV-86797']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
+  tag gid: 'V-204553'
+  tag rid: 'SV-204553r861056_rule'
+  tag stig_id: 'RHEL-07-030750'
+  tag fix_id: 'F-4677r861055_fix'
+  tag cci: ['CCI-000135', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-mount'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-mount')
       end
     end
   end
diff --git a/controls/SV-204554.rb b/controls/SV-204554.rb
index 53bd782f9..95df529ef 100644
--- a/controls/SV-204554.rb
+++ b/controls/SV-204554.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "postdrop" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -iw /usr/sbin/postdrop /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -k privileged-postfix
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "postdrop" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=unset -k privileged-postfix
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72175', 'SV-86799']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
-  tag 'gid': 'V-204554'
-  tag 'rid': 'SV-204554r603261_rule'
-  tag 'stig_id': 'RHEL-07-030760'
-  tag 'fix_id': 'F-4678r462658_fix'
-  tag 'cci': ['CCI-000135', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "postdrop" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/sbin/postdrop" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "postdrop" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72175', 'SV-86799']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
+  tag gid: 'V-204554'
+  tag rid: 'SV-204554r861059_rule'
+  tag stig_id: 'RHEL-07-030760'
+  tag fix_id: 'F-4678r861058_fix'
+  tag cci: ['CCI-000135', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-postfix'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-postfix')
       end
     end
   end
diff --git a/controls/SV-204555.rb b/controls/SV-204555.rb
index 09f6c4ff5..c1ad3be1e 100644
--- a/controls/SV-204555.rb
+++ b/controls/SV-204555.rb
@@ -8,28 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "postqueue" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -iw /usr/sbin/postqueue /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -k privileged-postfix
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "postqueue" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=unset -k privileged-postfix
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86801', 'V-72177']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
-  tag 'gid': 'V-204555'
-  tag 'rid': 'SV-204555r603261_rule'
-  tag 'stig_id': 'RHEL-07-030770'
-  tag 'fix_id': 'F-4679r462661_fix'
-  tag 'cci': ['CCI-000135', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "postqueue" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/sbin/postqueue" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "postqueue" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86801', 'V-72177']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']
+  tag gid: 'V-204555'
+  tag rid: 'SV-204555r861062_rule'
+  tag stig_id: 'RHEL-07-030770'
+  tag fix_id: 'F-4679r861061_fix'
+  tag cci: ['CCI-000135', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +52,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-postfix'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-postfix')
       end
     end
   end
diff --git a/controls/SV-204556.rb b/controls/SV-204556.rb
index 93291cced..9d141b7f5 100644
--- a/controls/SV-204556.rb
+++ b/controls/SV-204556.rb
@@ -7,29 +7,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "ssh-keysign" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -iw /usr/libexec/openssh/ssh-keysign /etc/audit/audit.rules
-    -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -k privileged-ssh
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "ssh-keysign" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -k privileged-ssh
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86803', 'V-72179']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204556'
-  tag 'rid': 'SV-204556r603261_rule'
-  tag 'stig_id': 'RHEL-07-030780'
-  tag 'fix_id': 'F-4680r462664_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "ssh-keysign" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/libexec/openssh/ssh-keysign" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "ssh-keysign" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86803', 'V-72179']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204556'
+  tag rid: 'SV-204556r861065_rule'
+  tag stig_id: 'RHEL-07-030780'
+  tag fix_id: 'F-4680r861064_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +51,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-ssh'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-ssh')
       end
     end
   end
diff --git a/controls/SV-204557.rb b/controls/SV-204557.rb
index 40f4147d3..c2ae21977 100644
--- a/controls/SV-204557.rb
+++ b/controls/SV-204557.rb
@@ -7,29 +7,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "crontab" command occur.
-    Check that the following system call is being audited by performing the following command to check the file system
-    rules in "/etc/audit/audit.rules":
-    # grep -iw /usr/bin/crontab /etc/audit/audit.rules
-    -a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -k privileged-cron
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "crontab" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=unset -k privileged-cron
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86807', 'V-72183']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000042-GPOS-00020'
-  tag 'satisfies': ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172',
-                    'SRG-OS-000471-GPOS-00215']
-  tag 'gid': 'V-204557'
-  tag 'rid': 'SV-204557r603261_rule'
-  tag 'stig_id': 'RHEL-07-030800'
-  tag 'fix_id': 'F-4681r462667_fix'
-  tag 'cci': ['CCI-000135', 'CCI-000172', 'CCI-002884']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "crontab" command occur.
+
+Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules":
+
+$ sudo grep -w "/usr/bin/crontab" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-cron
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "crontab" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-cron
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86807', 'V-72183']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000042-GPOS-00020'
+  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']
+  tag gid: 'V-204557'
+  tag rid: 'SV-204557r861068_rule'
+  tag stig_id: 'RHEL-07-030800'
+  tag fix_id: 'F-4681r861067_fix'
+  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']
   tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -48,8 +51,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-cron'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-cron')
       end
     end
   end
diff --git a/controls/SV-204558.rb b/controls/SV-204558.rb
index 7ae798176..cef9f811c 100644
--- a/controls/SV-204558.rb
+++ b/controls/SV-204558.rb
@@ -6,26 +6,31 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "pam_timestamp_check" command occur.
-    Check the auditing rules in "/etc/audit/audit.rules" with the following command:
-    # grep -iw "/usr/sbin/pam_timestamp_check" /etc/audit/audit.rules
-    -a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=unset -k privileged-pam
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "pam_timestamp_check" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=unset -k privileged-pam
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['V-72185', 'SV-86809']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000471-GPOS-00215'
-  tag 'gid': 'V-204558'
-  tag 'rid': 'SV-204558r603261_rule'
-  tag 'stig_id': 'RHEL-07-030810'
-  tag 'fix_id': 'F-4682r462670_fix'
-  tag 'cci': ['CCI-000172']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur.
+
+Check the auditing rules in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "/usr/sbin/pam_timestamp_check" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['V-72185', 'SV-86809']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000471-GPOS-00215'
+  tag gid: 'V-204558'
+  tag rid: 'SV-204558r833166_rule'
+  tag stig_id: 'RHEL-07-030810'
+  tag fix_id: 'F-4682r833165_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -44,8 +49,8 @@
         expect(audit_rule).to exist
         expect(audit_rule.action.uniq).to cmp 'always'
         expect(audit_rule.list.uniq).to cmp 'exit'
-        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-        expect(audit_rule.key.uniq).to cmp 'privileged-pam'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key.uniq).to include('privileged-pam')
       end
     end
   end
diff --git a/controls/SV-204559.rb b/controls/SV-204559.rb
index 6242759a4..387c4a031 100644
--- a/controls/SV-204559.rb
+++ b/controls/SV-204559.rb
@@ -5,30 +5,36 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "create_module" syscall occur.
-    Check the auditing rules in "/etc/audit/audit.rules" with the following command:
-    # grep -iw create_module /etc/audit/audit.rules
-    -a always,exit -F arch=b32 -S create_module -k module-change
-    -a always,exit -F arch=b64 -S create_module -k module-change
-    If both the "b32" and "b64" audit rules are not defined for the "create_module" syscall, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "create_module" syscall occur.
-    Add or update the following rules in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F arch=b32 -S create_module -k module-change
-    -a always,exit -F arch=b64 -S create_module -k module-change
-    The audit daemon must be restarted for the changes to take effect.'
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "create_module" syscall occur.
+
+Check the auditing rules in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "create_module" /etc/audit/audit.rules
+
+-a always,exit -F arch=b32 -S create_module -F auid>=1000 -F auid!=unset -k module-change
+
+-a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change
+
+If both the "b32" and "b64" audit rules are not defined for the "create_module" syscall, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "create_module" syscall occur.
+
+Add or update the following rules in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F arch=b32 -S create_module -F auid>=1000 -F auid!=unset -k module-change
+
+-a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change
+
+The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-78999', 'SV-93705']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000471-GPOS-00216'
-  tag 'satisfies': ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
-  tag 'gid': 'V-204559'
-  tag 'rid': 'SV-204559r603261_rule'
-  tag 'stig_id': 'RHEL-07-030819'
-  tag 'fix_id': 'F-4683r88870_fix'
-  tag 'cci': ['CCI-000172']
+  tag legacy: ['V-78999', 'SV-93705']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000471-GPOS-00216'
+  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
+  tag gid: 'V-204559'
+  tag rid: 'SV-204559r833169_rule'
+  tag stig_id: 'RHEL-07-030819'
+  tag fix_id: 'F-4683r833168_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -53,7 +59,8 @@
           else
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
-          expect(audit_rule.key.uniq).to cmp 'module-change'
+          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
+          expect(audit_rule.key.uniq).to include('module-change')
         end
       end
     end
diff --git a/controls/SV-204560.rb b/controls/SV-204560.rb
index 0ddd2175b..22042ea2b 100644
--- a/controls/SV-204560.rb
+++ b/controls/SV-204560.rb
@@ -10,31 +10,36 @@
     system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect
     performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining
     syscalls into one rule whenever possible.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the
-    "init_module" and "finit_module" syscalls.
-    Check the auditing rules in "/etc/audit/audit.rules" with the following command:
-    # grep init_module /etc/audit/audit.rules
-    -a always,exit -F arch=b32 -S init_module,finit_module -k modulechange
-    -a always,exit -F arch=b64 -S init_module,finit_module -k modulechange
-    If both the "b32" and "b64" audit rules are not defined for the "init_module" and "finit_module" syscalls, this is a
-    finding.'
-  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use
-    the "init_module" and "finit_module" syscalls.
-    Add or update the following rules in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F arch=b32 -S init_module,finit_module -k modulechange
-    -a always,exit -F arch=b64 -S init_module,finit_module -k modulechange
-    The audit daemon must be restarted for the changes to take effect.'
+  desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the "init_module" and "finit_module" syscalls.
+
+Check the auditing rules in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep init_module /etc/audit/audit.rules
+
+-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange
+
+-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange
+
+If both the "b32" and "b64" audit rules are not defined for the "init_module" and "finit_module" syscalls, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use the "init_module" and "finit_module" syscalls.
+
+Add or update the following rules in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange
+
+-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange
+
+The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72187', 'SV-86811']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000471-GPOS-00216'
-  tag 'satisfies': ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
-  tag 'gid': 'V-204560'
-  tag 'rid': 'SV-204560r809822_rule'
-  tag 'stig_id': 'RHEL-07-030820'
-  tag 'fix_id': 'F-4684r809821_fix'
-  tag 'cci': ['CCI-000172']
+  tag legacy: ['V-72187', 'SV-86811']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000471-GPOS-00216'
+  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
+  tag gid: 'V-204560'
+  tag rid: 'SV-204560r833172_rule'
+  tag stig_id: 'RHEL-07-030820'
+  tag fix_id: 'F-4684r833171_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -59,7 +64,8 @@
           else
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
-          expect(audit_rule.key.uniq).to cmp 'modulechange'
+          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
+          expect(audit_rule.key.uniq).to include('modulechange')
         end
       end
     end
diff --git a/controls/SV-204562.rb b/controls/SV-204562.rb
index c6cd1e747..9b4a77e99 100644
--- a/controls/SV-204562.rb
+++ b/controls/SV-204562.rb
@@ -5,30 +5,36 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "delete_module" syscall occur.
-    Check the auditing rules in "/etc/audit/audit.rules" with the following command:
-    # grep -iw delete_module /etc/audit/audit.rules
-    -a always,exit -F arch=b32 -S delete_module -k module-change
-    -a always,exit -F arch=b64 -S delete_module -k module-change
-    If both the "b32" and "b64" audit rules are not defined for the "delete_module" syscall, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "delete_module" syscall occur.
-    Add or update the following rules in "/etc/audit/rules.d/audit.rules":
-    -a always,exit -F arch=b32 -S delete_module -k module-change
-    -a always,exit -F arch=b64 -S delete_module -k module-change
-    The audit daemon must be restarted for the changes to take effect.'
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "delete_module" syscall occur.
+
+Check the auditing rules in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep -w "delete_module" /etc/audit/audit.rules
+
+-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module-change
+
+-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module-change
+
+If both the "b32" and "b64" audit rules are not defined for the "delete_module" syscall, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "delete_module" syscall occur.
+
+Add or update the following rules in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module-change
+
+-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module-change
+
+The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72189', 'SV-86813']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000471-GPOS-00216'
-  tag 'satisfies': ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
-  tag 'gid': 'V-204562'
-  tag 'rid': 'SV-204562r603261_rule'
-  tag 'stig_id': 'RHEL-07-030830'
-  tag 'fix_id': 'F-4686r88879_fix'
-  tag 'cci': ['CCI-000172']
+  tag legacy: ['V-72189', 'SV-86813']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000471-GPOS-00216'
+  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
+  tag gid: 'V-204562'
+  tag rid: 'SV-204562r833175_rule'
+  tag stig_id: 'RHEL-07-030830'
+  tag fix_id: 'F-4686r833174_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -53,7 +59,8 @@
           else
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
-          expect(audit_rule.key.uniq).to cmp 'module-change'
+          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
+          expect(audit_rule.key.uniq).to include('module-change')
         end
       end
     end
diff --git a/controls/SV-204563.rb b/controls/SV-204563.rb
index ddf88aa12..7081064b2 100644
--- a/controls/SV-204563.rb
+++ b/controls/SV-204563.rb
@@ -8,27 +8,32 @@
     When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user
     sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals
     4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the
-    "kmod" command occur.
-    Check the auditing rules in "/etc/audit/audit.rules" with the following command:
-    # grep -iw kmod /etc/audit/audit.rules
-    -w /usr/bin/kmod -p x -F auid!=unset -k module-change
-    If the command does not return any output, this is a finding.'
-  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use
-    the "kmod" command occur.
-    Add or update the following rule in "/etc/audit/rules.d/audit.rules":
-    -w /usr/bin/kmod -p x -F auid!=unset -k module-change
-    The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86815', 'V-72191']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000471-GPOS-00216'
-  tag 'satisfies': ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
-  tag 'gid': 'V-204563'
-  tag 'rid': 'SV-204563r603261_rule'
-  tag 'stig_id': 'RHEL-07-030840'
-  tag 'fix_id': 'F-4687r462673_fix'
-  tag 'cci': ['CCI-000172']
+  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the "kmod" command occur.
+
+Check the auditing rules in "/etc/audit/audit.rules" with the following command:
+
+$ sudo grep "/usr/bin/kmod" /etc/audit/audit.rules
+
+-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules
+
+If the command does not return any output, this is a finding.'
+  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "kmod" command occur.
+
+Add or update the following rule in "/etc/audit/rules.d/audit.rules":
+
+-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules
+
+The audit daemon must be restarted for the changes to take effect.'
+  impact 0.5
+  tag legacy: ['SV-86815', 'V-72191']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000471-GPOS-00216'
+  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']
+  tag gid: 'V-204563'
+  tag rid: 'SV-204563r858498_rule'
+  tag stig_id: 'RHEL-07-030840'
+  tag fix_id: 'F-4687r858497_fix'
+  tag cci: ['CCI-000172']
   tag nist: ['AU-12 c']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -45,9 +50,10 @@
       it "#{audit_command} is audited properly" do
         audit_rule = auditd.file(audit_command)
         expect(audit_rule).to exist
-        expect(audit_rule.key).to cmp 'module-change'
-        expect(audit_rule.permissions.flatten).to cmp 'x'
-        expect(audit_rule.fields.flatten).to include 'auid!=-1'
+        expect(audit_rule.action.uniq).to cmp 'always'
+        expect(audit_rule.list.uniq).to cmp 'exit'
+        expect(audit_rule.fields.flatten).to include('perm=x', 'auid>=1000', 'auid!=-1')
+        expect(audit_rule.key).to cmp 'modules'
       end
     end
   end
diff --git a/controls/SV-204564.rb b/controls/SV-204564.rb
index bd640507a..697c634b0 100644
--- a/controls/SV-204564.rb
+++ b/controls/SV-204564.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,
     disabling, and termination events that affect "/etc/passwd".
     Check the auditing rules in "/etc/audit/audit.rules" with the following command:
@@ -18,16 +17,16 @@
     Add or update the following rule "/etc/audit/rules.d/audit.rules":
     -w /etc/passwd -p wa -k identity
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-86821', 'V-72197']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000004-GPOS-00004'
-  tag 'satisfies': ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089', 'SRG-OS-000240-GPOS-00090',
-                    'SRG-OS-000241-GPOS-00091', 'SRG-OS-000303-GPOS-00120', 'SRG-OS-000476-GPOS-00221']
-  tag 'gid': 'V-204564'
-  tag 'rid': 'SV-204564r603261_rule'
-  tag 'stig_id': 'RHEL-07-030870'
-  tag 'fix_id': 'F-4688r88885_fix'
-  tag 'cci': ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
+  impact 0.5
+  tag legacy: ['SV-86821', 'V-72197']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000004-GPOS-00004'
+  tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089', 'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091', 'SRG-OS-000303-GPOS-00120', 'SRG-OS-000476-GPOS-00221']
+  tag gid: 'V-204564'
+  tag rid: 'SV-204564r853978_rule'
+  tag stig_id: 'RHEL-07-030870'
+  tag fix_id: 'F-4688r88885_fix'
+  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
   tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
diff --git a/controls/SV-204565.rb b/controls/SV-204565.rb
index d26ffe607..a018315ca 100644
--- a/controls/SV-204565.rb
+++ b/controls/SV-204565.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,
     disabling, and termination events that affect "/etc/group".
     Check the auditing rules in "/etc/audit/audit.rules" with the following command:
@@ -18,14 +17,15 @@
     Add or update the following rule in "/etc/audit/rules.d/audit.rules":
     -w /etc/group -p wa -k identity
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-87817', 'V-73165']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000004-GPOS-00004'
-  tag 'gid': 'V-204565'
-  tag 'rid': 'SV-204565r603261_rule'
-  tag 'stig_id': 'RHEL-07-030871'
-  tag 'fix_id': 'F-4689r88888_fix'
-  tag 'cci': ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
+  impact 0.5
+  tag legacy: ['SV-87817', 'V-73165']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000004-GPOS-00004'
+  tag gid: 'V-204565'
+  tag rid: 'SV-204565r853979_rule'
+  tag stig_id: 'RHEL-07-030871'
+  tag fix_id: 'F-4689r88888_fix'
+  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
   tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
diff --git a/controls/SV-204566.rb b/controls/SV-204566.rb
index 9fb92d74e..9dc9979c6 100644
--- a/controls/SV-204566.rb
+++ b/controls/SV-204566.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,
     disabling, and termination events that affect "/etc/gshadow".
     Check the auditing rules in "/etc/audit/audit.rules" with the following command:
@@ -18,14 +17,15 @@
     Add or update the following rule in "/etc/audit/rules.d/audit.rules":
     -w /etc/gshadow -p wa -k identity
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-87819', 'V-73167']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000004-GPOS-00004'
-  tag 'gid': 'V-204566'
-  tag 'rid': 'SV-204566r603261_rule'
-  tag 'stig_id': 'RHEL-07-030872'
-  tag 'fix_id': 'F-4690r88891_fix'
-  tag 'cci': ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
+  impact 0.5
+  tag legacy: ['SV-87819', 'V-73167']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000004-GPOS-00004'
+  tag gid: 'V-204566'
+  tag rid: 'SV-204566r853980_rule'
+  tag stig_id: 'RHEL-07-030872'
+  tag fix_id: 'F-4690r88891_fix'
+  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
   tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
diff --git a/controls/SV-204567.rb b/controls/SV-204567.rb
index b768dad00..0837b80f1 100644
--- a/controls/SV-204567.rb
+++ b/controls/SV-204567.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,
     disabling, and termination events that affect /etc/shadow.
     Check the auditing rules in "/etc/audit/audit.rules" with the following command:
@@ -18,14 +17,15 @@
     Add or update the following file system rule in "/etc/audit/rules.d/audit.rules":
     -w /etc/shadow -p wa -k identity
     The audit daemon must be restarted for the changes to take effect.'
-  tag 'legacy': ['SV-87823', 'V-73171']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000004-GPOS-00004'
-  tag 'gid': 'V-204567'
-  tag 'rid': 'SV-204567r603261_rule'
-  tag 'stig_id': 'RHEL-07-030873'
-  tag 'fix_id': 'F-4691r88894_fix'
-  tag 'cci': ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
+  impact 0.5
+  tag legacy: ['SV-87823', 'V-73171']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000004-GPOS-00004'
+  tag gid: 'V-204567'
+  tag rid: 'SV-204567r853981_rule'
+  tag stig_id: 'RHEL-07-030873'
+  tag fix_id: 'F-4691r88894_fix'
+  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
   tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
diff --git a/controls/SV-204568.rb b/controls/SV-204568.rb
index d9b77bf0a..190790fba 100644
--- a/controls/SV-204568.rb
+++ b/controls/SV-204568.rb
@@ -6,7 +6,6 @@
     responsible for one.
     Audit records can be generated from various components within the information system (e.g., module or policy
     filter).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,
     disabling, and termination events that affect /etc/security/opasswd.
     Check the auditing rules in "/etc/audit/audit.rules" with the following command:
@@ -19,14 +18,15 @@
     -w /etc/security/opasswd -p wa -k identity
     The audit daemon must be restarted for the changes to take effect:
     # systemctl restart auditd'
-  tag 'legacy': ['SV-87825', 'V-73173']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000004-GPOS-00004'
-  tag 'gid': 'V-204568'
-  tag 'rid': 'SV-204568r744115_rule'
-  tag 'stig_id': 'RHEL-07-030874'
-  tag 'fix_id': 'F-4692r744114_fix'
-  tag 'cci': ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
+  impact 0.5
+  tag legacy: ['SV-87825', 'V-73173']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000004-GPOS-00004'
+  tag gid: 'V-204568'
+  tag rid: 'SV-204568r853982_rule'
+  tag stig_id: 'RHEL-07-030874'
+  tag fix_id: 'F-4692r744114_fix'
+  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']
   tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
diff --git a/controls/SV-204572.rb b/controls/SV-204572.rb
index fee574dd5..496dceefe 100644
--- a/controls/SV-204572.rb
+++ b/controls/SV-204572.rb
@@ -10,7 +10,6 @@
     system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect
     performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining
     syscalls into one rule whenever possible.'
-  desc 'rationale', ''
   desc 'check', %q(Verify the operating system generates audit records upon successful/unsuccessful attempts to use the
     "unlink", "unlinkat", "rename", "renameat", and "rmdir" syscalls.
     Check the file system rules in "/etc/audit/audit.rules" with the following commands:
@@ -26,16 +25,15 @@
     -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete
     The audit daemon must be restarted for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72205', 'SV-86829']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000466-GPOS-00210'
-  tag 'satisfies': ['SRG-OS-000466-GPOS-00210', 'SRG-OS-000467-GPOS-00211', 'SRG-OS-000468-GPOS-00212',
-                    'SRG-OS-000392-GPOS-00172']
-  tag 'gid': 'V-204572'
-  tag 'rid': 'SV-204572r809825_rule'
-  tag 'stig_id': 'RHEL-07-030910'
-  tag 'fix_id': 'F-4696r809824_fix'
-  tag 'cci': ['CCI-000172', 'CCI-002884']
+  tag legacy: ['V-72205', 'SV-86829']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000466-GPOS-00210'
+  tag satisfies: ['SRG-OS-000466-GPOS-00210', 'SRG-OS-000467-GPOS-00211', 'SRG-OS-000468-GPOS-00212', 'SRG-OS-000392-GPOS-00172']
+  tag gid: 'V-204572'
+  tag rid: 'SV-204572r853985_rule'
+  tag stig_id: 'RHEL-07-030910'
+  tag fix_id: 'F-4696r853984_fix'
+  tag cci: ['CCI-000172', 'CCI-002884']
   tag nist: ['AU-12 c', 'MA-4 (1) (a)']
   tag subsystems: ['audit', 'auditd', 'audit_rule']
   tag 'host'
@@ -61,7 +59,7 @@
             expect(audit_rule.arch.uniq).to cmp 'b32'
           end
           expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')
-          expect(audit_rule.key.uniq).to cmp 'delete'
+          expect(audit_rule.key.uniq).to include('delete')
         end
       end
     end
diff --git a/controls/SV-204574.rb b/controls/SV-204574.rb
index d3d50e07e..6ff42b0d5 100644
--- a/controls/SV-204574.rb
+++ b/controls/SV-204574.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.'
   desc 'Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event
     that the system is compromised or has a hardware failure.'
-  desc 'rationale', ''
   desc 'check', 'Verify "rsyslog" is configured to send all messages to a log aggregation server.
     Check the configuration of "rsyslog" with the following command:
     Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf".
@@ -17,14 +16,14 @@
     send all "rsyslog" output to a log aggregation system:
     *.* @@<log aggregation system name>'
   impact 0.5
-  tag 'legacy': ['SV-86833', 'V-72209']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204574'
-  tag 'rid': 'SV-204574r603261_rule'
-  tag 'stig_id': 'RHEL-07-031000'
-  tag 'fix_id': 'F-4698r88915_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86833', 'V-72209']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204574'
+  tag rid: 'SV-204574r603261_rule'
+  tag stig_id: 'RHEL-07-031000'
+  tag fix_id: 'F-4698r88915_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['rsyslog']
   tag 'host'
diff --git a/controls/SV-204575.rb b/controls/SV-204575.rb
index 186fe2dad..3214de2f4 100644
--- a/controls/SV-204575.rb
+++ b/controls/SV-204575.rb
@@ -6,7 +6,6 @@
     introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of
     Service.
     If the system is intended to be a log aggregation server its use must be documented with the ISSO."
-  tag  'rationale': ''
   desc 'check', 'Verify that the system is not accepting "rsyslog" messages from other systems unless it is
     documented as a log aggregation server.
     Check the configuration of "rsyslog" with the following command:
@@ -22,16 +21,15 @@
   desc 'fix', 'Modify the "/etc/rsyslog.conf" file to remove the "ModLoad imtcp", "ModLoad imudp", and "ModLoad
     imrelp" configuration lines, or document the system as being used for log aggregation.'
   impact 0.5
-  tag 'legacy': ['SV-86835', 'V-72211']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204575'
-  tag 'rid': 'SV-204575r603261_rule'
-  tag 'stig_id': 'RHEL-07-031010'
-  tag 'fix_id': 'F-4699r88918_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['SV-86835', 'V-72211']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204575'
+  tag rid: 'SV-204575r853986_rule'
+  tag stig_id: 'RHEL-07-031010'
+  tag fix_id: 'F-4699r88918_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['rsyslog']
   tag 'host'
 
diff --git a/controls/SV-204576.rb b/controls/SV-204576.rb
index f776ca856..198b29e7d 100644
--- a/controls/SV-204576.rb
+++ b/controls/SV-204576.rb
@@ -7,7 +7,6 @@
     This requirement addresses concurrent sessions for information system accounts and does not address concurrent
     sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined
     based on mission needs and the operational environment for each system.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system limits the number of concurrent sessions to "10" for all accounts and/or
     account types by issuing the following command:
     # grep "maxlogins" /etc/security/limits.conf /etc/security/limits.d/*.conf
@@ -21,19 +20,20 @@
     /etc/security/limits.d/ :
     * hard maxlogins 10'
   impact 0.3
-  tag 'legacy': ['V-72217', 'SV-86841']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000027-GPOS-00008'
-  tag 'gid': 'V-204576'
-  tag 'rid': 'SV-204576r603261_rule'
-  tag 'stig_id': 'RHEL-07-040000'
-  tag 'fix_id': 'F-4700r88921_fix'
-  tag 'cci': ['CCI-000054']
+  tag legacy: ['V-72217', 'SV-86841']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000027-GPOS-00008'
+  tag gid: 'V-204576'
+  tag rid: 'SV-204576r877399_rule'
+  tag stig_id: 'RHEL-07-040000'
+  tag fix_id: 'F-4700r88921_fix'
+  tag cci: ['CCI-000054']
   tag nist: ['AC-10']
   tag subsystems: ['session']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
-  maxlogins_limit = input('expected_maxlogins_limit')
+  maxlogins_limit = input('maxlogins_limit')
 
   # Collect any files under limits.d if they exist
   limits_files = directory('/etc/security/limits.d').exist? ? command('ls /etc/security/limits.d/*.conf').stdout.strip.lines : []
@@ -52,7 +52,7 @@
       # For each result check if it is a 'hard' limit for 'maxlogins'
       if temp_limit.include?('hard') && temp_limit.include?('maxlogins')
         # If the limit is correct, push to compliant files
-        if temp_limit[-1].to_i == input('expected_maxlogins_limit')
+        if temp_limit[-1].to_i <= maxlogins_limit
           compliant_files.push(limits_file)
         # Otherwise add to noncompliant files
         else
@@ -63,20 +63,14 @@
   end
 
   # It is required that at least 1 file contain compliant configuration
-  describe "Files configuring maxlogins less than or equal to #{input('expected_maxlogins_limit')}" do
+  describe "Files configuring maxlogins less than or equal to #{maxlogins_limit}" do
     subject { compliant_files.length }
     it { should be_positive }
   end
 
   # No files should set 'hard' 'maxlogins' to any noncompliant value
-  describe "Files configuring maxlogins greater than #{input('expected_maxlogins_limit')}" do
+  describe "Files configuring maxlogins greater than #{maxlogins_limit}" do
     subject { noncompliant_files }
     it { should cmp [] }
   end
-
-  # No files should set 'hard' 'maxlogins' to any noncompliant value
-  describe 'The expected maxlogins value should be within policy limit' do
-    subject { input('expected_maxlogins_limit') }
-    it { should cmp <= input('max_maxlogins_limit') }
-  end
 end
diff --git a/controls/SV-204577.rb b/controls/SV-204577.rb
index fb48f7212..d5500a742 100644
--- a/controls/SV-204577.rb
+++ b/controls/SV-204577.rb
@@ -13,7 +13,6 @@
     organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or
     services to only those required, authorized, and approved to conduct official business or to address authorized
     quality of life issues.'
-  desc 'rationale', ''
   desc 'check', 'Inspect the firewall configuration and running services to verify that it is configured to prohibit
     or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.
     Check which services are currently active with the following command:
@@ -34,18 +33,19 @@
   desc 'fix', "Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site
     or program and the PPSM CAL."
   impact 0.5
-  tag 'legacy': ['V-72219', 'SV-86843']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000096-GPOS-00050'
-  tag 'satisfies': ['SRG-OS-000096-GPOS-00050', 'SRG-OS-000297-GPOS-00115']
-  tag 'gid': 'V-204577'
-  tag 'rid': 'SV-204577r603261_rule'
-  tag 'stig_id': 'RHEL-07-040100'
-  tag 'fix_id': 'F-4701r88924_fix'
-  tag 'cci': ['CCI-000382', 'CCI-002314']
+  tag legacy: ['V-72219', 'SV-86843']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000096-GPOS-00050'
+  tag satisfies: ['SRG-OS-000096-GPOS-00050', 'SRG-OS-000297-GPOS-00115']
+  tag gid: 'V-204577'
+  tag rid: 'SV-204577r861069_rule'
+  tag stig_id: 'RHEL-07-040100'
+  tag fix_id: 'F-4701r88924_fix'
+  tag cci: ['CCI-000382', 'CCI-002314']
   tag nist: ['CM-7 b', 'AC-17 (1)']
   tag subsystems: ['firewall', 'manual']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if input('firewall_application_package') != ''
     describe 'Manual review of third-party firewall needed' do
diff --git a/controls/SV-204578.rb b/controls/SV-204578.rb
index 5a7f50924..728a6241c 100644
--- a/controls/SV-204578.rb
+++ b/controls/SV-204578.rb
@@ -11,7 +11,6 @@
     The system will attempt to use the first cipher presented by the client that matches the server list. Listing the
     values "strongest to weakest" is a method to ensure the use of the strongest cipher available to secure the SSH
     connection.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system uses mechanisms meeting the requirements of applicable federal laws,
     Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic
     module.
@@ -28,16 +27,15 @@
     Ciphers aes256-ctr,aes192-ctr,aes128-ctr
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72221', 'SV-86845']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000033-GPOS-00014'
-  tag 'satisfies': ['SRG-OS-000033-GPOS-00014', 'SRG-OS-000120-GPOS-00061', 'SRG-OS-000125-GPOS-00065',
-                    'SRG-OS-000250-GPOS-00093', 'SRG-OS-000393-GPOS-00173']
-  tag 'gid': 'V-204578'
-  tag 'rid': 'SV-204578r744116_rule'
-  tag 'stig_id': 'RHEL-07-040110'
-  tag 'fix_id': 'F-4702r622306_fix'
-  tag 'cci': ['CCI-000068', 'CCI-000366', 'CCI-000803']
+  tag legacy: ['V-72221', 'SV-86845']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000033-GPOS-00014'
+  tag satisfies: ['SRG-OS-000033-GPOS-00014', 'SRG-OS-000120-GPOS-00061', 'SRG-OS-000125-GPOS-00065', 'SRG-OS-000250-GPOS-00093', 'SRG-OS-000393-GPOS-00173']
+  tag gid: 'V-204578'
+  tag rid: 'SV-204578r877398_rule'
+  tag stig_id: 'RHEL-07-040110'
+  tag fix_id: 'F-4702r622306_fix'
+  tag cci: ['CCI-000068', 'CCI-000366', 'CCI-000803']
   tag nist: ['AC-17 (2)', 'CM-6 b', 'IA-7']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204579.rb b/controls/SV-204579.rb
index 426a97f42..9a12b66d7 100644
--- a/controls/SV-204579.rb
+++ b/controls/SV-204579.rb
@@ -11,37 +11,39 @@
     application level if multiple application sessions are using a single operating system-level network connection.
     This does not mean that the operating system terminates all sessions or network access; it only ends the inactive
     session and releases the resources associated with that session.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system terminates all network connections associated with a communications
-    session at the end of the session or based on inactivity.
-    Check the value of the system inactivity timeout with the following command:
-    # grep -i tmout /etc/profile.d/*
-    etc/profile.d/tmout.sh:declare -xr TMOUT=900
-    If "TMOUT" is not set to "900" or less in a script located in the /etc/profile.d/ directory to enforce session
-    termination after inactivity, this is a finding.'
+  desc 'check', 'Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.
+
+Check the value of the system inactivity timeout with the following command:
+
+$ sudo grep -irw tmout /etc/profile /etc/bashrc /etc/profile.d
+
+etc/profile.d/tmout.sh:declare -xr TMOUT=900
+
+If conflicting results are returned, this is a finding.
+If "TMOUT" is not set to "900" or less to enforce session termination after inactivity, this is a finding.'
   desc 'fix', 'Configure the operating system to terminate all network connections associated with a communications
     session at the end of the session or after a period of inactivity.
     Create a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:
     #!/bin/bash
     declare -xr TMOUT=900'
   impact 0.5
-  tag 'legacy': ['SV-86847', 'V-72223']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000163-GPOS-00072'
-  tag 'gid': 'V-204579'
-  tag 'rid': 'SV-204579r646844_rule'
-  tag 'stig_id': 'RHEL-07-040160'
-  tag 'fix_id': 'F-4703r646843_fix'
-  tag 'cci': ['CCI-001133', 'CCI-002361']
+  tag legacy: ['SV-86847', 'V-72223']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000163-GPOS-00072'
+  tag gid: 'V-204579'
+  tag rid: 'SV-204579r861070_rule'
+  tag stig_id: 'RHEL-07-040160'
+  tag fix_id: 'F-4703r646843_fix'
+  tag cci: ['CCI-001133', 'CCI-002361']
   tag nist: ['SC-10', 'AC-12']
   tag subsystems: ['user_profile']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   # Get current TMOUT environment variable (active test)
   describe 'Environment variable TMOUT' do
     subject { os_env('TMOUT').content.to_i }
-    it { should cmp input('expected_system_activity_timeout') }
-    it { should cmp <= input('max_system_activity_timeout') }
+    it { should cmp <= input('system_activity_timeout') }
   end
 
   # Check if TMOUT is set in files (passive test)
@@ -91,8 +93,7 @@
   else
     describe 'The TMOUT setting is configured properly' do
       subject { latest_val }
-      it { should cmp input('expected_system_activity_timeout') }
-      it { should cmp <= input('max_system_activity_timeout') }
+      it { should cmp <= input('system_activity_timeout') }
     end
   end
 end
diff --git a/controls/SV-204580.rb b/controls/SV-204580.rb
index f483a35b9..8ece7e5d1 100644
--- a/controls/SV-204580.rb
+++ b/controls/SV-204580.rb
@@ -22,7 +22,6 @@
     monitoring of the content of privileged communications, or work product, related to personal representation or
     services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are
     private and confidential. See User Agreement for details."'
-  desc 'rationale', ''
   desc 'check', 'Verify any publicly accessible connection to the operating system displays the Standard Mandatory
     DoD Notice and Consent Banner before granting access to the system.
     Check for the location of the banner file being used with the following command:
@@ -74,19 +73,16 @@
     private and confidential. See User Agreement for details."
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72225', 'SV-86849']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000023-GPOS-00006'
-  tag 'satisfies': ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007',
-                    'SRG-OS-000228-GPOS-00088']
-  tag 'gid': 'V-204580'
-  tag 'rid': 'SV-204580r603261_rule'
-  tag 'stig_id': 'RHEL-07-040170'
-  tag 'fix_id': 'F-4704r297486_fix'
-  tag 'cci': ['CCI-000048', 'CCI-000050', 'CCI-001384', 'CCI-001385',
-              'CCI-001386', 'CCI-001387', 'CCI-001388']
-  tag nist: ['AC-8 a', 'AC-8 b', 'AC-8 c 1', 'AC-8 c 2', 'AC-8 c 2', "AC-8 c
-2", 'AC-8 c 3']
+  tag legacy: ['V-72225', 'SV-86849']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000023-GPOS-00006'
+  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007', 'SRG-OS-000228-GPOS-00088']
+  tag gid: 'V-204580'
+  tag rid: 'SV-204580r603261_rule'
+  tag stig_id: 'RHEL-07-040170'
+  tag fix_id: 'F-4704r297486_fix'
+  tag cci: ['CCI-000048', 'CCI-000050', 'CCI-001384', 'CCI-001385', 'CCI-001386', 'CCI-001387', 'CCI-001388']
+  tag nist: ['AC-8 a', 'AC-8 b', 'AC-8 c 1', 'AC-8 c 2', 'AC-8 c 2', 'AC-8 c 3']
   tag subsystems: ['ssh', 'banner']
   tag 'host'
 
diff --git a/controls/SV-204581.rb b/controls/SV-204581.rb
index f7a97ff7a..894739738 100644
--- a/controls/SV-204581.rb
+++ b/controls/SV-204581.rb
@@ -6,7 +6,6 @@
     Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash
     functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while
     maintaining the confidentiality of the key used to generate the hash.'
-  desc 'rationale', ''
   desc 'check', 'If LDAP is not being utilized, this requirement is Not Applicable.
     Verify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.
     To determine if LDAP is being used for authentication, use the following command:
@@ -28,14 +27,14 @@
     Add or modify the following line in "/etc/sssd/sssd.conf":
     ldap_id_use_start_tls = true'
   impact 0.5
-  tag 'legacy': ['V-72227', 'SV-86851']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000250-GPOS-00093'
-  tag 'gid': 'V-204581'
-  tag 'rid': 'SV-204581r603261_rule'
-  tag 'stig_id': 'RHEL-07-040180'
-  tag 'fix_id': 'F-4705r88936_fix'
-  tag 'cci': ['CCI-001453']
+  tag legacy: ['V-72227', 'SV-86851']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000250-GPOS-00093'
+  tag gid: 'V-204581'
+  tag rid: 'SV-204581r877394_rule'
+  tag stig_id: 'RHEL-07-040180'
+  tag fix_id: 'F-4705r88936_fix'
+  tag cci: ['CCI-001453']
   tag nist: ['AC-17 (2)']
   tag subsystems: ['sssd', 'ldap']
   tag 'host'
diff --git a/controls/SV-204582.rb b/controls/SV-204582.rb
index 9e8b7034c..7965bff3d 100644
--- a/controls/SV-204582.rb
+++ b/controls/SV-204582.rb
@@ -6,7 +6,6 @@
     Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash
     functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while
     maintaining the confidentiality of the key used to generate the hash.'
-  desc 'rationale', ''
   desc 'check', 'If LDAP is not being utilized, this requirement is Not Applicable.
     Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.
     To determine if LDAP is being used for authentication, use the following command:
@@ -29,14 +28,14 @@
     Add or modify the following line in "/etc/sssd/sssd.conf":
     ldap_tls_reqcert = demand'
   impact 0.5
-  tag 'legacy': ['V-72229', 'SV-86853']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000250-GPOS-00093'
-  tag 'gid': 'V-204582'
-  tag 'rid': 'SV-204582r603261_rule'
-  tag 'stig_id': 'RHEL-07-040190'
-  tag 'fix_id': 'F-4706r88939_fix'
-  tag 'cci': ['CCI-001453']
+  tag legacy: ['V-72229', 'SV-86853']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000250-GPOS-00093'
+  tag gid: 'V-204582'
+  tag rid: 'SV-204582r877394_rule'
+  tag stig_id: 'RHEL-07-040190'
+  tag fix_id: 'F-4706r88939_fix'
+  tag cci: ['CCI-001453']
   tag nist: ['AC-17 (2)']
   tag subsystems: ['sssd', 'ldap']
   tag 'host'
diff --git a/controls/SV-204583.rb b/controls/SV-204583.rb
index 1036eb1f9..85369abbe 100644
--- a/controls/SV-204583.rb
+++ b/controls/SV-204583.rb
@@ -6,7 +6,6 @@
     Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash
     functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while
     maintaining the confidentiality of the key used to generate the hash.'
-  desc 'rationale', ''
   desc 'check', 'If LDAP is not being utilized, this requirement is Not Applicable.
     Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.
     To determine if LDAP is being used for authentication, use the following command:
@@ -29,14 +28,14 @@
     Add or modify the following line in "/etc/sssd/sssd.conf":
     ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt'
   impact 0.5
-  tag 'legacy': ['SV-86855', 'V-72231']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000250-GPOS-00093'
-  tag 'gid': 'V-204583'
-  tag 'rid': 'SV-204583r603261_rule'
-  tag 'stig_id': 'RHEL-07-040200'
-  tag 'fix_id': 'F-4707r88942_fix'
-  tag 'cci': ['CCI-001453']
+  tag legacy: ['SV-86855', 'V-72231']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000250-GPOS-00093'
+  tag gid: 'V-204583'
+  tag rid: 'SV-204583r877394_rule'
+  tag stig_id: 'RHEL-07-040200'
+  tag fix_id: 'F-4707r88942_fix'
+  tag cci: ['CCI-001453']
   tag nist: ['AC-17 (2)']
   tag subsystems: ['sssd', 'ldap']
   tag 'host'
diff --git a/controls/SV-204584.rb b/controls/SV-204584.rb
index 51ac51766..4c87c910e 100644
--- a/controls/SV-204584.rb
+++ b/controls/SV-204584.rb
@@ -4,16 +4,21 @@
     attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally,
     ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it
     using return-oriented programming (ROP) techniques."
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system implements virtual address space randomization.
-    # grep kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d/*
-    kernel.randomize_va_space = 2
-    If "kernel.randomize_va_space" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is
-    commented out or does not have a value of "2", this is a finding.
-    Check that the operating system implements virtual address space randomization with the following command:
-    # /sbin/sysctl -a | grep kernel.randomize_va_space
-    kernel.randomize_va_space = 2
-    If "kernel.randomize_va_space" does not have a value of "2", this is a finding.'
+
+     # grep -r kernel.randomize_va_space /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     kernel.randomize_va_space = 2
+
+If "kernel.randomize_va_space" is not configured in the /etc/sysctl.conf file or or in any of the other sysctl.d directories, is commented out or does not have a value of "2", this is a finding.
+
+Check that the operating system implements virtual address space randomization with the following command:
+
+     # /sbin/sysctl -a | grep kernel.randomize_va_space
+     kernel.randomize_va_space = 2
+
+If "kernel.randomize_va_space" does not have a value of "2", this is a finding.
+
+If conflicting results are returned, this is a finding.'
   desc 'fix', 'Configure the operating system implement virtual address space randomization.
     Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a config file
     in the /etc/sysctl.d/ directory (or modify the line to have the required value):
@@ -21,14 +26,14 @@
     Issue the following command to make the changes take effect:
     # sysctl --system'
   impact 0.5
-  tag 'legacy': ['SV-92521', 'V-77825']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204584'
-  tag 'rid': 'SV-204584r603261_rule'
-  tag 'stig_id': 'RHEL-07-040201'
-  tag 'fix_id': 'F-4708r88945_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-92521', 'V-77825']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204584'
+  tag rid: 'SV-204584r880794_rule'
+  tag stig_id: 'RHEL-07-040201'
+  tag fix_id: 'F-4708r880793_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['aslr', 'kernel_parameter']
   tag 'host'
@@ -40,8 +45,21 @@
     end
   else
     randomize_va_space = input('randomize_va_space')
+    config_file_values = command('grep -r kernel.randomize_va_space /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'kernel.randomize_va_space' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{randomize_va_space}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(randomize_va_space), incorrect_value_fail_message
+          end
+        end
+      end
+    end
 
-    describe kernel_parameter('kernel.randomize_va_space') do
+    describe 'The runtime kernel parameter kernel.randomize_va_space' do
+      subject { kernel_parameter('kernel.randomize_va_space') }
       its('value') { should eq randomize_va_space }
     end
   end
diff --git a/controls/SV-204585.rb b/controls/SV-204585.rb
index b9695151b..4c50a8cf9 100644
--- a/controls/SV-204585.rb
+++ b/controls/SV-204585.rb
@@ -10,26 +10,24 @@
     Protecting the confidentiality and integrity of organizational information can be accomplished by physical means
     (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If
     physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.'
-  desc 'rationale', ''
-  desc 'check', %q(Check to see if sshd is installed with the following command:
-    # yum list installed \*ssh\*
+  desc 'check', 'Check to see if sshd is installed with the following command:
+    # yum list installed \\*ssh\\*
     libssh2.x86_64 1.4.3-8.el7 @anaconda/7.1
     openssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1
     openssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1
-    If the "SSH server" package is not installed, this is a finding.)
+    If the "SSH server" package is not installed, this is a finding.'
   desc 'fix', 'Install SSH packages onto the host with the following commands:
     # yum install openssh-server.x86_64'
   impact 0.5
-  tag 'legacy': ['SV-86857', 'V-72233']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000423-GPOS-00187'
-  tag 'satisfies': ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000424-GPOS-00188', 'SRG-OS-000425-GPOS-00189',
-                    'SRG-OS-000426-GPOS-00190']
-  tag 'gid': 'V-204585'
-  tag 'rid': 'SV-204585r603261_rule'
-  tag 'stig_id': 'RHEL-07-040300'
-  tag 'fix_id': 'F-4709r88948_fix'
-  tag 'cci': ['CCI-002418', 'CCI-002420', 'CCI-002421', 'CCI-002422']
+  tag legacy: ['SV-86857', 'V-72233']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000423-GPOS-00187'
+  tag satisfies: ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000424-GPOS-00188', 'SRG-OS-000425-GPOS-00189', 'SRG-OS-000426-GPOS-00190']
+  tag gid: 'V-204585'
+  tag rid: 'SV-204585r853989_rule'
+  tag stig_id: 'RHEL-07-040300'
+  tag fix_id: 'F-4709r88948_fix'
+  tag cci: ['CCI-002418', 'CCI-002420', 'CCI-002421', 'CCI-002422']
   tag nist: ['SC-8', 'SC-8 (2)', 'SC-8 (1)', 'SC-8 (2)']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204586.rb b/controls/SV-204586.rb
index c427faf13..16c029fb0 100644
--- a/controls/SV-204586.rb
+++ b/controls/SV-204586.rb
@@ -12,7 +12,6 @@
     (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If
     physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice
     versa.'
-  desc 'rationale', ''
   desc 'check', 'Verify SSH is loaded and active with the following command:
     # systemctl status sshd
     sshd.service - OpenSSH server daemon
@@ -25,16 +24,15 @@
   desc 'fix', 'Configure the SSH service to automatically start after reboot with the following command:
     # systemctl enable sshd.service'
   impact 0.5
-  tag 'legacy': ['SV-86859', 'V-72235']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000423-GPOS-00187'
-  tag 'satisfies': ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000423-GPOS-00188', 'SRG-OS-000423-GPOS-00189',
-                    'SRG-OS-000423-GPOS-00190']
-  tag 'gid': 'V-204586'
-  tag 'rid': 'SV-204586r603261_rule'
-  tag 'stig_id': 'RHEL-07-040310'
-  tag 'fix_id': 'F-4710r88951_fix'
-  tag 'cci': ['CCI-002418', 'CCI-002420', 'CCI-002421', 'CCI-002422']
+  tag legacy: ['SV-86859', 'V-72235']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000423-GPOS-00187'
+  tag satisfies: ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000423-GPOS-00188', 'SRG-OS-000423-GPOS-00189', 'SRG-OS-000423-GPOS-00190', 'SRG-OS-000424-GPOS-00188', 'SRG-OS-000425-GPOS-00189', 'SRG-OS-000426-GPOS-00190']
+  tag gid: 'V-204586'
+  tag rid: 'SV-204586r861071_rule'
+  tag stig_id: 'RHEL-07-040310'
+  tag fix_id: 'F-4710r88951_fix'
+  tag cci: ['CCI-002418', 'CCI-002420', 'CCI-002421', 'CCI-002422']
   tag nist: ['SC-8', 'SC-8 (2)', 'SC-8 (1)', 'SC-8 (2)']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204587.rb b/controls/SV-204587.rb
index d3fac5e96..934fabcdb 100644
--- a/controls/SV-204587.rb
+++ b/controls/SV-204587.rb
@@ -11,7 +11,6 @@
     application level if multiple application sessions are using a single operating system-level network connection.
     This does not mean that the operating system terminates all sessions or network access; it only ends the inactive
     session and releases the resources associated with that session.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system automatically terminates a user session after inactivity time-outs have
     expired.
     Check for the value of the "ClientAliveInterval" keyword with the following command:
@@ -28,15 +27,15 @@
     ClientAliveInterval 600
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72237', 'SV-86861']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000163-GPOS-00072'
-  tag 'satisfies': ['SRG-OS-000163-GPOS-00072', 'SRG-OS-000279-GPOS-00109']
-  tag 'gid': 'V-204587'
-  tag 'rid': 'SV-204587r603261_rule'
-  tag 'stig_id': 'RHEL-07-040320'
-  tag 'fix_id': 'F-4711r88954_fix'
-  tag 'cci': ['CCI-001133', 'CCI-002361']
+  tag legacy: ['V-72237', 'SV-86861']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000163-GPOS-00072'
+  tag satisfies: ['SRG-OS-000163-GPOS-00072', 'SRG-OS-000279-GPOS-00109']
+  tag gid: 'V-204587'
+  tag rid: 'SV-204587r861072_rule'
+  tag stig_id: 'RHEL-07-040320'
+  tag fix_id: 'F-4711r88954_fix'
+  tag cci: ['CCI-001133', 'CCI-002361']
   tag nist: ['SC-10', 'AC-12']
   tag subsystems: ['ssh']
   tag 'host'
@@ -52,8 +51,7 @@
     # convert it to an integer using to_i it will convert it to 0 and pass the
     # <= client_alive_interval check. However, the control as a whole will still fail.
     describe sshd_config do
-      its('ClientAliveInterval') { should cmp input('expected_client_alive_interval') }
-      its('ClientAliveInterval') { should be_between(1, input('max_client_alive_interval')) }
+      its('ClientAliveInterval') { should be_between(1, input('client_alive_interval')) }
       its('ClientAliveInterval') { should_not eq nil }
     end
   end
diff --git a/controls/SV-204588.rb b/controls/SV-204588.rb
index 6b2e38fdf..d49e761d2 100644
--- a/controls/SV-204588.rb
+++ b/controls/SV-204588.rb
@@ -3,7 +3,6 @@
     authentication using RSA rhosts authentication.'
   desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will
     require a password, even in the event of misconfiguration elsewhere.'
-  desc 'rationale', ''
   desc 'check', %q(Check the version of the operating system with the following command:
     # cat /etc/redhat-release
     If the release is 7.4 or newer this requirement is Not Applicable.
@@ -17,14 +16,14 @@
     RhostsRSAAuthentication no
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72239', 'SV-86863']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204588'
-  tag 'rid': 'SV-204588r603261_rule'
-  tag 'stig_id': 'RHEL-07-040330'
-  tag 'fix_id': 'F-4712r88957_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72239', 'SV-86863']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204588'
+  tag rid: 'SV-204588r603261_rule'
+  tag stig_id: 'RHEL-07-040330'
+  tag fix_id: 'F-4712r88957_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
@@ -34,6 +33,11 @@
     describe 'Control not applicable - SSH is not installed within containerized RHEL' do
       skip 'Control not applicable - SSH is not installed within containerized RHEL'
     end
+  elsif os.release.to_f >= 7.4
+    impact 0.0
+    describe "The release is #{os.release}" do
+      skip 'For RHEL 7.4 and above, this requirement is not applicable.'
+    end
   else
     describe sshd_config do
       its('RhostsRSAAuthentication') { should cmp 'no' }
diff --git a/controls/SV-204589.rb b/controls/SV-204589.rb
index 77947b2de..fbfe61c39 100644
--- a/controls/SV-204589.rb
+++ b/controls/SV-204589.rb
@@ -10,7 +10,6 @@
     application level if multiple application sessions are using a single operating system-level network connection.
     This does not mean that the operating system terminates all sessions or network access; it only ends the inactive
     session and releases the resources associated with that session.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system automatically terminates a user session after inactivity time-outs have
     expired.
     Check for the value of the "ClientAliveCountMax" keyword with the following command:
@@ -25,15 +24,15 @@
     ClientAliveCountMax 0
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86865', 'V-72241']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000163-GPOS-00072'
-  tag 'satisfies': ['SRG-OS-000163-GPOS-00072', 'SRG-OS-000279-GPOS-00109']
-  tag 'gid': 'V-204589'
-  tag 'rid': 'SV-204589r603261_rule'
-  tag 'stig_id': 'RHEL-07-040340'
-  tag 'fix_id': 'F-4713r88960_fix'
-  tag 'cci': ['CCI-001133', 'CCI-002361']
+  tag legacy: ['SV-86865', 'V-72241']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000163-GPOS-00072'
+  tag satisfies: ['SRG-OS-000163-GPOS-00072', 'SRG-OS-000279-GPOS-00109']
+  tag gid: 'V-204589'
+  tag rid: 'SV-204589r853992_rule'
+  tag stig_id: 'RHEL-07-040340'
+  tag fix_id: 'F-4713r88960_fix'
+  tag cci: ['CCI-001133', 'CCI-002361']
   tag nist: ['SC-10', 'AC-12']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204590.rb b/controls/SV-204590.rb
index 809a986d4..2922eacc8 100644
--- a/controls/SV-204590.rb
+++ b/controls/SV-204590.rb
@@ -3,7 +3,6 @@
     authentication using rhosts authentication.'
   desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will
     require a password, even in the event of misconfiguration elsewhere.'
-  desc 'rationale', ''
   desc 'check', %q(Verify the SSH daemon does not allow authentication using known hosts authentication.
     To determine how the SSH daemon's "IgnoreRhosts" option is set, run the following command:
     # grep -i IgnoreRhosts /etc/ssh/sshd_config
@@ -13,14 +12,14 @@
     Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes":
     IgnoreRhosts yes'
   impact 0.5
-  tag 'legacy': ['V-72243', 'SV-86867']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204590'
-  tag 'rid': 'SV-204590r603261_rule'
-  tag 'stig_id': 'RHEL-07-040350'
-  tag 'fix_id': 'F-4714r88963_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72243', 'SV-86867']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204590'
+  tag rid: 'SV-204590r603261_rule'
+  tag stig_id: 'RHEL-07-040350'
+  tag fix_id: 'F-4714r88963_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204591.rb b/controls/SV-204591.rb
index 665356163..ea8373421 100644
--- a/controls/SV-204591.rb
+++ b/controls/SV-204591.rb
@@ -3,7 +3,6 @@
     logon upon an SSH logon.'
   desc 'Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition
     and reporting of unauthorized account use.'
-  desc 'rationale', ''
   desc 'check', 'Verify SSH provides users with feedback on when account accesses last occurred.
     Check that "PrintLastLog" keyword in the sshd daemon configuration file is used and set to "yes" with the following
     command:
@@ -18,15 +17,15 @@
     PrintLastLog yes
     The SSH service must be restarted for changes to "sshd_config" to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72245', 'SV-86869']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204591'
-  tag 'rid': 'SV-204591r603261_rule'
-  tag 'stig_id': 'RHEL-07-040360'
-  tag 'fix_id': 'F-4715r88966_fix'
-  tag 'cci': ['CCI-000366']
-  tag nist: ['CM-6 b']
+  tag legacy: ['V-72245', 'SV-86869']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204591'
+  tag rid: 'SV-204591r858477_rule'
+  tag stig_id: 'RHEL-07-040360'
+  tag fix_id: 'F-4715r88966_fix'
+  tag cci: ['CCI-000366', 'CCI-000052']
+  tag nist: ['CM-6 b', 'AC-9']
   tag subsystems: ['pam', 'ssh', 'lastlog']
   tag 'host'
 
diff --git a/controls/SV-204592.rb b/controls/SV-204592.rb
index 62349dca5..a9bac9d9c 100644
--- a/controls/SV-204592.rb
+++ b/controls/SV-204592.rb
@@ -4,7 +4,6 @@
   desc 'Even though the communications channel may be encrypted, an additional layer of security is gained by
     extending the policy of not logging on directly as root. In addition, logging on with a user-specific account
     provides individual accountability of actions performed on the system.'
-  desc 'rationale', ''
   desc 'check', 'Verify remote access using SSH prevents users from logging on directly as root.
     Check that SSH prevents users from logging on directly as root with the following command:
     # grep -i permitrootlogin /etc/ssh/sshd_config
@@ -17,14 +16,14 @@
     PermitRootLogin no
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72247', 'SV-86871']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204592'
-  tag 'rid': 'SV-204592r603261_rule'
-  tag 'stig_id': 'RHEL-07-040370'
-  tag 'fix_id': 'F-4716r88969_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72247', 'SV-86871']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204592'
+  tag rid: 'SV-204592r603261_rule'
+  tag stig_id: 'RHEL-07-040370'
+  tag fix_id: 'F-4716r88969_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204593.rb b/controls/SV-204593.rb
index 31fe0abb1..4362fb0ae 100644
--- a/controls/SV-204593.rb
+++ b/controls/SV-204593.rb
@@ -3,7 +3,6 @@
     authentication using known hosts authentication.'
   desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will
     require a password, even in the event of misconfiguration elsewhere.'
-  desc 'rationale', ''
   desc 'check', %q(Verify the SSH daemon does not allow authentication using known hosts authentication.
     To determine how the SSH daemon's "IgnoreUserKnownHosts" option is set, run the following command:
     # grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config
@@ -14,14 +13,14 @@
     IgnoreUserKnownHosts yes
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['V-72249', 'SV-86873']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204593'
-  tag 'rid': 'SV-204593r603261_rule'
-  tag 'stig_id': 'RHEL-07-040380'
-  tag 'fix_id': 'F-4717r88972_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72249', 'SV-86873']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204593'
+  tag rid: 'SV-204593r603261_rule'
+  tag stig_id: 'RHEL-07-040380'
+  tag fix_id: 'F-4717r88972_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204594.rb b/controls/SV-204594.rb
index 31551830c..6828e400b 100644
--- a/controls/SV-204594.rb
+++ b/controls/SV-204594.rb
@@ -3,7 +3,6 @@
     only use the SSHv2 protocol.'
   desc 'SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits.
     Exploits of the SSH daemon could provide immediate root access to the system.'
-  desc 'rationale', ''
   desc 'check', 'Check the version of the operating system with the following command:
     # cat /etc/redhat-release
     If the release is 7.4 or newer this requirement is Not Applicable.
@@ -19,15 +18,15 @@
     Protocol 2
     The SSH service must be restarted for changes to take effect.'
   impact 0.7
-  tag 'legacy': ['SV-86875', 'V-72251']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000074-GPOS-00042'
-  tag 'satisfies': ['SRG-OS-000074-GPOS-00042', 'SRG-OS-000480-GPOS-00227']
-  tag 'gid': 'V-204594'
-  tag 'rid': 'SV-204594r603261_rule'
-  tag 'stig_id': 'RHEL-07-040390'
-  tag 'fix_id': 'F-4718r88975_fix'
-  tag 'cci': ['CCI-000197', 'CCI-000366']
+  tag legacy: ['SV-86875', 'V-72251']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000074-GPOS-00042'
+  tag satisfies: ['SRG-OS-000074-GPOS-00042', 'SRG-OS-000480-GPOS-00227']
+  tag gid: 'V-204594'
+  tag rid: 'SV-204594r877396_rule'
+  tag stig_id: 'RHEL-07-040390'
+  tag fix_id: 'F-4718r88975_fix'
+  tag cci: ['CCI-000197', 'CCI-000366']
   tag nist: ['IA-5 (1) (c)', 'CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204595.rb b/controls/SV-204595.rb
index 5b54773c7..4541cc904 100644
--- a/controls/SV-204595.rb
+++ b/controls/SV-204595.rb
@@ -6,7 +6,6 @@
     The system will attempt to use the first hash presented by the client that matches the server list. Listing the
     values "strongest to weakest" is a method to ensure the use of the strongest hash available to secure the SSH
     connection.'
-  desc 'rationale', ''
   desc 'check', 'Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved hashes.
     Note: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS
     140-2-approved cryptographic algorithms and hashes.
@@ -22,14 +21,14 @@
     MACs hmac-sha2-512,hmac-sha2-256
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86877', 'V-72253']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000250-GPOS-00093'
-  tag 'gid': 'V-204595'
-  tag 'rid': 'SV-204595r744117_rule'
-  tag 'stig_id': 'RHEL-07-040400'
-  tag 'fix_id': 'F-4719r622309_fix'
-  tag 'cci': ['CCI-001453']
+  tag legacy: ['SV-86877', 'V-72253']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000250-GPOS-00093'
+  tag gid: 'V-204595'
+  tag rid: 'SV-204595r877394_rule'
+  tag stig_id: 'RHEL-07-040400'
+  tag fix_id: 'F-4719r622309_fix'
+  tag cci: ['CCI-001453']
   tag nist: ['AC-17 (2)']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204596.rb b/controls/SV-204596.rb
index d069b6001..0c45b4404 100644
--- a/controls/SV-204596.rb
+++ b/controls/SV-204596.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have
     mode 0644 or less permissive.'
   desc 'If a public host key file is modified by an unauthorized user, the SSH service may be compromised.'
-  desc 'rationale', ''
   desc 'check', %q(Verify the SSH public host key files have mode "0644" or less permissive.
     Note: SSH public key files may be found in other directories on the system depending on the installation.
     The following command will find all SSH public key files on the system:
@@ -16,14 +15,14 @@
     Change the mode of public host key files under "/etc/ssh" to "0644" with the following command:
     # chmod 0644 /etc/ssh/*.key.pub'
   impact 0.5
-  tag 'legacy': ['V-72255', 'SV-86879']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204596'
-  tag 'rid': 'SV-204596r603261_rule'
-  tag 'stig_id': 'RHEL-07-040410'
-  tag 'fix_id': 'F-4720r88981_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72255', 'SV-86879']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204596'
+  tag rid: 'SV-204596r603261_rule'
+  tag stig_id: 'RHEL-07-040410'
+  tag fix_id: 'F-4720r88981_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204597.rb b/controls/SV-204597.rb
index 99ade4885..fa290d281 100644
--- a/controls/SV-204597.rb
+++ b/controls/SV-204597.rb
@@ -1,27 +1,29 @@
 control 'SV-204597' do
-  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files
-    have mode 0600 or less permissive.'
+  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.'
   desc 'If an unauthorized user obtains the private SSH host key file, the host could be impersonated.'
-  desc 'rationale', ''
-  desc 'check', %q(Verify the SSH private host key files have mode "0600" or less permissive.
-    The following command will find all SSH private key files on the system and list their modes:
-    # find / -name '*ssh_host*key' | xargs ls -lL
-    -rw------- 1 root ssh_keys 668 Nov 28 06:43 ssh_host_dsa_key
-    -rw------- 1 root ssh_keys 582 Nov 28 06:43 ssh_host_key
-    -rw------- 1 root ssh_keys 887 Nov 28 06:43 ssh_host_rsa_key
-    If any file has a mode more permissive than "0600", this is a finding.)
-  desc 'fix', 'Configure the mode of SSH private host key files under "/etc/ssh" to "0600" with the following
-    command:
-    # chmod 0600 /path/to/file/ssh_host*key'
+  desc 'check', %q(Verify the SSH private host key files have mode "0640" or less permissive.
+
+The following command will find all SSH private key files on the system and list their modes:
+
+     # find / -name '*ssh_host*key' | xargs ls -lL
+
+     -rw-r----- 1 root ssh_keys 112 Apr 1 11:59 ssh_host_dsa_key
+     -rw-r----- 1 root ssh_keys 202 Apr 1 11:59 ssh_host_key
+     -rw-r----- 1 root ssh_keys 352 Apr 1 11:59 ssh_host_rsa_key
+
+If any file has a mode more permissive than "0640", this is a finding.)
+  desc 'fix', 'Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command:
+
+# chmod 0640 /path/to/file/ssh_host*key'
   impact 0.5
-  tag 'legacy': ['V-72257', 'SV-86881']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204597'
-  tag 'rid': 'SV-204597r792834_rule'
-  tag 'stig_id': 'RHEL-07-040420'
-  tag 'fix_id': 'F-4721r792833_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72257', 'SV-86881']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204597'
+  tag rid: 'SV-204597r880743_rule'
+  tag stig_id: 'RHEL-07-040420'
+  tag fix_id: 'F-4721r880742_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204598.rb b/controls/SV-204598.rb
index 72fbf5df6..d477db83e 100644
--- a/controls/SV-204598.rb
+++ b/controls/SV-204598.rb
@@ -4,7 +4,6 @@
   desc "GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing
     GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the
     system. GSSAPI authentication must be disabled unless needed."
-  desc 'rationale', ''
   desc 'check', 'Verify the SSH daemon does not permit GSSAPI authentication unless approved.
     Check that the SSH daemon does not permit GSSAPI authentication with the following command:
     # grep -i gssapiauth /etc/ssh/sshd_config
@@ -19,16 +18,15 @@
     If GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with
     the ISSO.'
   impact 0.5
-  tag 'legacy': ['V-72259', 'SV-86883']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000364-GPOS-00151'
-  tag 'gid': 'V-204598'
-  tag 'rid': 'SV-204598r603261_rule'
-  tag 'stig_id': 'RHEL-07-040430'
-  tag 'fix_id': 'F-4722r88987_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['V-72259', 'SV-86883']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000364-GPOS-00151'
+  tag gid: 'V-204598'
+  tag rid: 'SV-204598r853993_rule'
+  tag stig_id: 'RHEL-07-040430'
+  tag fix_id: 'F-4722r88987_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['ssh']
   tag 'host'
 
diff --git a/controls/SV-204599.rb b/controls/SV-204599.rb
index af52b8dd0..58b611f23 100644
--- a/controls/SV-204599.rb
+++ b/controls/SV-204599.rb
@@ -6,7 +6,6 @@
     Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to
     exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be
     disabled for systems not using this capability."
-  desc 'rationale', ''
   desc 'check', 'Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.
     Check that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:
     # grep -i kerberosauth /etc/ssh/sshd_config
@@ -21,16 +20,15 @@
     If Kerberos authentication is required, it must be documented, to include the location of the configuration file,
     with the ISSO.'
   impact 0.5
-  tag 'legacy': ['V-72261', 'SV-86885']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000364-GPOS-00151'
-  tag 'gid': 'V-204599'
-  tag 'rid': 'SV-204599r603261_rule'
-  tag 'stig_id': 'RHEL-07-040440'
-  tag 'fix_id': 'F-4723r88990_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['V-72261', 'SV-86885']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000364-GPOS-00151'
+  tag gid: 'V-204599'
+  tag rid: 'SV-204599r853994_rule'
+  tag stig_id: 'RHEL-07-040440'
+  tag fix_id: 'F-4723r88990_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['ssh']
   tag 'host'
 
diff --git a/controls/SV-204600.rb b/controls/SV-204600.rb
index 58f159dac..5b8c4f6d2 100644
--- a/controls/SV-204600.rb
+++ b/controls/SV-204600.rb
@@ -3,7 +3,6 @@
     mode checking of home directory configuration files.'
   desc 'If other users have access to modify user-specific SSH configuration files, they may be able to log on to
     the system as another user.'
-  desc 'rationale', ''
   desc 'check', 'Verify the SSH daemon performs strict mode checking of home directory configuration files.
     The location of the "sshd_config" file may vary if a different daemon is in use.
     Inspect the "sshd_config" file with the following command:
@@ -16,14 +15,14 @@
     StrictModes yes
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86887', 'V-72263']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204600'
-  tag 'rid': 'SV-204600r603261_rule'
-  tag 'stig_id': 'RHEL-07-040450'
-  tag 'fix_id': 'F-4724r88993_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86887', 'V-72263']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204600'
+  tag rid: 'SV-204600r603261_rule'
+  tag stig_id: 'RHEL-07-040450'
+  tag fix_id: 'F-4724r88993_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204601.rb b/controls/SV-204601.rb
index 99ac49604..5d81c0895 100644
--- a/controls/SV-204601.rb
+++ b/controls/SV-204601.rb
@@ -3,7 +3,6 @@
     separation.'
   desc 'SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would
     decrease the impact of software vulnerabilities in the unprivileged section.'
-  desc 'rationale', ''
   desc 'check', 'Verify the SSH daemon performs privilege separation.
     Check that the SSH daemon performs privilege separation with the following command:
     # grep -i usepriv /etc/ssh/sshd_config
@@ -16,14 +15,14 @@
     UsePrivilegeSeparation sandbox
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86889', 'V-72265']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204601'
-  tag 'rid': 'SV-204601r603261_rule'
-  tag 'stig_id': 'RHEL-07-040460'
-  tag 'fix_id': 'F-4725r88996_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86889', 'V-72265']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204601'
+  tag rid: 'SV-204601r603261_rule'
+  tag stig_id: 'RHEL-07-040460'
+  tag fix_id: 'F-4725r88996_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204602.rb b/controls/SV-204602.rb
index 1593db0a5..fa7983ba3 100644
--- a/controls/SV-204602.rb
+++ b/controls/SV-204602.rb
@@ -4,26 +4,30 @@
   desc 'If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression
     software could result in compromise of the system from an unauthenticated connection, potentially with root
     privileges.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the SSH daemon performs compression after a user successfully authenticates.
-    Check that the SSH daemon performs compression after a user successfully authenticates with the following command:
-    # grep -i compression /etc/ssh/sshd_config
-    Compression delayed
-    If the "Compression" keyword is set to "yes", is missing, or the returned line is commented out, this is a finding.'
+  desc 'check', 'Note: For RHEL 7.4 and above, this requirement is not applicable.
+
+Verify the SSH daemon performs compression after a user successfully authenticates.
+
+Check that the SSH daemon performs compression after a user successfully authenticates with the following command:
+
+     # grep -i compression /etc/ssh/sshd_config
+     Compression delayed
+
+If the "Compression" keyword is set to "yes", is missing, or the returned line is commented out, this is a finding.'
   desc 'fix', 'Uncomment the "Compression" keyword in "/etc/ssh/sshd_config" (this file may be named differently or
     be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set
     the value to "delayed" or "no":
     Compression no
     The SSH service must be restarted for changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86891', 'V-72267']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204602'
-  tag 'rid': 'SV-204602r603261_rule'
-  tag 'stig_id': 'RHEL-07-040470'
-  tag 'fix_id': 'F-4726r88999_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86891', 'V-72267']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204602'
+  tag rid: 'SV-204602r880758_rule'
+  tag stig_id: 'RHEL-07-040470'
+  tag fix_id: 'F-4726r880757_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
@@ -33,6 +37,13 @@
     describe 'Control not applicable - SSH is not installed within containerized RHEL' do
       skip 'Control not applicable - SSH is not installed within containerized RHEL'
     end
+
+  elsif os.release.to_f >= 7.4
+    impact 0.0
+    describe "The release is #{os.release}" do
+      skip 'For RHEL 7.4 and above, this requirement is not applicable.'
+    end
+
   else
 
     describe.one do
diff --git a/controls/SV-204603.rb b/controls/SV-204603.rb
index 4ae37933e..e145e42a1 100644
--- a/controls/SV-204603.rb
+++ b/controls/SV-204603.rb
@@ -9,7 +9,6 @@
     multiple system clocks and systems connected over a network.
     Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g.,
     mobile, teleworking, and tactical endpoints).'
-  desc 'rationale', ''
   desc 'check', 'Check to see if NTP is running in continuous mode:
     # ps -ef | grep ntp
     If NTP is not running, check to see if "chronyd" is running in continuous mode:
@@ -41,18 +40,19 @@
     If "chronyd" was not running, it must be started:
     # systemctl start chronyd.service'
   impact 0.5
-  tag 'legacy': ['V-72269', 'SV-86893']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000355-GPOS-00143'
-  tag 'satisfies': ['SRG-OS-000355-GPOS-00143', 'SRG-OS-000356-GPOS-00144']
-  tag 'gid': 'V-204603'
-  tag 'rid': 'SV-204603r809230_rule'
-  tag 'stig_id': 'RHEL-07-040500'
-  tag 'fix_id': 'F-4727r809210_fix'
-  tag 'cci': ['CCI-001891', 'CCI-002046']
+  tag legacy: ['V-72269', 'SV-86893']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000355-GPOS-00143'
+  tag satisfies: ['SRG-OS-000355-GPOS-00143', 'SRG-OS-000356-GPOS-00144']
+  tag gid: 'V-204603'
+  tag rid: 'SV-204603r877038_rule'
+  tag stig_id: 'RHEL-07-040500'
+  tag fix_id: 'F-4727r809210_fix'
+  tag cci: ['CCI-001891', 'CCI-002046']
   tag nist: ['AU-8 (1) (a)', 'AU-8 (1) (b)']
   tag subsystems: ['ntp']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   # Either ntpd or chronyd should be running
   describe.one do
diff --git a/controls/SV-204604.rb b/controls/SV-204604.rb
index badd50cf9..b5ee84b53 100644
--- a/controls/SV-204604.rb
+++ b/controls/SV-204604.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must enable an application firewall, if available.'
   desc 'Firewalls protect computers from network attacks by blocking or limiting access to open network ports.
     Application firewalls limit which applications are allowed to communicate over the network.'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system enabled an application firewall.
     Check to see if "firewalld" is installed with the following command:
     # yum list installed firewalld
@@ -26,19 +25,19 @@
     Start the firewall via "systemctl" with the following command:
     # systemctl start firewalld)
   impact 0.5
-  tag 'legacy': ['SV-86897', 'V-72273']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'satisfies': ['SRG-OS-000480-GPOS-00227', 'SRG-OS-000480-GPOS-00231',
-                    'SRG-OS-000480-GPOS-00232']
-  tag 'gid': 'V-204604'
-  tag 'rid': 'SV-204604r603261_rule'
-  tag 'stig_id': 'RHEL-07-040520'
-  tag 'fix_id': 'F-4728r89005_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86897', 'V-72273']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag satisfies: ['SRG-OS-000480-GPOS-00227', 'SRG-OS-000480-GPOS-00231', 'SRG-OS-000480-GPOS-00232']
+  tag gid: 'V-204604'
+  tag rid: 'SV-204604r603261_rule'
+  tag stig_id: 'RHEL-07-040520'
+  tag fix_id: 'F-4728r89005_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['firewalld', 'iptables']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe.one do
     describe package('firewalld') do
diff --git a/controls/SV-204605.rb b/controls/SV-204605.rb
index ea79afe34..beab2c10a 100644
--- a/controls/SV-204605.rb
+++ b/controls/SV-204605.rb
@@ -3,7 +3,6 @@
     logon upon logon.'
   desc 'Providing users with feedback on when account accesses last occurred facilitates user recognition and
     reporting of unauthorized account use.'
-  desc 'rationale', ''
   desc 'check', 'Verify users are provided with feedback on when account accesses last occurred.
     Check that "pam_lastlog" is used and not silent with the following command:
     # grep pam_lastlog /etc/pam.d/postlogin
@@ -14,17 +13,18 @@
     Add the following line to the top of "/etc/pam.d/postlogin":
     session required pam_lastlog.so showfailed'
   impact 0.3
-  tag 'legacy': ['SV-86899', 'V-72275']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204605'
-  tag 'rid': 'SV-204605r603261_rule'
-  tag 'stig_id': 'RHEL-07-040530'
-  tag 'fix_id': 'F-4729r89008_fix'
-  tag 'cci': ['CCI-000366']
-  tag nist: ['CM-6 b']
+  tag legacy: ['SV-86899', 'V-72275']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204605'
+  tag rid: 'SV-204605r858478_rule'
+  tag stig_id: 'RHEL-07-040530'
+  tag fix_id: 'F-4729r89008_fix'
+  tag cci: ['CCI-000366', 'CCI-000052']
+  tag nist: ['CM-6 b', 'AC-9']
   tag subsystems: ['pam', 'lastlog', 'ssh']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe pam('/etc/pam.d/postlogin') do
     its('lines') do
diff --git a/controls/SV-204606.rb b/controls/SV-204606.rb
index a976856a2..fbf243c4a 100644
--- a/controls/SV-204606.rb
+++ b/controls/SV-204606.rb
@@ -4,7 +4,6 @@
     SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not
     require interactive identification and authentication of a connection request, or for the use of two-factor
     authentication.'
-  desc 'rationale', ''
   desc 'check', %q(Verify there are no ".shosts" files on the system.
     Check the system for the existence of these files with the following command:
     # find / -name '*.shosts'
@@ -12,17 +11,18 @@
   desc 'fix', 'Remove any found ".shosts" files from the system.
     # rm /[path]/[to]/[file]/.shosts'
   impact 0.7
-  tag 'legacy': ['SV-86901', 'V-72277']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204606'
-  tag 'rid': 'SV-204606r603261_rule'
-  tag 'stig_id': 'RHEL-07-040540'
-  tag 'fix_id': 'F-4730r89011_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86901', 'V-72277']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204606'
+  tag rid: 'SV-204606r603261_rule'
+  tag stig_id: 'RHEL-07-040540'
+  tag fix_id: 'F-4730r89011_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?
     impact 0.0
diff --git a/controls/SV-204607.rb b/controls/SV-204607.rb
index 442e2d90d..82cb0f39b 100644
--- a/controls/SV-204607.rb
+++ b/controls/SV-204607.rb
@@ -3,7 +3,6 @@
   desc 'The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based
     authentication is not sufficient for preventing unauthorized access to the system, as it does not require
     interactive identification and authentication of a connection request, or for the use of two-factor authentication.'
-  desc 'rationale', ''
   desc 'check', 'Verify there are no "shosts.equiv" files on the system.
     Check the system for the existence of these files with the following command:
     # find / -name shosts.equiv
@@ -11,17 +10,18 @@
   desc 'fix', 'Remove any found "shosts.equiv" files from the system.
     # rm /[path]/[to]/[file]/shosts.equiv'
   impact 0.7
-  tag 'legacy': ['SV-86903', 'V-72279']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204607'
-  tag 'rid': 'SV-204607r603261_rule'
-  tag 'stig_id': 'RHEL-07-040550'
-  tag 'fix_id': 'F-4731r89014_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86903', 'V-72279']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204607'
+  tag rid: 'SV-204607r603261_rule'
+  tag stig_id: 'RHEL-07-040550'
+  tag fix_id: 'F-4731r89014_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?
     impact 0.0
diff --git a/controls/SV-204608.rb b/controls/SV-204608.rb
index 5dc69a172..389e3c197 100644
--- a/controls/SV-204608.rb
+++ b/controls/SV-204608.rb
@@ -4,8 +4,7 @@
   desc 'To provide availability for name resolution services, multiple redundant name servers are mandated. A
     failure in name resolution could lead to the failure of security functions requiring name resolution, which may
     include time synchronization, centralized authentication, and remote system logging.'
-  desc 'rationale', ''
-  desc 'check', %q{Determine whether the system is using local or DNS name resolution with the following command:
+  desc 'check', %q(Determine whether the system is using local or DNS name resolution with the following command:
     # grep hosts /etc/nsswitch.conf
     hosts: files dns
     If the DNS entry is missing from the host's line in the "/etc/nsswitch.conf" file, the "/etc/resolv.conf" file must
@@ -25,7 +24,7 @@
     # sudo lsattr /etc/resolv.conf
     ----i----------- /etc/resolv.conf
     If the file is mutable and has not been documented with the Information System Security Officer (ISSO), this is a
-    finding.}
+    finding.)
   desc 'fix', 'Configure the operating system to use two or more name servers for DNS resolution.
     Edit the "/etc/resolv.conf" file to uncomment or add the two or more "nameserver" option lines with the IP address
     of local authoritative name servers. If local host resolution is being performed, the "/etc/resolv.conf" file must
@@ -36,17 +35,18 @@
     If the "/etc/resolv.conf" file must be mutable, the required configuration must be documented with the Information
     System Security Officer (ISSO) and the file must be verified by the system file integrity tool.'
   impact 0.3
-  tag 'legacy': ['SV-86905', 'V-72281']
-  tag 'severity': 'low'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204608'
-  tag 'rid': 'SV-204608r603261_rule'
-  tag 'stig_id': 'RHEL-07-040600'
-  tag 'fix_id': 'F-4732r89017_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86905', 'V-72281']
+  tag severity: 'low'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204608'
+  tag rid: 'SV-204608r603261_rule'
+  tag stig_id: 'RHEL-07-040600'
+  tag fix_id: 'F-4732r89017_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['dns', 'resolv']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   dns_in_host_line = parse_config_file('/etc/nsswitch.conf',
                                        {
diff --git a/controls/SV-204609.rb b/controls/SV-204609.rb
index a91438278..76c32aca5 100644
--- a/controls/SV-204609.rb
+++ b/controls/SV-204609.rb
@@ -5,36 +5,39 @@
     different path than configured on the router, which can be used to bypass network security measures. This
     requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the
     system is functioning as a router.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system does not accept IPv4 source-routed packets.
-    # grep net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*
-    net.ipv4.conf.all.accept_source_route = 0
-    If " net.ipv4.conf.all.accept_source_route " is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/
-    directory, is commented out, or does not have a value of "0", this is a finding.
-    Check that the operating system implements the accept source route variable with the following command:
-    # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route
-    net.ipv4.conf.all.accept_source_route = 0
-    If the returned line does not have a value of "0", this is a finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter by adding the following
-line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/
+
+     # grep -r net.ipv4.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     net.ipv4.conf.all.accept_source_route = 0
+
+If "net.ipv4.conf.all.accept_source_route" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the accept source route variable with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route
+     net.ipv4.conf.all.accept_source_route = 0
+
+If the returned line does not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter by adding the following
+line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/
 directory (or modify the line to have the required value):
 
     net.ipv4.conf.all.accept_source_route = 0
 
     Issue the following command to make the changes take effect:
 
-    # sysctl -system
-  "
+    # sysctl -system'
   impact 0.5
-  tag 'legacy': ['V-72283', 'SV-86907']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204609'
-  tag 'rid': 'SV-204609r603261_rule'
-  tag 'stig_id': 'RHEL-07-040610'
-  tag 'fix_id': 'F-4733r89020_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72283', 'SV-86907']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204609'
+  tag rid: 'SV-204609r880797_rule'
+  tag stig_id: 'RHEL-07-040610'
+  tag fix_id: 'F-4733r880796_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -45,8 +48,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.conf.all.accept_source_route') do
-      its('value') { should eq 0 }
+    accept_source_route = 0
+    config_file_values = command('grep -r net.ipv4.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.all.accept_source_route' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{accept_source_route} in #{parse_config(result).params.keys[0].split(':')[0]}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(accept_source_route), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.conf.all.accept_source_route' do
+      subject { kernel_parameter('net.ipv4.conf.all.accept_source_route') }
+      its('value') { should eq accept_source_route }
     end
   end
 end
diff --git a/controls/SV-204610.rb b/controls/SV-204610.rb
index b5ed811e5..08c23329d 100644
--- a/controls/SV-204610.rb
+++ b/controls/SV-204610.rb
@@ -1,39 +1,40 @@
 control 'SV-204610' do
   title 'The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when
     possible on all interfaces.'
-  desc 'Enabling reverse path filtering drops packets with source addresses that should not have been able to be
-    received on the interface they were received on. It should not be used on systems which are routers for complicated
-    networks, but is helpful for end hosts and routers serving small networks.'
-  desc 'rationale', ''
+  desc 'Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks, but is helpful for end hosts and routers serving small networks.'
   desc 'check', 'Verify the system uses a reverse-path filter for IPv4:
-    # grep net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d/*
-    net.ipv4.conf.all.rp_filter = 1
-    If "net.ipv4.conf.all.rp_filter" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory,
-    is commented out, or does not have a value of "1", this is a finding.
-    Check that the operating system implements the accept source route variable with the following command:
-    # /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter
-    net.ipv4.conf.all.rp_filter = 1
-    If the returned line does not have a value of "1", this is a finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter by adding the following
-line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/
+
+     # grep -r net.ipv4.conf.all.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     net.ipv4.conf.all.rp_filter = 1
+
+If "net.ipv4.conf.all.rp_filter" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "1", this is a finding.
+
+Check that the operating system implements the accept source route variable with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter
+     net.ipv4.conf.all.rp_filter = 1
+
+If the returned line does not have a value of "1", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter by adding the following
+line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/
 directory (or modify the line to have the required value):
 
     net.ipv4.conf.all.rp_filter = 1
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-92251', 'SV-102353']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204610'
-  tag 'rid': 'SV-204610r603261_rule'
-  tag 'stig_id': 'RHEL-07-040611'
-  tag 'fix_id': 'F-4734r89023_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-92251', 'SV-102353']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204610'
+  tag rid: 'SV-204610r880800_rule'
+  tag stig_id: 'RHEL-07-040611'
+  tag fix_id: 'F-4734r880799_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -44,8 +45,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.conf.all.rp_filter') do
-      its('value') { should eq 1 }
+    rp_filter = 1
+    config_file_values = command('grep -r net.ipv4.conf.all.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.all.rp_filter' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{rp_filter}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(rp_filter), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.conf.all.rp_filter' do
+      subject { kernel_parameter('net.ipv4.conf.all.rp_filter') }
+      its('value') { should eq rp_filter }
     end
   end
 end
diff --git a/controls/SV-204611.rb b/controls/SV-204611.rb
index 5af550680..20637a2c4 100644
--- a/controls/SV-204611.rb
+++ b/controls/SV-204611.rb
@@ -4,36 +4,39 @@
   desc 'Enabling reverse path filtering drops packets with source addresses that should not have been able to be
     received on the interface they were received on. It should not be used on systems which are routers for complicated
     networks, but is helpful for end hosts and routers serving small networks.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system uses a reverse-path filter for IPv4:
-    # grep net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d/*
-    net.ipv4.conf.default.rp_filter = 1
-    If "net.ipv4.conf.default.rp_filter" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/
-    directory, is commented out, or does not have a value of "1", this is a finding.
-    Check that the operating system implements the accept source route variable with the following command:
-    # /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter
-    net.ipv4.conf.default.rp_filter = 1
-    If the returned line does not have a value of "1", this is a finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter by adding the following
-line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/
+
+     # grep -r net.ipv4.conf.default.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     net.ipv4.conf.default.rp_filter = 1
+
+If "net.ipv4.conf.default.rp_filter" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "1", this is a finding.
+
+Check that the operating system implements the accept source route variable with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter
+     net.ipv4.conf.default.rp_filter = 1
+
+If the returned line does not have a value of "1", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter by adding the following
+line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/
 directory (or modify the line to have the required value):
 
     net.ipv4.conf.default.rp_filter = 1
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-92253', 'SV-102355']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204611'
-  tag 'rid': 'SV-204611r603261_rule'
-  tag 'stig_id': 'RHEL-07-040612'
-  tag 'fix_id': 'F-4735r89026_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-92253', 'SV-102355']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204611'
+  tag rid: 'SV-204611r880803_rule'
+  tag stig_id: 'RHEL-07-040612'
+  tag fix_id: 'F-4735r880802_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -44,8 +47,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.conf.default.rp_filter') do
-      its('value') { should eq 1 }
+    rp_filter = 1
+    config_file_values = command('grep -r net.ipv4.conf.default.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.default.rp_filter' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{rp_filter}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(rp_filter), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.conf.default.rp_filter' do
+      subject { kernel_parameter('net.ipv4.conf.default.rp_filter') }
+      its('value') { should eq rp_filter }
     end
   end
 end
diff --git a/controls/SV-204612.rb b/controls/SV-204612.rb
index bacf3d6cf..7d9c604ae 100644
--- a/controls/SV-204612.rb
+++ b/controls/SV-204612.rb
@@ -5,36 +5,39 @@
     different path than configured on the router, which can be used to bypass network security measures. This
     requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the
     system is functioning as a router.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system does not accept IPv4 source-routed packets by default.
-    # grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*
-    net.ipv4.conf.default.accept_source_route = 0
-    If " net.ipv4.conf.default.accept_source_route " is not configured in the /etc/sysctl.conf file or in the
-    /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding.
-    Check that the operating system implements the accept source route variable with the following command:
-    # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route
-    net.ipv4.conf.default.accept_source_route = 0
-    If the returned line does not have a value of "0", this is a finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter by adding the following
-line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/
+
+     # grep -r net.ipv4.conf.default.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     net.ipv4.conf.default.accept_source_route = 0
+
+If  "net.ipv4.conf.default.accept_source_route" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the accept source route variable with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route
+     net.ipv4.conf.default.accept_source_route = 0
+
+If the returned line does not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter by adding the following
+line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/
 directory (or modify the line to have the required value):
 
     net.ipv4.conf.default.accept_source_route = 0
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-72285', 'SV-86909']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204612'
-  tag 'rid': 'SV-204612r603261_rule'
-  tag 'stig_id': 'RHEL-07-040620'
-  tag 'fix_id': 'F-4736r89029_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72285', 'SV-86909']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204612'
+  tag rid: 'SV-204612r880806_rule'
+  tag stig_id: 'RHEL-07-040620'
+  tag fix_id: 'F-4736r880805_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -45,8 +48,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.conf.default.accept_source_route') do
-      its('value') { should eq 0 }
+    accept_source_route = 0
+    config_file_values = command('grep -r net.ipv4.conf.default.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.default.accept_source_route' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{accept_source_route}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(accept_source_route), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.conf.default.accept_source_route' do
+      subject { kernel_parameter('net.ipv4.conf.default.accept_source_route') }
+      its('value') { should eq accept_source_route }
     end
   end
 end
diff --git a/controls/SV-204613.rb b/controls/SV-204613.rb
index fd4f919b8..f4c8cc8f0 100644
--- a/controls/SV-204613.rb
+++ b/controls/SV-204613.rb
@@ -3,35 +3,38 @@
     Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.'
   desc 'Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification
     attacks.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.
-    # grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d/*
-    If " net.ipv4.icmp_echo_ignore_broadcasts" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/
-    directory, is commented out, or does not have a value of "1", this is a finding.
-    Check that the operating system implements the "icmp_echo_ignore_broadcasts" variable with the following command:
-    # /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts
-    net.ipv4.icmp_echo_ignore_broadcasts = 1
-    If the returned line does not have a value of "1", this is a finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter by adding the following
-line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/
+
+     # grep -r net.ipv4.icmp_echo_ignore_broadcasts /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+
+If "net.ipv4.icmp_echo_ignore_broadcasts" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "1", this is a finding.
+
+Check that the operating system implements the "icmp_echo_ignore_broadcasts" variable with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts
+     net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+If the returned line does not have a value of "1", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter by adding the following
+line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/
 directory (or modify the line to have the required value):
 
     net.ipv4.icmp_echo_ignore_broadcasts = 1
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-72287', 'SV-86911']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204613'
-  tag 'rid': 'SV-204613r603261_rule'
-  tag 'stig_id': 'RHEL-07-040630'
-  tag 'fix_id': 'F-4737r89032_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72287', 'SV-86911']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204613'
+  tag rid: 'SV-204613r880809_rule'
+  tag stig_id: 'RHEL-07-040630'
+  tag fix_id: 'F-4737r880808_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -42,8 +45,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
-      its('value') { should eq 1 }
+    icmp_echo_ignore_broadcasts = 1
+    config_file_values = command('grep -r net.ipv4.icmp_echo_ignore_broadcasts /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.icmp_echo_ignore_broadcasts' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{icmp_echo_ignore_broadcasts}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(icmp_echo_ignore_broadcasts), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.icmp_echo_ignore_broadcasts' do
+      subject { kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') }
+      its('value') { should eq icmp_echo_ignore_broadcasts }
     end
   end
 end
diff --git a/controls/SV-204614.rb b/controls/SV-204614.rb
index aa86c6faa..9f7aa0358 100644
--- a/controls/SV-204614.rb
+++ b/controls/SV-204614.rb
@@ -4,35 +4,38 @@
   desc "ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular
     destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message
     could result in a man-in-the-middle attack."
-  desc 'rationale', ''
-  desc 'check', %q(Verify the system will not accept IPv4 ICMP redirect messages.
-    # grep 'net.ipv4.conf.default.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*
-    If " net.ipv4.conf.default.accept_redirects " is not configured in the /etc/sysctl.conf file or in the
-    /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding.
-    Check that the operating system implements the value of the "accept_redirects" variables with the following command:
-    # /sbin/sysctl -a | grep 'net.ipv4.conf.default.accept_redirects'
+  desc 'check', 'Verify the system will not accept IPv4 ICMP redirect messages.
+
+     # grep -r net.ipv4.conf.default.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+
+If "net.ipv4.conf.default.accept_redirects" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the value of the "accept_redirects" variables with the following command:
+
+    # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_redirects
     net.ipv4.conf.default.accept_redirects = 0
-    If the returned line does not have a value of "0", this is a finding.)
-  desc  'fix', "
-    Set the system to not accept IPv4 ICMP redirect messages by adding the
-following line to \"/etc/sysctl.conf\" or a configuration file in the
+
+If the returned line does not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to not accept IPv4 ICMP redirect messages by adding the
+following line to "/etc/sysctl.conf" or a configuration file in the
 /etc/sysctl.d/ directory (or modify the line to have the required value):
 
     net.ipv4.conf.default.accept_redirects = 0
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['SV-86913', 'V-72289']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204614'
-  tag 'rid': 'SV-204614r603261_rule'
-  tag 'stig_id': 'RHEL-07-040640'
-  tag 'fix_id': 'F-4738r89035_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86913', 'V-72289']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204614'
+  tag rid: 'SV-204614r880812_rule'
+  tag stig_id: 'RHEL-07-040640'
+  tag fix_id: 'F-4738r880811_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -43,8 +46,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.conf.default.accept_redirects') do
-      its('value') { should eq 0 }
+    accept_redirects = 0
+    config_file_values = command('grep -r net.ipv4.conf.default.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.default.accept_redirects' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{accept_redirects}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(accept_redirects), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.conf.default.accept_redirects' do
+      subject { kernel_parameter('net.ipv4.conf.default.accept_redirects') }
+      its('value') { should eq accept_redirects }
     end
   end
 end
diff --git a/controls/SV-204615.rb b/controls/SV-204615.rb
index 648daaff0..31ed255b4 100644
--- a/controls/SV-204615.rb
+++ b/controls/SV-204615.rb
@@ -4,35 +4,38 @@
   desc "ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular
     destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message
     could result in a man-in-the-middle attack."
-  desc 'rationale', ''
-  desc 'check', %q(Verify the system ignores IPv4 ICMP redirect messages.
-    # grep 'net.ipv4.conf.all.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/*
-    If " net.ipv4.conf.all.accept_redirects " is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/
-    directory, is commented out, or does not have a value of "0", this is a finding.
-    Check that the operating system implements the "accept_redirects" variables with the following command:
-    # /sbin/sysctl -a | grep 'net.ipv4.conf.all.accept_redirects'
-    net.ipv4.conf.all.accept_redirects = 0
-    If the returned line does not have a value of "0", this is a finding.)
-  desc  'fix', "
-    Set the system to ignore IPv4 ICMP redirect messages by adding the
-following line to \"/etc/sysctl.conf\" or a configuration file in the
+  desc 'check', 'Verify the system ignores IPv4 ICMP redirect messages.
+
+     # grep -r net.ipv4.conf.all.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+
+If "net.ipv4.conf.all.accept_redirects" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the "accept_redirects" variables with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_redirects
+     net.ipv4.conf.all.accept_redirects = 0
+
+If the returned line does not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to ignore IPv4 ICMP redirect messages by adding the
+following line to "/etc/sysctl.conf" or a configuration file in the
 /etc/sysctl.d/ directory (or modify the line to have the required value):
 
     net.ipv4.conf.all.accept_redirects = 0
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['SV-87827', 'V-73175']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204615'
-  tag 'rid': 'SV-204615r603261_rule'
-  tag 'stig_id': 'RHEL-07-040641'
-  tag 'fix_id': 'F-4739r89038_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-87827', 'V-73175']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204615'
+  tag rid: 'SV-204615r880815_rule'
+  tag stig_id: 'RHEL-07-040641'
+  tag fix_id: 'F-4739r880814_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -43,9 +46,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
+    accept_redirects = 0
+    config_file_values = command('grep -r net.ipv4.conf.all.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.all.accept_redirects' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{accept_redirects}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(accept_redirects), incorrect_value_fail_message
+          end
+        end
+      end
+    end
 
-    describe kernel_parameter('net.ipv4.conf.all.accept_redirects') do
-      its('value') { should eq 0 }
+    describe 'The runtime kernel parameter net.ipv4.conf.all.accept_redirects' do
+      subject { kernel_parameter('net.ipv4.conf.all.accept_redirects') }
+      its('value') { should eq accept_redirects }
     end
   end
 end
diff --git a/controls/SV-204616.rb b/controls/SV-204616.rb
index 8633c8c2f..1e934a619 100644
--- a/controls/SV-204616.rb
+++ b/controls/SV-204616.rb
@@ -4,15 +4,20 @@
   desc "ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular
     destination. These messages contain information from the system's route table, possibly revealing portions of the
     network topology."
-  desc 'rationale', ''
-  desc 'check', %q(Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.
-    # grep 'net.ipv4.conf.default.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*
-    If "net.ipv4.conf.default.send_redirects" is not configured in the "/etc/sysctl.conf" file or in the /etc/sysctl.d/
-    directory, is commented out or does not have a value of "0", this is a finding.
-    Check that the operating system implements the "default send_redirects" variables with the following command:
-    # /sbin/sysctl -a | grep 'net.ipv4.conf.default.send_redirects'
-    net.ipv4.conf.default.send_redirects = 0
-    If the returned line does not have a value of "0", this is a finding.)
+  desc 'check', 'Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.
+
+     # grep -r net.ipv4.conf.default.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+
+If "net.ipv4.conf.default.send_redirects" is not configured in the "/etc/sysctl.conf" file or in any of the other sysctl.d directories, is commented out or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the "default send_redirects" variables with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.default.send_redirects
+     net.ipv4.conf.default.send_redirects = 0
+
+If the returned line does not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
   desc 'fix', 'Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default.
     Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a
     configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):
@@ -20,14 +25,14 @@
     Issue the following command to make the changes take effect:
     # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-72291', 'SV-86915']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204616'
-  tag 'rid': 'SV-204616r603261_rule'
-  tag 'stig_id': 'RHEL-07-040650'
-  tag 'fix_id': 'F-4740r89041_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72291', 'SV-86915']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204616'
+  tag rid: 'SV-204616r880818_rule'
+  tag stig_id: 'RHEL-07-040650'
+  tag fix_id: 'F-4740r880817_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -38,9 +43,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
+    send_redirects = 0
+    config_file_values = command('grep -r net.ipv4.conf.default.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.default.send_redirects' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{send_redirects}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(send_redirects), incorrect_value_fail_message
+          end
+        end
+      end
+    end
 
-    describe kernel_parameter('net.ipv4.conf.default.send_redirects') do
-      its('value') { should eq 0 }
+    describe 'The runtime kernel parameter net.ipv4.conf.default.send_redirects' do
+      subject { kernel_parameter('net.ipv4.conf.default.send_redirects') }
+      its('value') { should eq send_redirects }
     end
   end
 end
diff --git a/controls/SV-204617.rb b/controls/SV-204617.rb
index 904f69330..0f9370a08 100644
--- a/controls/SV-204617.rb
+++ b/controls/SV-204617.rb
@@ -4,15 +4,20 @@
   desc "ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular
     destination. These messages contain information from the system's route table, possibly revealing portions of the
     network topology."
-  desc 'rationale', ''
-  desc 'check', %q(Verify the system does not send IPv4 ICMP redirect messages.
-    # grep 'net.ipv4.conf.all.send_redirects' /etc/sysctl.conf /etc/sysctl.d/*
-    If "net.ipv4.conf.all.send_redirects" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/
-    directory, is commented out or does not have a value of "0", this is a finding.
-    Check that the operating system implements the "all send_redirects" variables with the following command:
-    # /sbin/sysctl -a | grep 'net.ipv4.conf.all.send_redirects'
-    net.ipv4.conf.all.send_redirects = 0
-    If the returned line does not have a value of "0", this is a finding.)
+  desc 'check', 'Verify the system does not send IPv4 ICMP redirect messages.
+
+     # grep -r net.ipv4.conf.all.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+
+If "net.ipv4.conf.all.send_redirects" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the "all send_redirects" variables with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.conf.all.send_redirects
+     net.ipv4.conf.all.send_redirects = 0
+
+If the returned line does not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
   desc 'fix', 'Configure the system to not allow interfaces to perform IPv4 ICMP redirects.
     Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a
     configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):
@@ -20,14 +25,14 @@
     Issue the following command to make the changes take effect:
     # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-72293', 'SV-86917']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204617'
-  tag 'rid': 'SV-204617r603261_rule'
-  tag 'stig_id': 'RHEL-07-040660'
-  tag 'fix_id': 'F-4741r89044_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72293', 'SV-86917']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204617'
+  tag rid: 'SV-204617r880821_rule'
+  tag stig_id: 'RHEL-07-040660'
+  tag fix_id: 'F-4741r880820_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv4']
   tag 'host'
@@ -38,9 +43,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
+    send_redirects = 0
+    config_file_values = command('grep -r net.ipv4.conf.all.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.conf.all.send_redirects' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{send_redirects}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(send_redirects), incorrect_value_fail_message
+          end
+        end
+      end
+    end
 
-    describe kernel_parameter('net.ipv4.conf.all.send_redirects') do
-      its('value') { should eq 0 }
+    describe 'The runtime kernel parameter net.ipv4.conf.all.send_redirects' do
+      subject { kernel_parameter('net.ipv4.conf.all.send_redirects') }
+      its('value') { should eq send_redirects }
     end
   end
 end
diff --git a/controls/SV-204618.rb b/controls/SV-204618.rb
index 9a53fccc5..edfd27db1 100644
--- a/controls/SV-204618.rb
+++ b/controls/SV-204618.rb
@@ -6,7 +6,6 @@
     IDs, passwords, and key exchanges between systems.
     If the system is being used to perform a network troubleshooting function, the use of these tools must be documented
     with the Information System Security Officer (ISSO) and restricted to only authorized personnel.'
-  desc 'rationale', ''
   desc 'check', 'Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.
     Check for the status with the following command:
     # ip link | grep -i promisc
@@ -16,17 +15,18 @@
     Set the promiscuous mode of an interface to off with the following command:
     #ip link set dev <devicename> multicast off promisc off'
   impact 0.5
-  tag 'legacy': ['V-72295', 'SV-86919']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204618'
-  tag 'rid': 'SV-204618r603261_rule'
-  tag 'stig_id': 'RHEL-07-040670'
-  tag 'fix_id': 'F-4742r89047_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72295', 'SV-86919']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204618'
+  tag rid: 'SV-204618r603261_rule'
+  tag stig_id: 'RHEL-07-040670'
+  tag fix_id: 'F-4742r89047_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['network', 'ip_link']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe command('ip link | grep -i promisc') do
     its('stdout.strip') { should match(/^$/) }
diff --git a/controls/SV-204619.rb b/controls/SV-204619.rb
index a7fd701fb..20cfd5d45 100644
--- a/controls/SV-204619.rb
+++ b/controls/SV-204619.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.'
   desc 'If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the
     purpose of sending spam or other unauthorized activity.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system is configured to prevent unrestricted mail relaying.
     Determine if "postfix" is installed with the following commands:
     # yum list installed postfix
@@ -18,17 +17,18 @@
     the local network with the following command:
     # postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject')
   impact 0.5
-  tag 'legacy': ['SV-86921', 'V-72297']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204619'
-  tag 'rid': 'SV-204619r603261_rule'
-  tag 'stig_id': 'RHEL-07-040680'
-  tag 'fix_id': 'F-4743r89050_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86921', 'V-72297']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204619'
+  tag rid: 'SV-204619r603261_rule'
+  tag stig_id: 'RHEL-07-040680'
+  tag fix_id: 'F-4743r89050_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['postfix']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if package('postfix').installed?
     options = { assignment_regex: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/ }
diff --git a/controls/SV-204620.rb b/controls/SV-204620.rb
index 403382278..316d48271 100644
--- a/controls/SV-204620.rb
+++ b/controls/SV-204620.rb
@@ -5,7 +5,6 @@
     integrity of user passwords or the remote session. If a privileged user were to log on using this service, the
     privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of
     this service.'
-  desc 'rationale', ''
   desc 'check', 'Verify an FTP server has not been installed on the system.
     Check to see if an FTP server has been installed with the following commands:
     # yum list installed vsftpd
@@ -16,17 +15,18 @@
     with the following command:
     # yum remove vsftpd'
   impact 0.7
-  tag 'legacy': ['SV-86923', 'V-72299']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204620'
-  tag 'rid': 'SV-204620r603261_rule'
-  tag 'stig_id': 'RHEL-07-040690'
-  tag 'fix_id': 'F-4744r89053_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86923', 'V-72299']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204620'
+  tag rid: 'SV-204620r603261_rule'
+  tag stig_id: 'RHEL-07-040690'
+  tag fix_id: 'F-4744r89053_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['vsftpd']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe.one do
     describe package('vsftpd') do
diff --git a/controls/SV-204621.rb b/controls/SV-204621.rb
index 1ee595363..5ecc96383 100644
--- a/controls/SV-204621.rb
+++ b/controls/SV-204621.rb
@@ -4,7 +4,6 @@
   desc 'If TFTP is required for operational support (such as the transmission of router configurations) its use must
     be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have
     access control rules established.'
-  desc 'rationale', ''
   desc 'check', 'Verify a TFTP server has not been installed on the system.
     Check to see if a TFTP server has been installed with the following command:
     # yum list installed tftp-server
@@ -13,18 +12,18 @@
   desc 'fix', 'Remove the TFTP package from the system with the following command:
     # yum remove tftp-server'
   impact 0.7
-  tag 'legacy': ['SV-86925', 'V-72301']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204621'
-  tag 'rid': 'SV-204621r603261_rule'
-  tag 'stig_id': 'RHEL-07-040700'
-  tag 'fix_id': 'F-4745r89056_fix'
-  tag 'cci': ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813',
-              'CCI-001814']
-  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1)']
+  tag legacy: ['SV-86925', 'V-72301']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204621'
+  tag rid: 'SV-204621r853996_rule'
+  tag stig_id: 'RHEL-07-040700'
+  tag fix_id: 'F-4745r89056_fix'
+  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']
+  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']
   tag subsystems: ['tftp']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe package('tftp-server') do
     it { should_not be_installed }
diff --git a/controls/SV-204622.rb b/controls/SV-204622.rb
index 96a1f53e5..d87dfaa82 100644
--- a/controls/SV-204622.rb
+++ b/controls/SV-204622.rb
@@ -11,7 +11,6 @@
     enabled.
     If X11 services are not required for the system's intended function, they should be disabled or restricted as
     appropriate to the system’s needs."
-  desc 'rationale', ''
   desc 'check', 'Determine if X11Forwarding is disabled with the following command:
     # grep -i x11forwarding /etc/ssh/sshd_config | grep -v "^#"
     X11Forwarding no
@@ -24,14 +23,14 @@
     The SSH service must be restarted for changes to take effect:
     # systemctl restart sshd'
   impact 0.5
-  tag 'legacy': ['SV-86927', 'V-72303']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204622'
-  tag 'rid': 'SV-204622r603849_rule'
-  tag 'stig_id': 'RHEL-07-040710'
-  tag 'fix_id': 'F-4746r622312_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86927', 'V-72303']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204622'
+  tag rid: 'SV-204622r603849_rule'
+  tag stig_id: 'RHEL-07-040710'
+  tag fix_id: 'F-4746r622312_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['ssh']
   tag 'host'
diff --git a/controls/SV-204623.rb b/controls/SV-204623.rb
index 4b205c707..1f409d7d2 100644
--- a/controls/SV-204623.rb
+++ b/controls/SV-204623.rb
@@ -3,7 +3,6 @@
     Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.'
   desc 'Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting
     system files.'
-  desc 'rationale', ''
   desc 'check', 'Verify the TFTP daemon is configured to operate in secure mode.
     Check to see if a TFTP server has been installed with the following commands:
     # yum list installed tftp-server
@@ -16,17 +15,19 @@
   desc 'fix', 'Configure the TFTP daemon to operate in secure mode by adding the following line to
     "/etc/xinetd.d/tftp" (or modify the line to have the required value):
     server_args = -s /var/lib/tftpboot'
-  tag 'legacy': ['SV-86929', 'V-72305']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204623'
-  tag 'rid': 'SV-204623r603261_rule'
-  tag 'stig_id': 'RHEL-07-040720'
-  tag 'fix_id': 'F-4747r89062_fix'
-  tag 'cci': ['CCI-000366']
+  impact 0.5
+  tag legacy: ['SV-86929', 'V-72305']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204623'
+  tag rid: 'SV-204623r603261_rule'
+  tag stig_id: 'RHEL-07-040720'
+  tag fix_id: 'F-4747r89062_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['tftp']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if package('tftp-server').installed?
     impact 0.5
diff --git a/controls/SV-204624.rb b/controls/SV-204624.rb
index 97d265727..1cda4efd9 100644
--- a/controls/SV-204624.rb
+++ b/controls/SV-204624.rb
@@ -4,7 +4,6 @@
   desc 'Internet services that are not required for system or application processes must not be active to decrease
     the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and
     must not be used unless approved and documented.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system is configured to boot to the command line:
     $ systemctl get-default
     multi-user.target
@@ -13,8 +12,7 @@
     Verify a graphical user interface is not installed:
     $ rpm -qa | grep xorg | grep server
     Ask the System Administrator if use of a graphical user interface is an operational requirement.
-    If the use of a graphical user interface on the system is not documented with the ISSO, this is a finding.
-    '
+    If the use of a graphical user interface on the system is not documented with the ISSO, this is a finding.'
   desc 'fix', 'Document the requirement for a graphical user interface with the ISSO or reinstall the operating
     system without the graphical user interface. If reinstallation is not feasible, then continue with the following
     procedure:
@@ -23,14 +21,14 @@
     $ sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils
     A reboot is required for the changes to take effect.'
   impact 0.5
-  tag 'legacy': ['SV-86931', 'V-72307']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204624'
-  tag 'rid': 'SV-204624r646847_rule'
-  tag 'stig_id': 'RHEL-07-040730'
-  tag 'fix_id': 'F-36316r646846_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86931', 'V-72307']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204624'
+  tag rid: 'SV-204624r646847_rule'
+  tag stig_id: 'RHEL-07-040730'
+  tag fix_id: 'F-36316r646846_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['gui']
   tag 'host'
@@ -40,7 +38,7 @@
     describe 'Control not applicable to a container' do
       skip 'Control not applicable to a container'
     end
-  elsif input('x11-enabled')
+  elsif input('x11_enabled')
     describe 'System default target' do
       subject { command('systemctl get-default').stdout.strip }
       it { should eq 'multi-user.target' }
diff --git a/controls/SV-204625.rb b/controls/SV-204625.rb
index 3bff5e070..0563f6351 100644
--- a/controls/SV-204625.rb
+++ b/controls/SV-204625.rb
@@ -4,37 +4,39 @@
   desc 'Routing protocol daemons are typically used on routers to exchange network topology information with other
     routers. If this software is used when not required, system network information may be unnecessarily transmitted
     across the network.'
-  desc 'rationale', ''
   desc 'check', 'Verify the system is not performing packet forwarding, unless the system is a router.
-    # grep net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d/*
-    net.ipv4.ip_forward = 0
-    If "net.ipv4.ip_forward" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is
-    commented out, or does not have a value of "0", this is a finding.
-    Check that the operating system does not implement IP forwarding using the following command:
-    # /sbin/sysctl -a | grep net.ipv4.ip_forward
-    net.ipv4.ip_forward = 0
-    If IP forwarding value is "1" and the system is hosting any application, database, or web servers, this is a
-    finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter by adding the following
-line to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/
+
+     # grep -r net.ipv4.ip_forward /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     net.ipv4.ip_forward = 0
+
+If "net.ipv4.ip_forward" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "0", this is a finding.
+
+Check that the operating system does not implement IP forwarding using the following command:
+
+     # /sbin/sysctl -a | grep net.ipv4.ip_forward
+     net.ipv4.ip_forward = 0
+
+If IP forwarding value is "1" and the system is hosting any application, database, or web servers, this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter by adding the following
+line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/
 directory (or modify the line to have the required value):
 
     net.ipv4.ip_forward = 0
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['SV-86933', 'V-72309']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204625'
-  tag 'rid': 'SV-204625r603261_rule'
-  tag 'stig_id': 'RHEL-07-040740'
-  tag 'fix_id': 'F-4749r89068_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86933', 'V-72309']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204625'
+  tag rid: 'SV-204625r880824_rule'
+  tag stig_id: 'RHEL-07-040740'
+  tag fix_id: 'F-4749r880823_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter']
   tag 'host'
@@ -45,8 +47,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
-    describe kernel_parameter('net.ipv4.ip_forward') do
-      its('value') { should eq 0 }
+    ip_forward = 0
+    config_file_values = command('grep -r net.ipv4.ip_forward /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv4.ip_forward' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{ip_forward}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(ip_forward), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter net.ipv4.ip_forward' do
+      subject { kernel_parameter('net.ipv4.ip_forward') }
+      its('value') { should eq ip_forward }
     end
   end
 end
diff --git a/controls/SV-204626.rb b/controls/SV-204626.rb
index ebbd7b09d..2a95be7f0 100644
--- a/controls/SV-204626.rb
+++ b/controls/SV-204626.rb
@@ -5,7 +5,6 @@
     requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The
     RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate
     the remote mount request.'
-  desc 'rationale', ''
   desc 'check', 'Verify "AUTH_GSS" is being used to authenticate NFS mounts.
     To check if the system is importing an NFS file system, look for any entries in the "/etc/fstab" file that have a
     file system type of "nfs" with the following command:
@@ -17,17 +16,18 @@
     "sec" option does not have the "sys" setting.
     Ensure the "sec" option is defined as "krb5:krb5i:krb5p".'
   impact 0.5
-  tag 'legacy': ['SV-86935', 'V-72311']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204626'
-  tag 'rid': 'SV-204626r603261_rule'
-  tag 'stig_id': 'RHEL-07-040750'
-  tag 'fix_id': 'F-4750r89071_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86935', 'V-72311']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204626'
+  tag rid: 'SV-204626r603261_rule'
+  tag stig_id: 'RHEL-07-040750'
+  tag fix_id: 'F-4750r89071_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['nfs', 'etc_fstab']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   nfs_systems = etc_fstab.nfs_file_systems.entries
   if !nfs_systems.nil? and !nfs_systems.empty?
diff --git a/controls/SV-204627.rb b/controls/SV-204627.rb
index 2b53913df..fb5b84e64 100644
--- a/controls/SV-204627.rb
+++ b/controls/SV-204627.rb
@@ -5,7 +5,6 @@
     system and the network and use the information to potentially compromise the integrity of the system or network(s).
     It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the
     version 2 community strings.'
-  desc 'rationale', ''
   desc 'check', 'Verify that a system using SNMP is not using default community strings.
     Check to see if the "/etc/snmp/snmpd.conf" file exists with the following command:
     # ls -al /etc/snmp/snmpd.conf
@@ -17,18 +16,19 @@
     If either of these commands returns any output, this is a finding.'
   desc 'fix', 'If the "/etc/snmp/snmpd.conf" file exists, modify any lines that contain a community string value of
     "public" or "private" to another string value.'
-
-  tag 'legacy': ['SV-86937', 'V-72313']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204627'
-  tag 'rid': 'SV-204627r603261_rule'
-  tag 'stig_id': 'RHEL-07-040800'
-  tag 'fix_id': 'F-4751r89074_fix'
-  tag 'cci': ['CCI-000366']
+  impact 0.7
+  tag legacy: ['SV-86937', 'V-72313']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204627'
+  tag rid: 'SV-204627r603261_rule'
+  tag stig_id: 'RHEL-07-040800'
+  tag fix_id: 'F-4751r89074_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['snmp']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if file('/etc/snmp/snmpd.conf').exist?
     impact 0.7
diff --git a/controls/SV-204628.rb b/controls/SV-204628.rb
index 7714129e6..613d770d2 100644
--- a/controls/SV-204628.rb
+++ b/controls/SV-204628.rb
@@ -3,8 +3,7 @@
     system access to specific hosts and services.'
   desc 'If the systems access control program is not configured with appropriate rules for allowing and denying
     access to system network resources, services may be accessible to unauthorized hosts.'
-  desc 'rationale', ''
-  desc 'check', %q{If the "firewalld" package is not installed, ask the System Administrator (SA) if another firewall
+  desc 'check', %q(If the "firewalld" package is not installed, ask the System Administrator (SA) if another firewall
     application (such as iptables) is installed. If an application firewall is not installed, this is a finding.
     Verify the system's access control program is configured to grant or deny system access to specific hosts.
     Check to see if "firewalld" is active with the following command:
@@ -38,23 +37,24 @@
     program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or
     denies access to specific hosts or services.
     If "firewalld" is active and is not configured to grant access to specific hosts or "tcpwrappers" is not configured
-    to grant or deny access to specific hosts, this is a finding.}
+    to grant or deny access to specific hosts, this is a finding.)
   desc 'fix', 'If "firewalld" is installed and active on the system, configure rules for allowing specific services
     and hosts.
     If "firewalld" is not "active", enable "tcpwrappers" by configuring "/etc/hosts.allow" and "/etc/hosts.deny" to
     allow or deny access to specific hosts.'
   impact 0.5
-  tag 'legacy': ['SV-86939', 'V-72315']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204628'
-  tag 'rid': 'SV-204628r603261_rule'
-  tag 'stig_id': 'RHEL-07-040810'
-  tag 'fix_id': 'F-4752r89077_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['SV-86939', 'V-72315']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204628'
+  tag rid: 'SV-204628r603261_rule'
+  tag stig_id: 'RHEL-07-040810'
+  tag fix_id: 'F-4752r89077_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['iptables', 'firewall']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if input('firewall_application_package') != ''
     describe 'Manual review of third-party firewall needed' do
diff --git a/controls/SV-204629.rb b/controls/SV-204629.rb
index 489a3da4a..0603aa927 100644
--- a/controls/SV-204629.rb
+++ b/controls/SV-204629.rb
@@ -2,7 +2,6 @@
   title 'The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.'
   desc 'IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be
     documented with the Information System Security Officer (ISSO).'
-  desc 'rationale', ''
   desc 'check', 'Verify the system does not have unauthorized IP tunnels configured.
     Check to see if "libreswan" is installed with the following command:
     # yum list installed libreswan
@@ -19,17 +18,19 @@
     tunnel is documented with the ISSO.
     If "libreswan" is installed, "IPsec" is active, and an undocumented tunnel is active, this is a finding.'
   desc 'fix', 'Remove all unapproved tunnels from the system, or document them with the ISSO.'
-  tag 'legacy': ['V-72317', 'SV-86941']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204629'
-  tag 'rid': 'SV-204629r603261_rule'
-  tag 'stig_id': 'RHEL-07-040820'
-  tag 'fix_id': 'F-4753r89080_fix'
-  tag 'cci': ['CCI-000366']
+  impact 0.5
+  tag legacy: ['V-72317', 'SV-86941']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204629'
+  tag rid: 'SV-204629r603261_rule'
+  tag stig_id: 'RHEL-07-040820'
+  tag fix_id: 'F-4753r89080_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['libreswan', 'ipsec']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   approved_tunnels = input('approved_tunnels')
 
diff --git a/controls/SV-204630.rb b/controls/SV-204630.rb
index 0db3c9d92..0bfdef83b 100644
--- a/controls/SV-204630.rb
+++ b/controls/SV-204630.rb
@@ -4,40 +4,45 @@
     different path than configured on the router, which can be used to bypass network security measures. This
     requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the
     system is functioning as a router.'
-  desc 'rationale', ''
   desc 'check', 'If IPv6 is not enabled, the key will not exist, and this is Not Applicable.
-    Verify the system does not accept IPv6 source-routed packets.
-    # grep net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/*
-    net.ipv6.conf.all.accept_source_route = 0
-    If "net.ipv6.conf.all.accept_source_route" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/
-    directory, is commented out or does not have a value of "0", this is a finding.
-    Check that the operating system implements the accept source route variable with the following command:
-    # /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route
-    net.ipv6.conf.all.accept_source_route = 0
-    If the returned lines do not have a value of "0", this is a finding.'
-  desc  'fix', "
-    Set the system to the required kernel parameter, if IPv6 is enabled, by
-adding the following line to \"/etc/sysctl.conf\" or a configuration file in
+
+Verify the system does not accept IPv6 source-routed packets.
+
+     # grep -r net.ipv6.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     net.ipv6.conf.all.accept_source_route = 0
+
+If "net.ipv6.conf.all.accept_source_route" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of "0", this is a finding.
+
+Check that the operating system implements the accept source route variable with the following command:
+
+     # /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route
+     net.ipv6.conf.all.accept_source_route = 0
+
+If the returned lines do not have a value of "0", this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Set the system to the required kernel parameter, if IPv6 is enabled, by
+adding the following line to "/etc/sysctl.conf" or a configuration file in
 the /etc/sysctl.d/ directory (or modify the line to have the required value):
 
     net.ipv6.conf.all.accept_source_route = 0
 
     Issue the following command to make the changes take effect:
 
-    # sysctl --system
-  "
+    # sysctl --system'
   impact 0.5
-  tag 'legacy': ['V-72319', 'SV-86943']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-204630'
-  tag 'rid': 'SV-204630r603261_rule'
-  tag 'stig_id': 'RHEL-07-040830'
-  tag 'fix_id': 'F-4754r89083_fix'
-  tag 'cci': ['CCI-000366']
+  tag legacy: ['V-72319', 'SV-86943']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-204630'
+  tag rid: 'SV-204630r880827_rule'
+  tag stig_id: 'RHEL-07-040830'
+  tag fix_id: 'F-4754r880826_fix'
+  tag cci: ['CCI-000366']
   tag nist: ['CM-6 b']
   tag subsystems: ['kernel_parameter', 'ipv6']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if virtualization.system.eql?('docker')
     impact 0.0
@@ -45,9 +50,23 @@
       skip 'Control not applicable - Kernel config must be done on the host'
     end
   else
+    accept_source_route = 0
+    config_file_values = command('grep -r net.ipv6.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'net.ipv6.conf.all.accept_source_route' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{accept_source_route}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(accept_source_route), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
     describe.one do
       describe kernel_parameter('net.ipv6.conf.all.accept_source_route') do
-        its('value') { should eq 0 }
+        its('value') { should eq accept_source_route }
       end
       # If IPv6 is disabled in the kernel it will return NIL
       describe kernel_parameter('net.ipv6.conf.all.accept_source_route') do
diff --git a/controls/SV-204631.rb b/controls/SV-204631.rb
index df3b6fe41..a40e42a9c 100644
--- a/controls/SV-204631.rb
+++ b/controls/SV-204631.rb
@@ -1,7 +1,6 @@
 control 'SV-204631' do
   title 'The Red Hat Enterprise Linux operating system must have the required packages for multifactor
     authentication installed.'
-
   desc 'Using an authentication device, such as a CAC or token that is separate from the information system, ensures
     that even if the information system is compromised, that compromise will not affect credentials stored on the
     authentication device.
@@ -15,32 +14,26 @@
     This requirement only applies to components where this is specific to the function of the device or has the concept
     of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of
     configuring the device itself (management).'
-
   desc 'check', 'Verify the operating system has the packages required for multifactor authentication installed.
     Check for the presence of the packages required to support multifactor authentication with the following commands:
     # yum list installed pam_pkcs11
     pam_pkcs11-0.6.2-14.el7.noarch.rpm
     If the "pam_pkcs11" package is not installed, this is a finding.'
+  desc 'fix', 'Configure the operating system to implement multifactor authentication by installing the required packages.
 
-  desc 'fix', "
-        Configure the operating system to implement multifactor authentication by
-        installing the required packages.
-
-        Install the \"esc\" and \"pam_pkcs11\" packages on the system with the
-        following command:
-
-        # yum install esc pam_pkcs11"
+Install the pam_pkcs11 package with the following command:
 
-  tag 'legacy': ['SV-87041', 'V-72417']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000375-GPOS-00160'
-  tag 'satisfies': ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161',
-                    'SRG-OS-000375-GPOS-00162']
-  tag 'gid': 'V-204631'
-  tag 'rid': 'SV-204631r603261_rule'
-  tag 'stig_id': 'RHEL-07-041001'
-  tag 'fix_id': 'F-4755r462473_fix'
-  tag 'cci': ['CCI-001948', 'CCI-001953', 'CCI-001954']
+# yum install pam_pkcs11'
+  impact 0.5
+  tag legacy: ['SV-87041', 'V-72417']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000375-GPOS-00160'
+  tag satisfies: ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']
+  tag gid: 'V-204631'
+  tag rid: 'SV-204631r853997_rule'
+  tag stig_id: 'RHEL-07-041001'
+  tag fix_id: 'F-4755r462473_fix'
+  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']
   tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']
   tag subsystems: ['MFA', 'smartcard']
   tag 'host'
@@ -58,16 +51,16 @@
     if smart_card_status.eql?('disabled')
       impact 0.5
       describe 'The system is not smartcard enabled thus this control is Not Applicable' do
-        skip 'The system is not using Smartcards / PIVs to fulfil the MFA requirement, this control is Not Applicable.'
+        skip 'The system is not using Smartcards / PIVs to fulfill the MFA requirement, this control is Not Applicable.'
       end
     elsif mfa_pkg_list.empty?
-      describe 'The required Smartcard packages have not beed defined, plese define them in your `inputs`.' do
+      describe 'The required Smartcard packages have not been defined, please define them in your `inputs`' do
         subject { mfa_pkg_list }
         it { should_not be_empty }
       end
     else
       mfa_pkg_list.each do |pkg|
-        describe 'The package' do
+        describe "As required for MFA, the package '#{pkg}'" do
           subject { package(pkg.to_s) }
           it { should be_installed }
         end
diff --git a/controls/SV-204632.rb b/controls/SV-204632.rb
index 81ab4d1cf..be1e1dfa3 100644
--- a/controls/SV-204632.rb
+++ b/controls/SV-204632.rb
@@ -14,7 +14,6 @@
     This requirement only applies to components where this is specific to the function of the device or has the concept
     of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of
     configuring the device itself (management).'
-  desc 'rationale', ''
   desc 'check', 'Verify the operating system implements multifactor authentication for remote access to privileged
     accounts via pluggable authentication modules (PAM).
     Check the "/etc/sssd/sssd.conf" file for the authentication services that are being used with the following command:
@@ -25,18 +24,16 @@
     accounts via pluggable authentication modules (PAM).
     Modify all of the services lines in "/etc/sssd/sssd.conf" or in configuration files found under "/etc/sssd/conf.d"
     to include pam.'
-
   impact 0.5
-  tag 'legacy': ['V-72427', 'SV-87051']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000375-GPOS-00160'
-  tag 'satisfies': ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161',
-                    'SRG-OS-000375-GPOS-00162']
-  tag 'gid': 'V-204632'
-  tag 'rid': 'SV-204632r603261_rule'
-  tag 'stig_id': 'RHEL-07-041002'
-  tag 'fix_id': 'F-4756r89089_fix'
-  tag 'cci': ['CCI-001948', 'CCI-001953', 'CCI-001954']
+  tag legacy: ['V-72427', 'SV-87051']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000375-GPOS-00160'
+  tag satisfies: ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']
+  tag gid: 'V-204632'
+  tag rid: 'SV-204632r853998_rule'
+  tag stig_id: 'RHEL-07-041002'
+  tag fix_id: 'F-4756r89089_fix'
+  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']
   tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']
   tag subsystems: ['sssd']
   tag 'host'
diff --git a/controls/SV-204633.rb b/controls/SV-204633.rb
index 9585fe671..058f23503 100644
--- a/controls/SV-204633.rb
+++ b/controls/SV-204633.rb
@@ -14,15 +14,13 @@
     This requirement only applies to components where this is specific to the function of the device or has the concept
     of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of
     configuring the device itself (management).'
-  desc  'rationale', ''
-  desc  'check', "
-    Verify the operating system implements certificate status checking for PKI
+  desc 'check', 'Verify the operating system implements certificate status checking for PKI
 authentication.
 
     Check to see if Online Certificate Status Protocol (OCSP) is enabled on the
 system with the following command:
 
-    # grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \"^#\"
+    # grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v "^#"
 
     cert_policy = ca, ocsp_on, signature;
     cert_policy = ca, ocsp_on, signature;
@@ -30,25 +28,23 @@
 
     There should be at least three lines returned.
 
-    If \"ocsp_on\" is not present in all uncommented \"cert_policy\" lines in
-\"/etc/pam_pkcs11/pam_pkcs11.conf\", this is a finding.
-  "
-  desc 'fix', "
-    Configure the operating system to do certificate status checking for PKI
+    If "ocsp_on" is not present in all uncommented "cert_policy" lines in
+"/etc/pam_pkcs11/pam_pkcs11.conf", this is a finding.'
+  desc 'fix', 'Configure the operating system to do certificate status checking for PKI
 authentication.
 
-    Modify all of the \"cert_policy\" lines in
-\"/etc/pam_pkcs11/pam_pkcs11.conf\" to include \"ocsp_on\".
-  "
-  tag 'legacy': ['V-72433', 'SV-87057']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000375-GPOS-00160'
-  tag 'satisfies': ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']
-  tag 'gid': 'V-204633'
-  tag 'rid': 'SV-204633r603261_rule'
-  tag 'stig_id': 'RHEL-07-041003'
-  tag 'fix_id': 'F-4757r89092_fix'
-  tag 'cci': ['CCI-001948', 'CCI-001953', 'CCI-001954']
+    Modify all of the "cert_policy" lines in
+"/etc/pam_pkcs11/pam_pkcs11.conf" to include "ocsp_on".'
+  impact 0.5
+  tag legacy: ['V-72433', 'SV-87057']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000375-GPOS-00160'
+  tag satisfies: ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']
+  tag gid: 'V-204633'
+  tag rid: 'SV-204633r853999_rule'
+  tag stig_id: 'RHEL-07-041003'
+  tag fix_id: 'F-4757r89092_fix'
+  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']
   tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']
   tag subsystems: ['pam_pkcs11', 'pam', 'pkcs11']
   tag 'host'
diff --git a/controls/SV-204634.rb b/controls/SV-204634.rb
index 09426b9c1..185d0c52e 100644
--- a/controls/SV-204634.rb
+++ b/controls/SV-204634.rb
@@ -6,7 +6,6 @@
     access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor
     and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to
     create a denial of service to valid network resources."
-  desc 'rationale', ''
   desc 'check', 'Verify that there are no wireless interfaces configured on the system.
     This is N/A for systems that do not have wireless network adapters.
     Check for the presence of active wireless interfaces with the following command:
@@ -20,17 +19,18 @@
   desc 'fix', 'Configure the system to disable all wireless network interfaces with the following command:
     #nmcli radio wifi off'
   impact 0.5
-  tag 'legacy': ['V-73177', 'SV-87829']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000424-GPOS-00188'
-  tag 'gid': 'V-204634'
-  tag 'rid': 'SV-204634r603261_rule'
-  tag 'stig_id': 'RHEL-07-041010'
-  tag 'fix_id': 'F-4758r89095_fix'
-  tag 'cci': ['CCI-001443', 'CCI-001444', 'CCI-002418']
+  tag legacy: ['V-73177', 'SV-87829']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000424-GPOS-00188'
+  tag gid: 'V-204634'
+  tag rid: 'SV-204634r877465_rule'
+  tag stig_id: 'RHEL-07-041010'
+  tag fix_id: 'F-4758r89095_fix'
+  tag cci: ['CCI-001443', 'CCI-001444', 'CCI-002418']
   tag nist: ['AC-18 (1)', 'AC-18 (1)', 'SC-8']
   tag subsystems: ['network', 'wifi', 'nmcli']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe command('nmcli device') do
     its('stdout.strip') { should_not match(/wifi connected/) }
diff --git a/controls/SV-214799.rb b/controls/SV-214799.rb
index 1c55adf87..69f7505a3 100644
--- a/controls/SV-214799.rb
+++ b/controls/SV-214799.rb
@@ -6,15 +6,13 @@
     Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash
     functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while
     maintaining the confidentiality of the key used to generate the hash.'
-  desc 'rationale', ''
-  desc 'check', %q{Verify the cryptographic hash of system files and commands match the vendor values.
+  desc 'check', %q(Verify the cryptographic hash of system files and commands match the vendor values.
     Check the cryptographic hash of system files and commands with the following command:
     Note: System configuration files (indicated by a "c" in the second column) are expected to change over time. Unusual
     modifications should be investigated through the system audit log.
     # rpm -Va --noconfig | grep '^..5'
-    If there is any output from the command for system files or binaries, this is a finding.}
-  desc  'fix', "
-    Run the following command to determine which package owns the file:
+    If there is any output from the command for system files or binaries, this is a finding.)
+  desc 'fix', 'Run the following command to determine which package owns the file:
 
     # rpm -qf <filename>
 
@@ -25,20 +23,20 @@
     Alternatively, the package can be reinstalled from trusted media using the
 command:
 
-    # sudo rpm -Uvh <packagename>
-  "
+    # sudo rpm -Uvh <packagename>'
   impact 0.7
-  tag 'legacy': ['SV-86479', 'V-71855']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-214799'
-  tag 'rid': 'SV-214799r603261_rule'
-  tag 'stig_id': 'RHEL-07-010020'
-  tag 'fix_id': 'F-15997r192363_fix'
-  tag 'cci': ['CCI-001749']
+  tag legacy: ['SV-86479', 'V-71855']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-214799'
+  tag rid: 'SV-214799r854001_rule'
+  tag stig_id: 'RHEL-07-010020'
+  tag fix_id: 'F-15997r192363_fix'
+  tag cci: ['CCI-001749']
   tag nist: ['CM-5 (3)']
   tag subsystems: ['rpm', 'package']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if input('disable_slow_controls')
     describe "This control consistently takes a long to run and has been disabled
diff --git a/controls/SV-214800.rb b/controls/SV-214800.rb
index d5303a193..2ecfa79fd 100644
--- a/controls/SV-214800.rb
+++ b/controls/SV-214800.rb
@@ -5,7 +5,6 @@
     malicious behavior, which can provide additional agility in reacting to network threats. These tools also often
     include a reporting capability to provide network awareness of the system, which may not otherwise exist in an
     organization's systems management regime."
-  desc 'rationale', ''
   desc 'check', 'Per OPORD 16-0080, the preferred endpoint security tool is McAfee Endpoint Security for Linux (ENSL)
     in conjunction with SELinux.
     Procedure:
@@ -17,17 +16,18 @@
     If the daemon is not running, this is a finding.'
   desc 'fix', 'Install and enable the latest McAfee ENSLTP package.'
   impact 0.5
-  tag 'legacy': ['V-92255', 'SV-102357']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-214800'
-  tag 'rid': 'SV-214800r754751_rule'
-  tag 'stig_id': 'RHEL-07-020019'
-  tag 'fix_id': 'F-36317r754750_fix'
-  tag 'cci': ['CCI-001263']
-  tag nist: ['SI-4 (5)']
+  tag legacy: ['V-92255', 'SV-102357']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-214800'
+  tag rid: 'SV-214800r854323_rule'
+  tag stig_id: 'RHEL-07-020019'
+  tag fix_id: 'F-36317r754750_fix'
+  tag cci: ['CCI-001263', 'CCI-000366']
+  tag nist: ['SI-4 (5)', 'CM-6 b']
   tag subsystems: ['endpoint_security']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   describe package('mcafeetp') do
     it { should be_installed }
diff --git a/controls/SV-214801.rb b/controls/SV-214801.rb
index edb78c02c..7c632bc12 100644
--- a/controls/SV-214801.rb
+++ b/controls/SV-214801.rb
@@ -6,23 +6,23 @@
     is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily
     basis.
     If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.'
-  tag  'rationale': ''
   desc 'check', 'Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled
     with an approved host-based security solution.
     If there is no anti-virus solution installed on the system, this is a finding.'
   desc 'fix', 'Install an antivirus solution on the system.'
   impact 0.7
-  tag 'legacy': ['V-72213', 'SV-86837']
-  tag 'severity': 'high'
-  tag 'gtitle': 'SRG-OS-000480-GPOS-00227'
-  tag 'gid': 'V-214801'
-  tag 'rid': 'SV-214801r603261_rule'
-  tag 'stig_id': 'RHEL-07-032000'
-  tag 'fix_id': 'F-15999r192369_fix'
-  tag 'cci': ['CCI-001668']
-  tag nist: ['SI-3 a']
+  tag legacy: ['V-72213', 'SV-86837']
+  tag severity: 'high'
+  tag gtitle: 'SRG-OS-000480-GPOS-00227'
+  tag gid: 'V-214801'
+  tag rid: 'SV-214801r854324_rule'
+  tag stig_id: 'RHEL-07-032000'
+  tag fix_id: 'F-15999r192369_fix'
+  tag cci: ['CCI-001668', 'CCI-000366']
+  tag nist: ['SI-3 a', 'CM-6 b']
   tag subsystems: ['clamav', 'nails', 'virus_scan']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   custom_antivirus = input('custom_antivirus')
 
diff --git a/controls/SV-214937.rb b/controls/SV-214937.rb
index fca96ff8b..27ae8d8c4 100644
--- a/controls/SV-214937.rb
+++ b/controls/SV-214937.rb
@@ -7,21 +7,22 @@
     The ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to
     disengage the graphical user interface session lock provides the assurance that all sessions will lock after the
     specified period of time.'
-  desc 'rationale', ''
-  desc 'check', 'Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for
-    the graphical user interface.
-    Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be
-    installed to lock sessions on the console.
-    Determine which profile the system database is using with the following command:
-    # grep system-db /etc/dconf/profile/user
-    system-db:local
-    Check for the lock-enabled setting with the following command:
-    Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This
-    path must be modified if a database other than "local" is being used.
-    # grep -i lock-enabled /etc/dconf/db/local.d/locks/*
-    /org/gnome/desktop/screensaver/lock-enabled
-    If the command does not return a result, this is a finding.
-    '
+  desc 'check', 'Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface.
+
+Note: If the system does not have GNOME installed, this requirement is Not Applicable.
+
+Determine which profile the system database is using with the following command:
+     # grep system-db /etc/dconf/profile/user
+     system-db:local
+
+Check for the lock-enabled setting with the following command:
+
+Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.
+
+     # grep -i lock-enabled /etc/dconf/db/local.d/locks/*
+     /org/gnome/desktop/screensaver/lock-enabled
+
+If the command does not return a result, this is a finding.'
   desc 'fix', 'Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute
     period of inactivity for graphical user interfaces.
     Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following
@@ -30,17 +31,16 @@
     "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory.
     # touch /etc/dconf/db/local.d/locks/session
     Add the setting to lock the screensaver lock-enabled setting:
-    /org/gnome/desktop/screensaver/lock-enabled
-    '
+    /org/gnome/desktop/screensaver/lock-enabled'
   impact 0.5
-  tag 'legacy': ['V-78995', 'SV-93701']
-  tag 'severity': 'medium'
-  tag 'gtitle': 'SRG-OS-000029-GPOS-00010'
-  tag 'gid': 'V-214937'
-  tag 'rid': 'SV-214937r603261_rule'
-  tag 'stig_id': 'RHEL-07-010062'
-  tag 'fix_id': 'F-16135r193201_fix'
-  tag 'cci': ['CCI-000057']
+  tag legacy: ['V-78995', 'SV-93701']
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag gid: 'V-214937'
+  tag rid: 'SV-214937r880767_rule'
+  tag stig_id: 'RHEL-07-010062'
+  tag fix_id: 'F-16135r880766_fix'
+  tag cci: ['CCI-000057']
   tag nist: ['AC-11 a']
   tag subsystems: ['gui']
   tag 'host'
diff --git a/controls/SV-219059.rb b/controls/SV-219059.rb
index 5fb88c484..14302376d 100644
--- a/controls/SV-219059.rb
+++ b/controls/SV-219059.rb
@@ -1,14 +1,64 @@
 control 'SV-219059' do
   title 'The Red Hat Enterprise Linux operating system must disable the graphical user interface automounter unless required.'
-  desc  'Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.'
-  desc 'check', "Note: If the operating system does not have a graphical user interface installed, this requirement is Not Applicable.\n\nVerify the operating system disables the ability to automount devices in a graphical user interface.\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\nCheck to see if automounter service is disabled with the following commands:\n# cat /etc/dconf/db/local.d/00-No-Automount\n\n[org/gnome/desktop/media-handling]\n\nautomount=false\n\nautomount-open=false\n\nautorun-never=true\n\nIf the output does not match the example above, this is a finding.\n\n# cat /etc/dconf/db/local.d/locks/00-No-Automount\n\n/org/gnome/desktop/media-handling/automount\n\n/org/gnome/desktop/media-handling/automount-open\n\n/org/gnome/desktop/media-handling/autorun-never\n\nIf the output does not match the example, this is a finding."
-  desc 'fix', "Configure the graphical user interface to disable the ability to automount devices.\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\nCreate or edit the /etc/dconf/db/local.d/00-No-Automount file and add the following:  \n\n[org/gnome/desktop/media-handling]\n\nautomount=false\n\nautomount-open=false\n\nautorun-never=true\n\nCreate or edit the /etc/dconf/db/local.d/locks/00-No-Automount file and add the following:\n/org/gnome/desktop/media-handling/automount\n\n/org/gnome/desktop/media-handling/automount-open\n\n/org/gnome/desktop/media-handling/autorun-never\n\nRun the following command to update the database:\n\n# dconf update"
+  desc 'Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.'
+  desc 'check', 'Note: If the operating system does not have a graphical user interface installed, this requirement is Not Applicable.
+
+Verify the operating system disables the ability to automount devices in a graphical user interface.
+
+Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.
+
+Check to see if automounter service is disabled with the following commands:
+# cat /etc/dconf/db/local.d/00-No-Automount
+
+[org/gnome/desktop/media-handling]
+
+automount=false
+
+automount-open=false
+
+autorun-never=true
+
+If the output does not match the example above, this is a finding.
+
+# cat /etc/dconf/db/local.d/locks/00-No-Automount
+
+/org/gnome/desktop/media-handling/automount
+
+/org/gnome/desktop/media-handling/automount-open
+
+/org/gnome/desktop/media-handling/autorun-never
+
+If the output does not match the example, this is a finding.'
+  desc 'fix', 'Configure the graphical user interface to disable the ability to automount devices.
+
+Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.
+
+Create or edit the /etc/dconf/db/local.d/00-No-Automount file and add the following:
+
+[org/gnome/desktop/media-handling]
+
+automount=false
+
+automount-open=false
+
+autorun-never=true
+
+Create or edit the /etc/dconf/db/local.d/locks/00-No-Automount file and add the following:
+/org/gnome/desktop/media-handling/automount
+
+/org/gnome/desktop/media-handling/automount-open
+
+/org/gnome/desktop/media-handling/autorun-never
+
+Run the following command to update the database:
+
+# dconf update'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000114-GPOS-00059'
   tag satisfies: ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163', 'SRG-OS-000480-GPOS-00227']
   tag gid: 'V-219059'
-  tag rid: 'SV-219059r603261_rule'
+  tag rid: 'SV-219059r854002_rule'
   tag stig_id: 'RHEL-07-020111'
   tag fix_id: 'F-36318r602663_fix'
   tag cci: ['CCI-000366', 'CCI-000778', 'CCI-001958']
diff --git a/controls/SV-228563.rb b/controls/SV-228563.rb
index fd464e7f5..921296f80 100644
--- a/controls/SV-228563.rb
+++ b/controls/SV-228563.rb
@@ -1,9 +1,15 @@
 control 'SV-228563' do
   title 'The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are owned by root, sys, bin, or an application user.'
-  desc  "If a world-writable directory is not owned by root, sys, bin, or an application User Identifier (UID), unauthorized users may be able to modify files created by others.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access."
-  impact 0.5
-  desc 'check', "The following command will discover and print world-writable directories that are not owned by a system account, assuming only system accounts have a UID lower than 1000. Run it once for each local partition [PART]:\n\n# find [PART] -xdev -type d -perm -0002 -uid +999 -print\n\nIf there is output, this is a finding."
+  desc 'If a world-writable directory is not owned by root, sys, bin, or an application User Identifier (UID), unauthorized users may be able to modify files created by others.
+
+The only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.'
+  desc 'check', 'The following command will discover and print world-writable directories that are not owned by a system account, assuming only system accounts have a UID lower than 1000. Run it once for each local partition [PART]:
+
+# find [PART] -xdev -type d -perm -0002 -uid +999 -print
+
+If there is output, this is a finding.'
   desc 'fix', 'All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.'
+  impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000480-GPOS-00227'
   tag satisfies: nil
diff --git a/controls/SV-228564.rb b/controls/SV-228564.rb
index 7b4f93a8a..1529b643a 100644
--- a/controls/SV-228564.rb
+++ b/controls/SV-228564.rb
@@ -1,20 +1,42 @@
 control 'SV-228564' do
   title 'The Red Hat Enterprise Linux operating system must protect audit information from unauthorized read, modification, or deletion.'
-  desc  "If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nTo ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification.\n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity."
-  desc 'check', "Verify the operating system audit records have proper permissions and ownership.\n\nList the full permissions and ownership of the audit log files with the following command.\n\n# ls -la /var/log/audit \ntotal 4512\ndrwx------. 2 root root 23 Apr 25 16:53 .\ndrwxr-xr-x. 17 root root 4096 Aug 9 13:09 ..\n-rw-------. 1 root root 8675309 Aug 9 12:54 audit.log\n\nAudit logs must be mode 0600 or less permissive. \nIf any are more permissive, this is a finding.\n\nThe owner and group owner of all audit log files must both be \"root\". If any other owner or group owner is listed, this is a finding."
-  desc 'fix', "Change the mode of the audit log files with the following command: \n\n# chmod 0600 [audit_file]\n\nChange the owner and group owner of the audit log files with the following command: \n\n# chown root:root [audit_file]"
+  desc 'If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.
+
+To ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification.
+
+Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.'
+  desc 'check', 'Verify the operating system audit records have proper permissions and ownership.
+
+List the full permissions and ownership of the audit log files with the following command.
+
+# ls -la /var/log/audit
+total 4512
+drwx------. 2 root root 23 Apr 25 16:53 .
+drwxr-xr-x. 17 root root 4096 Aug 9 13:09 ..
+-rw-------. 1 root root 8675309 Aug 9 12:54 audit.log
+
+Audit logs must be mode 0600 or less permissive.
+If any are more permissive, this is a finding.
+
+The owner and group owner of all audit log files must both be "root". If any other owner or group owner is listed, this is a finding.'
+  desc 'fix', 'Change the mode of the audit log files with the following command:
+
+# chmod 0600 [audit_file]
+
+Change the owner and group owner of the audit log files with the following command:
+
+# chown root:root [audit_file]'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000057-GPOS-00027'
-  tag satisfies: ['SRG-OS-000057-GPOS-00027', 'SRG-OS-000058-GPOS-00028',
-                  'SRG-OS-000059-GPOS-00029', 'SRG-OS-000206-GPOS-00084']
+  tag satisfies: ['SRG-OS-000057-GPOS-00027', 'SRG-OS-000058-GPOS-00028', 'SRG-OS-000059-GPOS-00029', 'SRG-OS-000206-GPOS-00084']
   tag gid: 'V-228564'
   tag rid: 'SV-228564r606407_rule'
   tag stig_id: 'RHEL-07-910055'
   tag fix_id: 'F-23603r419770_fix'
   tag cci: ['CCI-000162', 'CCI-000163', 'CCI-000164', 'CCI-001314']
   tag legacy: []
-  tag nist: ['AU-9', 'SI-11 c']
+  tag nist: ['AU-9', 'SI-11 c', 'AU-9 a', 'SI-11 b']
   tag subsystems: ['audit']
   tag 'host'
 
@@ -25,7 +47,6 @@
     end
   else
     describe file(auditd_conf.log_file) do
-      its('mode') { should cmp input('expected_audit_file_mode') }
       it { should_not be_more_permissive_than(input('max_audit_file_mode')) }
       its('group') { should cmp 'root' }
       its('owner') { should cmp 'root' }
diff --git a/controls/SV-233307.rb b/controls/SV-233307.rb
index 5c6d729bc..b2ab9e9b8 100644
--- a/controls/SV-233307.rb
+++ b/controls/SV-233307.rb
@@ -1,8 +1,19 @@
 control 'SV-233307' do
   title 'The Red Hat Enterprise Linux operating system SSH daemon must prevent remote hosts from connecting to the proxy display.'
-  desc  'When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DIPSLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display.'
-  desc 'check', "Verify the SSH daemon prevents remote hosts from connecting to the proxy display.\n\nCheck the SSH X11UseLocalhost setting with the following command:\n\n# sudo grep -i x11uselocalhost /etc/ssh/sshd_config\nX11UseLocalhost yes\n\nIf the \"X11UseLocalhost\" keyword is set to \"no\", is missing, or is commented out, this is a finding."
-  desc 'fix', "Configure the SSH daemon to prevent remote hosts from connecting to the proxy display.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"X11UseLocalhost\" keyword and set its value to \"yes\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nX11UseLocalhost yes"
+  desc 'When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DIPSLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display.'
+  desc 'check', 'Verify the SSH daemon prevents remote hosts from connecting to the proxy display.
+
+Check the SSH X11UseLocalhost setting with the following command:
+
+# sudo grep -i x11uselocalhost /etc/ssh/sshd_config
+X11UseLocalhost yes
+
+If the "X11UseLocalhost" keyword is set to "no", is missing, or is commented out, this is a finding.'
+  desc 'fix', 'Configure the SSH daemon to prevent remote hosts from connecting to the proxy display.
+
+Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "X11UseLocalhost" keyword and set its value to "yes" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):
+
+X11UseLocalhost yes'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000480-GPOS-00227'
diff --git a/controls/SV-237633.rb b/controls/SV-237633.rb
index 69d24f65e..9d70e080f 100644
--- a/controls/SV-237633.rb
+++ b/controls/SV-237633.rb
@@ -1,8 +1,15 @@
 control 'SV-237633' do
   title 'The Red Hat Enterprise Linux operating system must restrict privilege elevation to authorized personnel.'
-  desc  'The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.'
-  desc 'check', "Verify the \"sudoers\" file restricts sudo access to authorized personnel.\n$ sudo grep -iw 'ALL' /etc/sudoers /etc/sudoers.d/*\n\nIf the either of the following entries are returned, this is a finding:\nALL     ALL=(ALL) ALL\nALL     ALL=(ALL:ALL) ALL"
-  desc 'fix', "Remove the following entries from the sudoers file:\nALL     ALL=(ALL) ALL\nALL     ALL=(ALL:ALL) ALL"
+  desc 'The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.'
+  desc 'check', %q(Verify the "sudoers" file restricts sudo access to authorized personnel.
+$ sudo grep -iw 'ALL' /etc/sudoers /etc/sudoers.d/*
+
+If the either of the following entries are returned, this is a finding:
+ALL     ALL=(ALL) ALL
+ALL     ALL=(ALL:ALL) ALL)
+  desc 'fix', 'Remove the following entries from the sudoers file:
+ALL     ALL=(ALL) ALL
+ALL     ALL=(ALL:ALL) ALL'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000480-GPOS-00227'
diff --git a/controls/SV-237634.rb b/controls/SV-237634.rb
index 6b6935116..40e4f0e79 100644
--- a/controls/SV-237634.rb
+++ b/controls/SV-237634.rb
@@ -1,16 +1,35 @@
 control 'SV-237634' do
-  title "The Red Hat Enterprise Linux operating system must use the invoking user's password for privilege escalation when using \"sudo\"."
-  desc  "The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the \"root\" user password. \nFor more information on each of the listed configurations, reference the sudoers(5) manual page."
-  desc 'check', "Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.\n\n$ sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'\n\n/etc/sudoers:Defaults !targetpw\n/etc/sudoers:Defaults !rootpw\n/etc/sudoers:Defaults !runaspw\n\nIf no results are returned, this is a finding.\nIf results are returned from more than one file location, this is a finding.\nIf \"Defaults !targetpw\" is not defined, this is a finding.\nIf \"Defaults !rootpw\" is not defined, this is a finding.\nIf \"Defaults !runaspw\" is not defined, this is a finding."
-  desc 'fix', "Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:\nDefaults !targetpw\nDefaults !rootpw\nDefaults !runaspw"
+  title %q(The Red Hat Enterprise Linux operating system must use the invoking user's password for privilege escalation when using "sudo".)
+  desc %q(The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the "root" user password.
+For more information on each of the listed configurations, reference the sudoers(5) manual page.)
+  desc 'check', %q(Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.
+
+     $ sudo grep -Eir '(rootpw|targetpw|runaspw)' /etc/sudoers /etc/sudoers.d* | grep -v '#'
+
+     /etc/sudoers:Defaults !targetpw
+     /etc/sudoers:Defaults !rootpw
+     /etc/sudoers:Defaults !runaspw
+
+If conflicting results are returned, this is a finding.
+If "Defaults !targetpw" is not defined, this is a finding.
+If "Defaults !rootpw" is not defined, this is a finding.
+If "Defaults !runaspw" is not defined, this is a finding.)
+  desc 'fix', 'Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:
+     Defaults !targetpw
+     Defaults !rootpw
+     Defaults !runaspw
+
+Remove any configurations that conflict with the above from the following locations:
+     /etc/sudoers
+     /etc/sudoers.d/'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000480-GPOS-00227'
   tag satisfies: nil
   tag gid: 'V-237634'
-  tag rid: 'SV-237634r809213_rule'
+  tag rid: 'SV-237634r880755_rule'
   tag stig_id: 'RHEL-07-010342'
-  tag fix_id: 'F-40816r646852_fix'
+  tag fix_id: 'F-40816r880754_fix'
   tag cci: ['CCI-002227']
   tag legacy: []
   tag nist: ['AC-6 (5)']
@@ -23,7 +42,7 @@
       skip 'Control not applicable within a container without sudo enabled'
     end
   else
-    sudoers_settings = command("egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'").stdout.strip
+    sudoers_settings = command("grep -Eir '(rootpw|targetpw|runaspw)' /etc/sudoers /etc/sudoers.d | grep -v '#'").stdout.strip
 
     target_match = sudoers_settings.scan(/^([^:]+):Defaults\s+!targetpw$/).flatten
     root_match = sudoers_settings.scan(/^([^:]+):Defaults\s+!rootpw$/).flatten
diff --git a/controls/SV-237635.rb b/controls/SV-237635.rb
index 6848b660b..fb560262f 100644
--- a/controls/SV-237635.rb
+++ b/controls/SV-237635.rb
@@ -1,16 +1,35 @@
 control 'SV-237635' do
   title 'The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command.'
-  desc  "Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to re-authenticate when using the \"sudo\" command.\n\nIf the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated."
-  desc 'check', "Verify the operating system requires re-authentication when using the \"sudo\" command to elevate privileges.\n\n$ sudo grep -i 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/*\n/etc/sudoers:Defaults timestamp_timeout=0\n\nIf results are returned from more than one file location, this is a finding.\n\nIf \"timestamp_timeout\" is set to a negative number, is commented out, or no results are returned, this is a finding."
-  desc 'fix', "Configure the \"sudo\" command to require re-authentication.\nEdit the /etc/sudoers file:\n$ sudo visudo\n\nAdd or modify the following line:\nDefaults timestamp_timeout=[value]\nNote: The \"[value]\" must be a number that is greater than or equal to \"0\"."
+  desc %q(Without re-authentication, users may access resources or perform tasks for which they do not have authorization.
+
+When operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to re-authenticate when using the "sudo" command.
+
+If the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.)
+  desc 'check', %q(Verify the operating system requires re-authentication when using the "sudo" command to elevate privileges.
+
+$ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d
+/etc/sudoers:Defaults timestamp_timeout=0
+
+If conflicting results are returned, this is a finding.
+
+If "timestamp_timeout" is set to a negative number, is commented out, or no results are returned, this is a finding.)
+  desc 'fix', 'Configure the "sudo" command to require re-authentication.
+Edit the /etc/sudoers file:
+$ sudo visudo
+
+Add or modify the following line:
+Defaults timestamp_timeout=[value]
+Note: The "[value]" must be a number that is greater than or equal to "0".
+
+Remove any duplicate or conflicting lines from /etc/sudoers and /etc/sudoers.d/ files.'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000373-GPOS-00156'
   tag satisfies: nil
   tag gid: 'V-237635'
-  tag rid: 'SV-237635r809215_rule'
+  tag rid: 'SV-237635r861075_rule'
   tag stig_id: 'RHEL-07-010343'
-  tag fix_id: 'F-40817r646855_fix'
+  tag fix_id: 'F-40817r858491_fix'
   tag cci: ['CCI-002038']
   tag legacy: []
   tag nist: ['IA-11']
@@ -23,7 +42,7 @@
       skip 'Control not applicable within a container without sudo enabled'
     end
   else
-    describe command("grep -i 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/*").stdout.strip do
+    describe command("grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d").stdout.strip do
       it { should match /^[^#].*Defaults timestamp_timeout=\d/ }
       it { should_not match /\n/ }
     end
diff --git a/controls/SV-244557.rb b/controls/SV-244557.rb
index 527f31041..1d74cccee 100644
--- a/controls/SV-244557.rb
+++ b/controls/SV-244557.rb
@@ -1,16 +1,37 @@
 control 'SV-244557' do
   title 'Red Hat Enterprise Linux operating systems version 7.2 or newer booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.'
-  desc  "If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc."
-  desc 'check', "For systems that use UEFI, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nVerify that a unique name is set as the \"superusers\" account:\n\n# grep -iw \"superusers\" /boot/grub2/grub.cfg\n    set superusers=\"[someuniquestringhere]\"\n    export superusers\n\nIf \"superusers\" is identical to any OS account name or is missing a name, this is a finding."
-  desc 'fix', "Configure the system to have a unique name for the grub superusers account.\n\nEdit the /boot/grub2/grub.cfg file and add or modify the following lines in the \"### BEGIN /etc/grub.d/01_users ###\" section:\n\nset superusers=\"[someuniquestringhere]\"\nexport superusers\npassword_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}"
+  desc 'If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.
+The GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc.'
+  desc 'check', 'For systems that use UEFI, this is Not Applicable.
+
+For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.
+
+Verify that a unique name is set as the "superusers" account:
+
+# grep -iw "superusers" /boot/grub2/grub.cfg
+    set superusers="[someuniquestringhere]"
+    export superusers
+
+If "superusers" is identical to any OS account name or is missing a name, this is a finding.'
+  desc 'fix', 'Configure the system to have a unique name for the grub superusers account.
+
+Edit the /etc/grub.d/01_users file and add or modify the following lines:
+
+set superusers="[someuniquestringhere]"
+export superusers
+password_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}
+
+Generate a new grub.cfg file with the following command:
+
+$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000080-GPOS-00048'
   tag satisfies: nil
   tag gid: 'V-244557'
-  tag rid: 'SV-244557r792838_rule'
+  tag rid: 'SV-244557r833185_rule'
   tag stig_id: 'RHEL-07-010483'
-  tag fix_id: 'F-47789r744062_fix'
+  tag fix_id: 'F-47789r833184_fix'
   tag cci: ['CCI-000213']
   tag legacy: []
   tag nist: ['AC-3']
diff --git a/controls/SV-244558.rb b/controls/SV-244558.rb
index aef3b599e..214dde9f9 100644
--- a/controls/SV-244558.rb
+++ b/controls/SV-244558.rb
@@ -1,21 +1,43 @@
 control 'SV-244558' do
   title 'Red Hat Enterprise Linux operating systems version 7.2 or newer booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.'
-  desc  "If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc."
-  desc 'check', "For systems that use BIOS, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nVerify that a unique name is set as the \"superusers\" account:\n\n$ sudo grep -iw \"superusers\" /boot/efi/EFI/redhat/grub.cfg\n    set superusers=\"[someuniquestringhere]\"\n    export superusers\n\nIf \"superusers\" is identical to any OS account name or is missing a name, this is a finding."
-  desc 'fix', "Configure the system to have a unique name for the grub superusers account.\n\nEdit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the \"### BEGIN /etc/grub.d/01_users ###\" section:\n\nset superusers=\"[someuniquestringhere]\"\nexport superusers\npassword_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}"
+  desc 'If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.
+The GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc.'
+  desc 'check', 'For systems that use BIOS, this is Not Applicable.
+
+For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.
+
+Verify that a unique name is set as the "superusers" account:
+
+$ sudo grep -iw "superusers" /boot/efi/EFI/redhat/grub.cfg
+    set superusers="[someuniquestringhere]"
+    export superusers
+
+If "superusers" is identical to any OS account name or is missing a name, this is a finding.'
+  desc 'fix', 'Configure the system to have a unique name for the grub superusers account.
+
+Edit the /etc/grub.d/01_users file and add or modify the following lines:
+
+set superusers="[someuniquestringhere]"
+export superusers
+password_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}
+
+Generate a new grub.cfg file with the following command:
+
+$ sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000080-GPOS-00048'
   tag satisfies: nil
   tag gid: 'V-244558'
-  tag rid: 'SV-244558r792840_rule'
+  tag rid: 'SV-244558r833187_rule'
   tag stig_id: 'RHEL-07-010492'
-  tag fix_id: 'F-47790r744065_fix'
+  tag fix_id: 'F-47790r833186_fix'
   tag cci: ['CCI-000213']
   tag legacy: []
   tag nist: ['AC-3']
   tag subsystems: ['grub']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if virtualization.system.eql?('docker')
     impact 0.0
diff --git a/controls/SV-250312.rb b/controls/SV-250312.rb
index bc43b1e94..e3b95991b 100644
--- a/controls/SV-250312.rb
+++ b/controls/SV-250312.rb
@@ -1,14 +1,41 @@
 control 'SV-250312' do
   title 'The Red Hat Enterprise Linux operating system must confine SELinux users to roles that conform to least privilege.'
-  desc  "Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users."
-  desc 'check', "Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system confines SELinux users to roles that conform to least privilege.\n\nCheck the SELinux User list to SELinux Roles mapping by using the following command:\n\n$ sudo semanage user -l\nSELinuxUser LabelingPrefix MLS/MCSLevel MLS/MCSRange SELinuxRoles\nguest_u            user  s0  s0  guest_r\nroot                   user  s0  s0-s0:c0.c1023  staff_r sysadm_r system_r unconfined_r\nstaff_u              user  s0  s0-s0:c0.c1023  staff_r sysadm_r\nsysadm_u         user  s0  s0-s0:c0.c1023  sysadm_r \nsystem_u          user  s0  s0-s0:c0.c1023  system_r unconfined_r\nunconfined_u  user  s0  s0-s0:c0.c1023  system_r unconfined_r\nuser_u               user  s0  s0  user_r\nxguest_u           user  s0  s0  xguest_r\n\nIf the output differs from the above example, ask the SA to demonstrate how the SELinux User mappings are exercising least privilege. If deviations from the example are not documented with the ISSO and do not demonstrate least privilege, this is a finding."
-  desc 'fix', "Configure the operating system to confine SELinux users to roles that conform to least privilege.\n\nUse the following command to map the \"staff_u\" SELinux user to the \"staff_r\" and \"sysadm_r\" roles:\n\n$ sudo semanage user -m staff_u -R staff_r -R sysadm_r\n\nUse the following command to map the \"user_u\" SELinux user to the \"user_r\" role:\n\n$ sudo semanage -m user_u -R user_r"
+  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.
+
+Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.'
+  desc 'check', 'Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.
+
+Verify the operating system confines SELinux users to roles that conform to least privilege.
+
+Check the SELinux User list to SELinux Roles mapping by using the following command:
+
+$ sudo semanage user -l
+SELinuxUser LabelingPrefix MLS/MCSLevel MLS/MCSRange SELinuxRoles
+guest_u            user  s0  s0  guest_r
+root                   user  s0  s0-s0:c0.c1023  staff_r sysadm_r system_r unconfined_r
+staff_u              user  s0  s0-s0:c0.c1023  staff_r sysadm_r
+sysadm_u         user  s0  s0-s0:c0.c1023  sysadm_r
+system_u          user  s0  s0-s0:c0.c1023  system_r unconfined_r
+unconfined_u  user  s0  s0-s0:c0.c1023  system_r unconfined_r
+user_u               user  s0  s0  user_r
+xguest_u           user  s0  s0  xguest_r
+
+If the output differs from the above example, ask the SA to demonstrate how the SELinux User mappings are exercising least privilege. If deviations from the example are not documented with the ISSO and do not demonstrate least privilege, this is a finding.'
+  desc 'fix', 'Configure the operating system to confine SELinux users to roles that conform to least privilege.
+
+Use the following command to map the "staff_u" SELinux user to the "staff_r" and "sysadm_r" roles:
+
+$ sudo semanage user -m staff_u -R staff_r -R sysadm_r
+
+Use the following command to map the "user_u" SELinux user to the "user_r" role:
+
+$ sudo semanage -m user_u -R user_r'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000324-GPOS-00125'
   tag satisfies: nil
   tag gid: 'V-250312'
-  tag rid: 'SV-250312r792843_rule'
+  tag rid: 'SV-250312r877392_rule'
   tag stig_id: 'RHEL-07-020021'
   tag fix_id: 'F-53700r792842_fix'
   tag cci: ['CCI-002165', 'CCI-002235']
diff --git a/controls/SV-250313.rb b/controls/SV-250313.rb
index 7909eb326..7b846d0d2 100644
--- a/controls/SV-250313.rb
+++ b/controls/SV-250313.rb
@@ -1,14 +1,33 @@
 control 'SV-250313' do
   title 'The Red Hat Enterprise Linux operating system must not allow privileged accounts to utilize SSH.'
-  desc  "Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users."
-  desc 'check', "Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system prevents privileged accounts from utilizing SSH.\nCheck the SELinux ssh_sysadm_login boolean with the following command:\n\n$ sudo getsebool ssh_sysadm_login\nssh_sysadm_login --> off\n\nIf the \"ssh_sysadm_login\" boolean is not \"off\" and is not documented with the ISSO as an operational requirement, this is a finding."
-  desc 'fix', "Configure the operating system to prevent privileged accounts from utilizing SSH.\nUse the following command to set the \"ssh_sysadm_login\" boolean to \"off\":\n\n$ sudo setsebool -P ssh_sysadm_login off\n\nNote: SELinux confined users mapped to sysadm_u are not allowed to login to the system over SSH, by default. If this is a required function, it can be configured by setting the ssh_sysadm_login SELinux boolean to \"on\" with the following command:\n\n$ sudo setsebool -P ssh_sysadm_login on\n\nThis must be documented with the ISSO as an operational requirement."
+  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.
+
+Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.'
+  desc 'check', 'Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.
+
+Verify the operating system prevents privileged accounts from utilizing SSH.
+Check the SELinux ssh_sysadm_login boolean with the following command:
+
+$ sudo getsebool ssh_sysadm_login
+ssh_sysadm_login --> off
+
+If the "ssh_sysadm_login" boolean is not "off" and is not documented with the ISSO as an operational requirement, this is a finding.'
+  desc 'fix', 'Configure the operating system to prevent privileged accounts from utilizing SSH.
+Use the following command to set the "ssh_sysadm_login" boolean to "off":
+
+$ sudo setsebool -P ssh_sysadm_login off
+
+Note: SELinux confined users mapped to sysadm_u are not allowed to login to the system over SSH, by default. If this is a required function, it can be configured by setting the ssh_sysadm_login SELinux boolean to "on" with the following command:
+
+$ sudo setsebool -P ssh_sysadm_login on
+
+This must be documented with the ISSO as an operational requirement.'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000324-GPOS-00125'
   tag satisfies: nil
   tag gid: 'V-250313'
-  tag rid: 'SV-250313r792846_rule'
+  tag rid: 'SV-250313r877392_rule'
   tag stig_id: 'RHEL-07-020022'
   tag fix_id: 'F-53701r792845_fix'
   tag cci: ['CCI-002165', 'CCI-002235']
diff --git a/controls/SV-250314.rb b/controls/SV-250314.rb
index b2d1a6d12..390fbf0a7 100644
--- a/controls/SV-250314.rb
+++ b/controls/SV-250314.rb
@@ -1,16 +1,35 @@
 control 'SV-250314' do
   title 'The Red Hat Enterprise Linux operating system must elevate the SELinux context when an administrator calls the sudo command.'
-  desc  "Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users."
-  desc 'check', "Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system elevates the SELinux context when an administrator calls the sudo command with the following command:\n\nThis command must be ran as root:\n# grep sysadm_r /etc/sudoers /etc/sudoers.d/*\n%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL\n\nIf results are returned from more than one file location, this is a finding.\n\nIf a designated sudoers administrator group or account(s) is not configured to elevate the SELinux type and role to \"sysadm_t\" and \"sysadm_r\" with the use of the sudo command, this is a finding."
-  desc 'fix', "Configure the operating system to elevate the SELinux context when an administrator calls the sudo command.\nEdit a file in the /etc/sudoers.d directory with the following command:\n$ sudo visudo -f /etc/sudoers.d/<customfile>\n\nUse the following example to build the <customfile> in the /etc/sudoers.d directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command:\n%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL"
+  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.
+
+Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.'
+  desc 'check', 'Verify the operating system elevates the SELinux context when an administrator calls the sudo command with the following command:
+
+This command must be ran as root:
+# grep -r sysadm_r /etc/sudoers /etc/sudoers.d
+%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
+
+If conflicting results are returned, this is a finding.
+
+If a designated sudoers administrator group or account(s) is not configured to elevate the SELinux type and role to "sysadm_t" and "sysadm_r" with the use of the sudo command, this is a finding.'
+  desc 'fix', 'Configure the operating system to elevate the SELinux context when an administrator calls the sudo command.
+Edit a file in the /etc/sudoers.d directory with the following command:
+$ sudo visudo -f /etc/sudoers.d/<customfile>
+
+Use the following example to build the <customfile> in the /etc/sudoers.d directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command:
+%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
+
+Remove any configurations that conflict with the above from the following locations:
+/etc/sudoers
+/etc/sudoers.d/'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000324-GPOS-00125'
   tag satisfies: nil
   tag gid: 'V-250314'
-  tag rid: 'SV-250314r809217_rule'
+  tag rid: 'SV-250314r877392_rule'
   tag stig_id: 'RHEL-07-020023'
-  tag fix_id: 'F-53702r792848_fix'
+  tag fix_id: 'F-53702r858494_fix'
   tag cci: ['CCI-002165', 'CCI-002235']
   tag legacy: []
   tag nist: ['AC-3 (4)', 'AC-6 (10)']
@@ -23,7 +42,7 @@
       skip 'Control not applicable within a container -- kernel config'
     end
   else
-    describe command('grep sysadm_r /etc/sudoers /etc/sudoers.d/*').stdout.strip do
+    describe command('grep -r sysadm_r /etc/sudoers /etc/sudoers.d').stdout.strip do
       it { should match /TYPE=sysadm_t\s+ROLE=sysadm_r/ }
       it { should_not match /\n/ }
     end
diff --git a/controls/SV-251702.rb b/controls/SV-251702.rb
index 4e2b86c30..bcc4c9564 100644
--- a/controls/SV-251702.rb
+++ b/controls/SV-251702.rb
@@ -1,8 +1,17 @@
 control 'SV-251702' do
   title 'The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.'
-  desc  'If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.'
-  desc 'check', "Check the \"/etc/shadow\" file for blank passwords with the following command:\n\n$ sudo awk -F: '!$2 {print $1}' /etc/shadow\n\nIf the command returns any results, this is a finding."
-  desc 'fix', "Configure all accounts on the system to have a password or lock the account with the following commands:\n\nPerform a password reset:\n$ sudo passwd [username]\nLock an account:\n$ sudo passwd -l [username]"
+  desc 'If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.'
+  desc 'check', %q(Check the "/etc/shadow" file for blank passwords with the following command:
+
+$ sudo awk -F: '!$2 {print $1}' /etc/shadow
+
+If the command returns any results, this is a finding.)
+  desc 'fix', 'Configure all accounts on the system to have a password or lock the account with the following commands:
+
+Perform a password reset:
+$ sudo passwd [username]
+Lock an account:
+$ sudo passwd -l [username]'
   impact 0.7
   tag severity: 'high'
   tag gtitle: 'SRG-OS-000480-GPOS-00227'
@@ -15,7 +24,8 @@
   tag legacy: []
   tag nist: ['CM-6 b']
   tag subsystems: ['password', '/etc/shadow']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   empty_pw_users = shadow.where { password == '' }.users
 
diff --git a/controls/SV-251703.rb b/controls/SV-251703.rb
index 1161f824e..fc8a8bb02 100644
--- a/controls/SV-251703.rb
+++ b/controls/SV-251703.rb
@@ -1,14 +1,37 @@
 control 'SV-251703' do
   title 'The Red Hat Enterprise Linux operating system must specify the default "include" directory for the /etc/sudoers file.'
-  desc  "The \"sudo\" command allows authorized users to run programs (including shells) as other users, system users, and root. The \"/etc/sudoers\" file is used to configure authorized \"sudo\" users as well as the programs they are allowed to run. Some configuration options in the \"/etc/sudoers\" file allow configured users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.\n\nIt is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives. When sudo reaches this line it will suspend processing of the current file (/etc/sudoers) and switch to the specified file/directory. Once the end of the included file(s) is reached, the rest of /etc/sudoers will be processed. Files that are included may themselves include other files. A hard limit of 128 nested include files is enforced to prevent include file loops."
-  desc 'check', "Verify the operating system specifies only the default \"include\" directory for the /etc/sudoers file with the following command:\n\n$ sudo grep include /etc/sudoers\n\n#includedir /etc/sudoers.d\n\nIf the results are not \"/etc/sudoers.d\" or additional files or directories are specified, this is a finding.\n\nVerify the operating system does not have nested \"include\" files or directories within the /etc/sudoers.d directory with the following command:\n\n$ sudo grep include /etc/sudoers.d/*\n\nIf results are returned, this is a finding."
-  desc 'fix', "Configure the /etc/sudoers file to only include the /etc/sudoers.d directory.\n\nEdit the /etc/sudoers file with the following command:\n\n$ sudo visudo\n\nAdd or modify the following line:\n#includedir /etc/sudoers.d"
+  desc 'The "sudo" command allows authorized users to run programs (including shells) as other users, system users, and root. The "/etc/sudoers" file is used to configure authorized "sudo" users as well as the programs they are allowed to run. Some configuration options in the "/etc/sudoers" file allow configured users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.
+
+It is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives. When sudo reaches this line it will suspend processing of the current file (/etc/sudoers) and switch to the specified file/directory. Once the end of the included file(s) is reached, the rest of /etc/sudoers will be processed. Files that are included may themselves include other files. A hard limit of 128 nested include files is enforced to prevent include file loops.'
+  desc 'check', 'Note: If the "include" and "includedir" directives are not present in the /etc/sudoers file, this requirement is not applicable.
+
+Verify the operating system specifies only the default "include" directory for the /etc/sudoers file with the following command:
+
+$ sudo grep include /etc/sudoers
+
+#includedir /etc/sudoers.d
+
+If the results are not "/etc/sudoers.d" or additional files or directories are specified, this is a finding.
+
+Verify the operating system does not have nested "include" files or directories within the /etc/sudoers.d directory with the following command:
+
+$ sudo grep -r include /etc/sudoers.d
+
+If results are returned, this is a finding.'
+  desc 'fix', 'Configure the /etc/sudoers file to only include the /etc/sudoers.d directory.
+
+Edit the /etc/sudoers file with the following command:
+
+$ sudo visudo
+
+Add or modify the following line:
+#includedir /etc/sudoers.d'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000480-GPOS-00227'
   tag satisfies: nil
   tag gid: 'V-251703'
-  tag rid: 'SV-251703r809566_rule'
+  tag rid: 'SV-251703r833183_rule'
   tag stig_id: 'RHEL-07-010339'
   tag fix_id: 'F-55094r809222_fix'
   tag cci: ['CCI-000366']
@@ -17,20 +40,24 @@
   tag subsystems: ['sudo']
   tag 'host'
 
-  if virtualization.system.eql?('docker') && !command('sudo').exist?
+  if command('grep include /etc/sudoers').stdout.empty?
+    impact 0.0
+    describe 'This requirement is not applicable as "include" and "includedir" directives are not present in the /etc/sudoers file' do
+      skip 'This requirement is not applicable as "include" and "includedir" directives are not present in the /etc/sudoers file'
+    end
+  elsif virtualization.system.eql?('docker') && !command('sudo').exist?
     impact 0.0
     describe 'Control not applicable within a container without sudo enabled' do
       skip 'Control not applicable within a container without sudo enabled'
     end
   else
-    options = {
-      assignment_regex: /^(#includedirs?)\s*(.*?)\s*$/
-    }
-    describe parse_config_file('/etc/sudoers', options) do
-      its('#includedirs') { should cmp '/etc/sudoers.d' }
+    describe 'Only the default "include" directory for /etc/sudoers file should be specified' do
+      subject { command('grep include /etc/sudoers').stdout.strip }
+      it { should match %r{#includedir\s*/etc/sudoers.d\s*$} }
     end
-    describe command('grep include /etc/sudoers.d') do
-      its('stdout') { should be_empty }
+    describe 'Nested "include" files or directories within /etc/sudoers.d directory should not exist' do
+      subject { command('grep -r include /etc/sudoers.d').stdout }
+      it { should be_empty }
     end
   end
 end
diff --git a/controls/SV-251704.rb b/controls/SV-251704.rb
index 32da7d87a..d289bcb12 100644
--- a/controls/SV-251704.rb
+++ b/controls/SV-251704.rb
@@ -1,17 +1,29 @@
 control 'SV-251704' do
   title 'The Red Hat Enterprise Linux operating system must not be configured to bypass password requirements for privilege escalation.'
-  desc  "Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate."
-  desc 'check', "Verify the operating system is not be configured to bypass password requirements for privilege escalation.\n\nCheck the configuration of the \"/etc/pam.d/sudo\" file with the following command:\n\n$ sudo grep pam_succeed_if /etc/pam.d/sudo\n\nIf any occurrences of \"pam_succeed_if\" is returned from the command, this is a finding."
-  desc 'fix', "Configure the operating system to require users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/ pam.d/sudo\" file with the following command:\n$ sudo vi /etc/pam.d/sudo\n\nRemove any occurrences of \"pam_succeed_if\" in the file."
+  desc 'Without re-authentication, users may access resources or perform tasks for which they do not have authorization.
+
+When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.'
+  desc 'check', 'Verify the operating system is not be configured to bypass password requirements for privilege escalation.
+
+Check the configuration of the "/etc/pam.d/sudo" file with the following command:
+
+$ sudo grep pam_succeed_if /etc/pam.d/sudo
+
+If any occurrences of "pam_succeed_if" is returned from the command, this is a finding.'
+  desc 'fix', 'Configure the operating system to require users to supply a password for privilege escalation.
+
+Check the configuration of the "/etc/ pam.d/sudo" file with the following command:
+$ sudo vi /etc/pam.d/sudo
+
+Remove any occurrences of "pam_succeed_if" in the file.'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000373-GPOS-00156'
-  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157',
-                  'SRG-OS-000373-GPOS-00158']
+  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157', 'SRG-OS-000373-GPOS-00158']
   tag gid: 'V-251704'
-  tag rid: 'SV-251704r809568_rule'
+  tag rid: 'SV-251704r854012_rule'
   tag stig_id: 'RHEL-07-010344'
-  tag fix_id: 'F-55095r809567_fix'
+  tag fix_id: 'F-55095r854011_fix'
   tag cci: ['CCI-002038']
   tag legacy: []
   tag nist: ['IA-11']
diff --git a/controls/SV-251705.rb b/controls/SV-251705.rb
index 6d6ce281b..b0383ae53 100644
--- a/controls/SV-251705.rb
+++ b/controls/SV-251705.rb
@@ -1,23 +1,75 @@
 control 'SV-251705' do
   title 'The Red Hat Enterprise Linux operating system must use a file integrity tool to verify correct operation of all security functions.'
-  desc  "Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to the Red Hat Enterprise Linux operating system performing security function verification/testing and/or systems and environments that require this functionality."
-  desc 'check', "Verify that Advanced Intrusion Detection Environment (AIDE) is installed and verifies the correct operation of all security functions.\n\nCheck that the AIDE package is installed with the following command:\n\n$ sudo rpm -q aide\n\naide-0.16-14.el8.x86_64\n\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \n\nIf there is no application installed to perform integrity checks, this is a finding."
-  desc 'fix', "Install the AIDE package by running the following command:\n\n$ sudo yum install aide"
+  desc 'Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.
+
+This requirement applies to the Red Hat Enterprise Linux operating system performing security function verification/testing and/or systems and environments that require this functionality.'
+  desc 'check', %q(Verify that Advanced Intrusion Detection Environment (AIDE) is installed and verifies the correct operation of all security functions.
+
+Check that the AIDE package is installed with the following command:
+     $ sudo rpm -q aide
+
+     aide-0.15.1-13.el7.x86_64
+
+If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system.
+
+If there is no application installed to perform integrity checks, this is a finding.
+
+If AIDE is installed, check if it has been initialized with the following command:
+     $ sudo /usr/sbin/aide --check
+
+If the output is "Couldn't open file /var/lib/aide/aide.db.gz for reading", this is a finding.)
+  desc 'fix', 'Install AIDE, initialize it, and perform a manual check.
+
+Install AIDE:
+     $ sudo yum install aide
+
+Initialize it:
+     $ sudo /usr/sbin/aide --init
+
+     AIDE, version 0.15.1
+     ### AIDE database at /var/lib/aide/aide.db.new.gz initialized.
+
+The new database will need to be renamed to be read by AIDE:
+     $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
+
+Perform a manual check:
+     $ sudo /usr/sbin/aide --check
+
+     AIDE, version 0.15.1
+     ### All files match AIDE database. Looks okay!
+
+Done.'
   impact 0.5
   tag severity: 'medium'
   tag gtitle: 'SRG-OS-000445-GPOS-00199'
   tag satisfies: nil
   tag gid: 'V-251705'
-  tag rid: 'SV-251705r809229_rule'
+  tag rid: 'SV-251705r880854_rule'
   tag stig_id: 'RHEL-07-020029'
-  tag fix_id: 'F-55096r809228_fix'
+  tag fix_id: 'F-55096r880853_fix'
   tag cci: ['CCI-002696']
   tag legacy: []
   tag nist: ['SI-6 a']
   tag subsystems: ['file_integrity_tool']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
+
+  tool = input('file_integrity_tool')
+
+  if tool == 'aide'
+    describe package('aide') do
+      it { should be_installed }
+    end
+
+    aide_initialization = command('sudo /usr/sbin/aide --check').stdout.strip
 
-  describe package(input('file_integrity_tool')) do
-    it { should be_installed }
+    describe "File integrity tool #{tool} should be initialized" do
+      subject { aide_initialization }
+      it { should_not match /Couldn't\sopen\sfile/ }
+    end
+  else
+    describe "Manually review that #{tool} is installed and configured to perform file integrity checks" do
+      skip "Manually review that #{tool} is installed and configured to perform file integrity checks"
+    end
   end
 end
diff --git a/controls/SV-254523.rb b/controls/SV-254523.rb
new file mode 100644
index 000000000..7c795802d
--- /dev/null
+++ b/controls/SV-254523.rb
@@ -0,0 +1,48 @@
+control 'SV-254523' do
+  title 'The Red Hat Enterprise Linux operating system emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours.'
+  desc "Emergency accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.
+
+Emergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.
+
+To address access requirements, many RHEL systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements."
+  desc 'check', 'Verify emergency accounts have been provisioned with an expiration date of 72 hours.
+
+For every existing emergency account, run the following command to obtain its account expiration information.
+
+$ sudo chage -l system_account_name
+
+Verify each of these accounts has an expiration date set within 72 hours.
+If any emergency accounts have no expiration date set or do not expire within 72 hours, this is a finding.'
+  desc 'fix', 'If an emergency account must be created, configure the system to terminate the account after 72 hours with the following command to set an expiration date for the account. Substitute "system_account_name" with the account to be created.
+
+$ sudo chage -E `date -d "+3 days" +%Y-%m-%d` system_account_name
+
+The automatic expiration or disabling time period may be extended as needed until the crisis is resolved.'
+  impact 0.5
+  tag check_id: 'C-58007r858499_chk'
+  tag severity: 'medium'
+  tag gid: 'V-254523'
+  tag rid: 'SV-254523r858501_rule'
+  tag stig_id: 'RHEL-07-010271'
+  tag gtitle: 'SRG-OS-000123-GPOS-00064'
+  tag fix_id: 'F-57956r858500_fix'
+  tag 'documentable'
+  tag cci: ['CCI-001682']
+  tag nist: ['AC-2 (2)']
+
+  emergency_accounts = input('emergency_accounts')
+
+  if emergency_accounts.empty?
+    describe 'Emergency accounts' do
+      subject { emergency_accounts }
+      it { should be_empty }
+    end
+  else
+    emergency_accounts.each do |acct|
+      describe user(acct.to_s) do
+        its('maxdays') { should cmp <= 3 }
+        its('maxdays') { should cmp > 0 }
+      end
+    end
+  end
+end
diff --git a/controls/SV-255925.rb b/controls/SV-255925.rb
new file mode 100644
index 000000000..d9130a748
--- /dev/null
+++ b/controls/SV-255925.rb
@@ -0,0 +1,32 @@
+control 'SV-255925' do
+  title 'The Red Hat Enterprise Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.'
+  desc 'The use of FIPS-validated cryptographic algorithms is enforced by enabling kernel FIPS mode. In the event that kernel FIPS mode is disabled, the use of nonvalidated cryptographic algorithms will be permitted systemwide. The SSH server configuration must manually define only FIPS-validated key exchange algorithms to prevent the use of nonvalidated algorithms.'
+  desc 'check', 'Verify that the SSH server is configured to use only FIPS-validated key exchange algorithms:
+
+     $ sudo grep -i kexalgorithms /etc/ssh/sshd_config
+     KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256
+
+If "KexAlgorithms" is not configured, is commented out, or does not contain only the algorithms "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256" in exact order, this is a finding.'
+  desc 'fix', 'Configure the SSH server to use only FIPS-validated key exchange algorithms by adding or modifying the following line in "/etc/ssh/sshd_config":
+
+     KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256
+
+Restart the "sshd" service for changes to take effect:
+
+     $ sudo systemctl restart sshd'
+  impact 0.5
+  tag check_id: 'C-59602r880747_chk'
+  tag severity: 'medium'
+  tag gid: 'V-255925'
+  tag rid: 'SV-255925r880749_rule'
+  tag stig_id: 'RHEL-07-040712'
+  tag gtitle: 'SRG-OS-000033-GPOS-00014'
+  tag fix_id: 'F-59545r880748_fix'
+  tag 'documentable'
+  tag cci: ['CCI-001453']
+  tag nist: ['AC-17 (2)']
+
+  describe sshd_config('/etc/ssh/sshd_config') do
+    its('KexAlgorithms') { should cmp 'ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256' }
+  end
+end
diff --git a/controls/SV-255926.rb b/controls/SV-255926.rb
new file mode 100644
index 000000000..feaacdc3a
--- /dev/null
+++ b/controls/SV-255926.rb
@@ -0,0 +1,57 @@
+control 'SV-255926' do
+  title 'The Red Hat Enterprise Linux operating system must have the screen package installed.'
+  desc "A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.
+
+The screen and tmux packages allow for a session lock to be implemented and configured."
+  desc 'check', 'Verify the operating system has the screen package installed.
+
+Check to see if the screen package is installed with the following command:
+
+     # yum list installed screen
+     screen-4.3.1-3-x86_64.rpm
+
+If the screen package is not installed, check to see if the tmux package is installed with the following command:
+
+     # yum list installed tmux
+     tmux-1.8-4.el7.x86_64.rpm
+
+If either the screen package or the tmux package is not installed, this is a finding.'
+  desc 'fix', 'Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.
+
+Install the screen program (if it is not on the system) with the following command:
+
+     # yum install screen
+
+OR
+
+Install the tmux program (if it is not on the system) with the following command:
+
+     # yum install tmux'
+  impact 0.5
+  tag check_id: 'C-59603r880777_chk'
+  tag severity: 'medium'
+  tag gid: 'V-255926'
+  tag rid: 'SV-255926r880779_rule'
+  tag stig_id: 'RHEL-07-010090'
+  tag gtitle: 'SRG-OS-000029-GPOS-00010'
+  tag fix_id: 'F-59546r880778_fix'
+  tag 'documentable'
+  tag cci: ['CCI-000057']
+  tag nist: ['AC-11 a']
+
+  if virtualization.system.eql?('docker')
+    impact 0.0
+    describe 'Control not applicable within a container' do
+      skip 'Control not applicable within a container'
+    end
+  else
+    describe.one do
+      describe package('screen') do
+        it { should be_installed }
+      end
+      describe package('tmux') do
+        it { should be_installed }
+      end
+    end
+  end
+end
diff --git a/controls/SV-255927.rb b/controls/SV-255927.rb
new file mode 100644
index 000000000..148756259
--- /dev/null
+++ b/controls/SV-255927.rb
@@ -0,0 +1,74 @@
+control 'SV-255927' do
+  title 'The Red Hat Enterprise Linux operating system must restrict access to the kernel message buffer.'
+  desc 'Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a non-privileged user.'
+  desc 'check', 'Verify the operating system is configured to restrict access to the kernel message buffer with the following commands:
+
+     $ sudo sysctl kernel.dmesg_restrict
+     kernel.dmesg_restrict = 1
+
+If "kernel.dmesg_restrict" is not set to "1" or is missing, this is a finding.
+
+Check that the configuration files are present to enable this kernel parameter:
+
+     $ sudo grep -r kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null
+     /etc/sysctl.conf:kernel.dmesg_restrict = 1
+     /etc/sysctl.d/99-sysctl.conf:kernel.dmesg_restrict = 1
+
+If "kernel.dmesg_restrict" is not set to "1", is missing or commented out, this is a finding.
+
+If conflicting results are returned, this is a finding.'
+  desc 'fix', 'Configure the operating system to restrict access to the kernel message buffer.
+
+Set the system to the required kernel parameter by adding or modifying the following line in /etc/sysctl.conf or a config file in the /etc/sysctl.d/ directory:
+
+     kernel.dmesg_restrict = 1
+
+Remove any configurations that conflict with the above from the following locations:
+     /run/sysctl.d/
+     /etc/sysctl.d/
+     /usr/local/lib/sysctl.d/
+     /usr/lib/sysctl.d/
+     /lib/sysctl.d/
+     /etc/sysctl.conf
+
+Reload settings from all system configuration files with the following command:
+
+     $ sudo sysctl --system'
+  impact 0.3
+  tag check_id: 'C-59604r880789_chk'
+  tag severity: 'low'
+  tag gid: 'V-255927'
+  tag rid: 'SV-255927r880791_rule'
+  tag stig_id: 'RHEL-07-010375'
+  tag gtitle: 'SRG-OS-000138-GPOS-00069'
+  tag fix_id: 'F-59547r880790_fix'
+  tag 'documentable'
+  tag cci: ['CCI-001090']
+  tag nist: ['SC-4']
+
+  if virtualization.system.eql?('docker')
+    impact 0.0
+    describe 'Control not applicable within a container' do
+      skip 'Control not applicable within a container'
+    end
+  else
+    dmesg_restrict = 1
+    config_file_values = command('grep -r kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null').stdout.strip.split("\n")
+
+    describe 'kernel.dmesg_restrict' do
+      unless config_file_values.empty?
+        config_file_values.each do |result|
+          incorrect_value_fail_message = "Found value: #{parse_config(result).params.values[0]} in #{parse_config(result).params.keys[0]}"
+          it "should be set to #{dmesg_restrict}" do
+            expect(parse_config(result).params.values[0].to_i).to eq(dmesg_restrict), incorrect_value_fail_message
+          end
+        end
+      end
+    end
+
+    describe 'The runtime kernel parameter kernel.dmesg_restrict' do
+      subject { kernel_parameter('kernel.dmesg_restrict') }
+      its('value') { should eq dmesg_restrict }
+    end
+  end
+end
diff --git a/controls/SV-255928.rb b/controls/SV-255928.rb
new file mode 100644
index 000000000..53e09c7c3
--- /dev/null
+++ b/controls/SV-255928.rb
@@ -0,0 +1,128 @@
+control 'SV-255928' do
+  title 'The Red Hat Enterprise Linux operating system must be configured to prevent overwriting of custom authentication configuration settings by the authconfig utility.'
+  desc 'When using the authconfig utility to modify authentication configuration settings, the "system-auth" and "password-auth" files and any custom settings that they may contain are overwritten. This can be avoided by creating new local configuration files and creating new or moving existing symbolic links to them. The authconfig utility will recognize the local configuration files and not overwrite them, while writing its own settings to the original configuration files.'
+  desc 'check', 'Verify "system-auth" and "password-auth" files are symbolic links pointing to "system-auth-local" and "password-auth-local":
+     $ sudo ls -l /etc/pam.d/{password,system}-auth
+
+     lrwxrwxrwx. 1 root root 30 Apr 1 11:59 /etc/pam.d/password-auth -> /etc/pam.d/password-auth-local
+     lrwxrwxrwx. 1 root root 28 Apr 1 11:59 /etc/pam.d/system-auth -> /etc/pam.d/system-auth-local
+
+If system-auth and password-auth files are not symbolic links, this is a finding.
+
+If system-auth and password-auth are symbolic links but do not point to "system-auth-local" and "password-auth-local", this is a finding.'
+  desc 'fix', 'Create custom configuration files and their corresponding symbolic links:
+
+Rename the existing configuration files (skip this step if symbolic links are already present):
+     $ sudo mv /etc/pam.d/system-auth /etc/pam.d/system-auth-ac
+     $ sudo mv /etc/pam.d/password-auth /etc/pam.d/password-auth-ac
+
+Create custom system-auth configuration file:
+     $ sudo vi /etc/pam.d/system-auth-local
+
+The new file, at minimum, must contain the following lines:
+
+auth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+auth        include       system-auth-ac
+auth        sufficient    pam_unix.so try_first_pass
+auth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+
+account     required      pam_faillock.so
+account     include       system-auth-ac
+
+password    requisite     pam_pwhistory.so use_authtok remember=5 retry=3
+password    include       system-auth-ac
+password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
+
+session     include       system-auth-ac
+
+Create custom password-auth configuration file:
+     $ sudo vi /etc/pam.d/password-auth-local
+
+The new file, at minimum, must contain the following lines:
+
+auth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+auth        include       password-auth-ac
+auth        sufficient    pam_unix.so try_first_pass
+auth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900
+
+account     required      pam_faillock.so
+account     include       password-auth-ac
+
+password    requisite     pam_pwhistory.so use_authtok remember=5 retry=3
+password    include       password-auth-ac
+password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
+
+session     include       password-auth-ac
+
+Create new or move existing symbolic links to the new custom configuration files:
+     $ sudo ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth
+     $ sudo ln -sf /etc/pam.d/password-auth-local /etc/pam.d/password-auth
+
+Once finished you should have the following file structure:
+    $ sudo ls -1 /etc/pam.d/{password,system}-auth*
+
+    /etc/pam.d/password-auth
+    /etc/pam.d/password-auth-ac
+    /etc/pam.d/password-auth-local
+    /etc/pam.d/system-auth
+    /etc/pam.d/system-auth-ac
+    /etc/pam.d/system-auth-local
+
+Done.
+
+Note: With this solution in place any custom settings to "system-auth" and "password-auth" will be retained and not overwritten by the use of the authconfig utility.  The authconfig utility will write its settings to "system-auth-ac" and "password-auth-ac" and continue to function as expected.'
+  impact 0.5
+  tag check_id: 'C-59605r880828_chk'
+  tag severity: 'medium'
+  tag gid: 'V-255928'
+  tag rid: 'SV-255928r880830_rule'
+  tag stig_id: 'RHEL-07-010199'
+  tag gtitle: 'SRG-OS-000073-GPOS-00041'
+  tag fix_id: 'F-59548r880829_fix'
+  tag 'documentable'
+  tag cci: ['CCI-000196']
+  tag nist: ['IA-5 (1) (c)']
+
+  describe file('/etc/pam.d/system-auth') do
+    it { should be_symlink }
+    its('link_path') { should cmp '/etc/pam.d/system-auth-local' }
+  end
+
+  if file('/etc/pam.d/system-auth').symlink? && file('/etc/pam.d/system-auth').link_path == '/etc/pam.d/system-auth-local'
+    describe '/etc/pam.d/system-auth-local should contain the minimum configuration settings' do
+      subject { parse_config_file('/etc/pam.d/system-auth-local').content.strip }
+      it { should match /auth.*required.*pam_faillock.so.*preauth.*silent.*audit.*deny=3.*even_deny_root.*fail_interval=900.*unlock_time=900/ }
+      it { should match /auth.*include.*system-auth-ac/ }
+      it { should match /auth.*sufficient.*pam_unix.so.*try_first_pass/ }
+      it { should match /auth.*default=die.*pam_faillock.so.*authfail.*audit.*deny=3.*even_deny_root.*fail_interval=900.*unlock_time=900/ }
+      it { should match /account.*required.*pam_faillock.so/ }
+      it { should match /account.*include.*system-auth-ac/ }
+      it { should match /password.*requisite.*pam_pwhistory.so.*use_authtok.*remember=5.*retry=3/ }
+      it { should match /password.*include.*system-auth-ac/ }
+      it { should match /password.*sufficient.*pam_unix.so.*sha512.*shadow.*try_first_pass.*use_authtok/ }
+      it { should match /session.*include.*system-auth-ac/ }
+    end
+  end
+
+  describe file('/etc/pam.d/password-auth') do
+    it { should be_symlink }
+    its('link_path') { should cmp '/etc/pam.d/password-auth-local' }
+  end
+
+  if file('/etc/pam.d/password-auth').symlink? && file('/etc/pam.d/password-auth').link_path == '/etc/pam.d/password-auth-local'
+
+    describe '/etc/pam.d/password-auth-local should contain the minimum configuration settings' do
+      subject { parse_config_file('/etc/pam.d/password-auth-local').content.strip }
+      it { should match /auth.*required.*pam_faillock.so.*preauth.*silent.*audit.*deny=3.*even_deny_root.*fail_interval=900.*unlock_time=900/ }
+      it { should match /auth.*include.*password-auth-ac/ }
+      it { should match /auth.*sufficient.*pam_unix.so.*try_first_pass/ }
+      it { should match /auth.*default=die.*pam_faillock.so.*authfail.*audit.*deny=3.*even_deny_root.*fail_interval=900.*unlock_time=900/ }
+      it { should match /account.*required.*pam_faillock.so/ }
+      it { should match /account.*include.*password-auth-ac/ }
+      it { should match /password.*requisite.*pam_pwhistory.so.*use_authtok.*remember=5.*retry=3/ }
+      it { should match /password.*include.*password-auth-ac/ }
+      it { should match /password.*sufficient.*pam_unix.so.*sha512.*shadow.*try_first_pass.*use_authtok/ }
+      it { should match /session.*include.*password-auth-ac/ }
+    end
+  end
+end
diff --git a/ec2.inputs.yml b/ec2.inputs.yml
index bd3d1d302..8f5ea7451 100644
--- a/ec2.inputs.yml
+++ b/ec2.inputs.yml
@@ -2,7 +2,7 @@
 # used in the RHEL 7 DISA STIG.
 
 # Controls that are known to consistently have long run times can be disabled with this attribute
-disable_slow_controls: true
+disable_slow_controls: false
 
 # V-72081 - 'monitor_kernel_log', (bool)
 # Set this to false if your system availability concern is not documented or
@@ -23,10 +23,6 @@ banner_message_enabled: true
 # V-72211 (default: false)
 log_aggregation_server: false
 
-# V-72047 (default: [])
-# Known application groups that are allowed to have world-writeable files or directories
-application_groups: []
-
 # V-72307
 x11_enabled: false
 
@@ -151,10 +147,6 @@ difok: 8
 # number of reuse generations
 min_reuse_generations: 5
 
-# V-71935
-# (number of characters)
-min_len: 15
-
 # V-71941
 # (number of days)
 days_of_inactivity: 0
@@ -203,16 +195,9 @@ exempt_home_users: []
 # main grub boot config file
 grub_main_cfg: "/boot/grub2/grub.cfg"
 
-# superusers for grub boot ( array )
-grub_superusers: ["root", "ec2-user"]
-
 # grub boot config files
 grub_user_boot_files: ["/boot/grub2/user.cfg"]
 
-# V-71963
-# superusers for efi boot ( array )
-efi_superusers: ["root", ec2-user]
-
 # efi boot config files
 efi_user_boot_files: ["/boot/efi/EFI/redhat/user.cfg"]
 
diff --git a/inspec.yml b/inspec.yml
index 3fda0c884..a30c2a231 100644
--- a/inspec.yml
+++ b/inspec.yml
@@ -19,54 +19,59 @@ supports:
 # The following defines the default inputs for the configurable controls used in the RHEL 7 DISA STIG.
 inputs:
   - name: disable_slow_controls
-    description: Controls that are known to consistently have long run times can be disabled with this attribute
+    desc: Controls that are known to consistently have long run times can be disabled with this attribute
     type: Boolean
     value: false
 
-  # V-204504
+  # SV-204504
   - name: monitor_kernel_log
-    description: Set this to false if your system availability concern is not documented or there is no monitoring of the kernel log
+    desc: Set this to false if your system availability concern is not documented or there is no monitoring of the kernel log
     type: Boolean
     value: true
 
-  # V-204392
-  - name: rpm_verify_perms_except
-    description: List of system files that should be allowed to change from an rpm verify point of view
+  # SV-204392
+  - name: rpm_verify_ownership_except
+    desc: List of system files that should be allowed to have a different ownership from the default as determined by 'rpm verify'
     type: Array
-    value:
-      - "/etc/issue"
+    value: []
 
-  # V-214799
+  # SV-204392
+  - name: rpm_verify_group_membership_except
+    desc: List of system files that should be allowed to have a different group membership from the default as determined by 'rpm verify'
+    type: Array
+    value: []
+
+  # SV-214799
   - name: rpm_verify_integrity_except
-    description: List of system files that should be allowed to change from an rpm verify point of view
+    desc: List of system files that should be allowed to change from an rpm verify point of view
     type: Array
     value: []
 
-  # V-204393
+  # SV-204393
   - name: banner_message_enabled
-    description: Set to 'true' if the login banner message should be enabled
+    desc: Set to 'true' if the login banner message should be enabled
     type: Boolean
     value: true
 
-  # V-204575
+  # SV-204575
   - name: log_aggregation_server
-    description: Set to 'true' if the system is being used as a log aggregation server
+    desc: Set to 'true' if the system is being used as a log aggregation server
     type: Boolean
     value: false
 
-  # V-204624
+  # SV-204624
   - name: x11_enabled
-    description: Set to 'true' if X11 is needed on the system.
+    desc: Set to 'true' if X11 is needed on the system.
     type: Boolean
     value: false
 
   - name: user_accounts
-    description: Accounts of known managed users
+    desc: Accounts of known managed users
     type: Array
     value: []
 
   - name: known_system_accounts
-    description: System accounts that support approved system activities.
+    desc: System accounts that support approved system activities.
     type: Array
     value:
       - "root"
@@ -90,9 +95,9 @@ inputs:
       - "sshd"
       - "ntp"
 
-  # V-204393/V-204397
+  # SV-204393/SV-204397
   - name: dconf_user
-    description: User to use to check dconf settings. Nil means to use whatever user is running inspec currently.
+    desc: User to use to check dconf settings. Nil means to use whatever user is running inspec currently.
     type: String
     value: ""
 
@@ -106,7 +111,7 @@ inputs:
 
   # SV-204394
   - name: banner_message_text_gui
-    description: Banner message text for graphical user interface logins.
+    desc: Banner message text for graphical user interface logins.
     type: String
     value:
       "You are accessing a U.S. Government (USG) Information System (IS) that is \
@@ -129,13 +134,13 @@ inputs:
       Agreement for details."
 
   - name: banner_message_text_gui_limited
-    description: Banner message text for limited-resource graphical user interface logins.
+    desc: Banner message text for limited-resource graphical user interface logins.
     type: String
     value: "I've read & consent to terms in IS user agreem't."
 
   # SV-204395
   - name: banner_message_text_cli
-    description: Banner message text for command line interface logins.
+    desc: Banner message text for command line interface logins.
     type: String
     value:
       "You are accessing a U.S. Government (USG) Information System (IS) that is \
@@ -158,13 +163,13 @@ inputs:
       Agreement for details."
 
   - name: banner_message_text_cli_limited
-    description: Banner message text for resource-limited command line interface logins.
+    desc: Banner message text for resource-limited command line interface logins.
     type: String
     value: "I've read & consent to terms in IS user agreem't."
 
   # SV-204580
   - name: banner_message_text_ral
-    description: Banner message text for remote access logins.
+    desc: Banner message text for remote access logins.
     type: String
     value:
       "You are accessing a U.S. Government (USG) Information System (IS) that is \
@@ -187,217 +192,144 @@ inputs:
       Agreement for details."
 
   - name: banner_message_text_ral_limited
-    description: Banner message text for resource-limited remote access logins.
+    desc: Banner message text for resource-limited remote access logins.
     type: String
     value: "I've read & consent to terms in IS user agreem't."
 
   # SV-204404
-  - name: expected_lock_delay
-    description: Expected value for the screensaver lock-delay
+  - name: lock_delay
+    desc: Maximum value for the screensaver lock-delay
     type: Numeric
     value: 5
 
-  # SV-204404
-  - name: expected_lock_delay
-    description: Maximum screensaver lock-delay, by policy
-    type: Numeric
-    value: 5
-
-  # SV-204411
-  - name: expected_difok
-    description: Number of characters that must be different from previous password
-    type: Numeric
-    value: 8
-
   # SV-204411
-  - name: max_difok
-    description: Minimum number of characters that must be different from previous password, by policy
+  - name: difok
+    desc: Minimum number of characters that must be different from previous password, by policy
     type: Numeric
     value: 8
 
   # SV-204413
-  - name: expected_passwd_repeats
-    description: Number of allowed same consecutive characters in a new password
+  - name: passwd_repeats
+    desc: Maximum number of allowed same consecutive characters in a new password, by policy
     type: Numeric
     value: 3
 
-  # SV-204413
-  - name: max_passwd_repeats
-    description: Maximum number of allowed same consecutive characters in a new password, by policy
-    type: Numeric
-    value: 3
-
-  # SV-204422
-  - name: expected_reuse_generations
-    description: Number of reuse generations for passwords
-    type: Numeric
-    value: 5
-
   # SV-204422
   - name: min_reuse_generations
-    description: Minimum number of reuse generations for passwords by policy
+    desc: Minimum number of reuse generations for passwords by policy
     type: Numeric
     value: 5
 
   # SV-204423
-  - name: expected_minlen
-    description: Expected value for the minimum number of characters a password needs
-    type: Numeric
-    value: 15
-
-  # SV-204423
-  - name: min_minlen
-    description: Minimum number of characters a password needs, by policy
+  - name: min_len
+    desc: Minimum number of characters a password needs, by policy
     type: Numeric
     value: 15
 
   # SV-204426
-  - name: expected_days_of_inactivity
-    description: System setting for number of days an account can stay inactive before deactivation.
+  - name: days_of_inactivity
+    desc: Maximum allowable number of days an account can stay inactive before deactivation.
     type: Numeric
     value: 35
 
-  # SV-204426
-  - name: max_days_of_inactivity
-    description: Maximum allowable number of days an account can stay inactive before deactivation.
-    type: Numeric
-    value: 35
-
-  # SV-204427
-  - name: expected_unsuccessful_attempts
-    description: number of unsuccessful attempts
+  - name: unsuccessful_attempts
+    desc: Maximum number of unsuccessful attempts by policy
     type: Numeric
     value: 3
 
-  - name: expected_fail_interval
-    description: Interval of time in which the consecutive failed logon attempts must occur in order for the account to be locked out (time in seconds)
+  - name: fail_interval
+    desc: Maximum interval of time, according to policy, in which the consecutive failed logon attempts must occur in order for the account to be locked out (time in seconds)
     type: Numeric
     value: 900
 
-  - name: expected_lockout_time
-    description: Amount of time account must be locked out after failed logins. This attribute should never be set greater than 604800 (time in seconds).
+  - name: lockout_time
+    desc: Minimum amount of time account must be locked out after failed logins by policy. This attribute should never be set greater than 604800 (time in seconds).
     value: 604800
 
-  - name: max_unsuccessful_attempts
-    description: Maximum number of unsuccessful attempts by policy
-    type: Numeric
-    value: 3
-
-  - name: max_fail_interval
-    description: Maximum interval of time, according to policy, in which the consecutive failed logon attempts must occur in order for the account to be locked out (time in seconds)
-    type: Numeric
-    value: 900
-
-  - name: min_lockout_time
-    description: Minimum amount of time account must be locked out after failed logins by policy. This attribute should never be set greater than 604800 (time in seconds).
-    value: 604800
-
-  # SV-204445
+  # SV-204445 SV-251705
   - name: file_integrity_tool
-    description: Name of tool
+    desc: Name of tool
     type: String
     value: "aide"
 
+  # SV-204498 SV-204499 SV-204500
+  - name: aide_conf_path
+    desc: Path to the aide.conf file
+    type: String
+    value: "/etc/aide.conf"
+
+  # SV-204445
   - name: file_integrity_interval
-    description: Interval to run the file integrity tool (monthly, weekly, or daily).
+    desc: Interval to run the file integrity tool (monthly, weekly, or daily).
     type: String
     value: "weekly"
 
   # SV-204579
-  - name: expected_system_activity_timeout
-    description: System activity timeout (time in seconds).
-    type: Numeric
-    value: 600
-
-  # SV-204579
-  - name: max_system_activity_timeout
-    description: Maximum system activity timeout (time in seconds) allowed by policy.
-    type: Numeric
-    value: 600
-
-  # SV-204587
-  - name: expected_client_alive_interval
-    description: Expected specific value of the client alive interval (time in seconds).
+  - name: system_activity_timeout
+    desc: System activity timeout (time in seconds).
     type: Numeric
     value: 600
 
   # SV-204587
-  - name: max_client_alive_interval
-    description: Maximum allowed client alive interval (time in seconds).
+  - name: client_alive_interval
+    desc: Value of the client alive interval (time in seconds).
     type: Numeric
     value: 600
 
-  # V-204441, V-204631, V-204633
+  # SV-204441, SV-204631, SV-204633
   - name: smart_card_status
-    description: Smart card status (enabled or disabled)
+    desc: Smart card status (enabled or disabled)
     type: String
     value: "enabled"
 
   # SV-204489/V-204574
   - name: log_pkg_paths
-    description: Paths to files and directories that may include logging config
+    desc: Paths to files and directories that may include logging config
     type: Array
     value:
       - "/etc/rsyslog.conf"
       - "/etc/rsyslog.d/*"
 
-  # V-204467, V-204468, V-204469, V-204470, V-204471, V-204472
-  # V-204473, V-204474, V-204475, V-204476, V-204477, V-204478, V-204493
+  # SV-204467, SV-204468, SV-204469, SV-204470, SV-204471, SV-204472
+  # SV-204473, SV-204474, SV-204475, SV-204476, SV-204477, SV-204478, SV-204493
   - name: exempt_home_users
-    description: Users exempt from home directory-based controls in array format
+    desc: Users exempt from home directory-based controls in array format
     type: Array
     value: []
 
-  # V-204436
+  # SV-244557
   - name: grub_main_cfg
-    description: Main grub boot config file
+    desc: Main grub boot config file
     type: String
     value: "/boot/grub2/grub.cfg"
 
+  # SV-204440 SV-244558
   - name: grub_uefi_main_cfg
-    description: Main grub boot config file
+    desc: Main grub boot config file
     type: String
     value: "/boot/efi/EFI/redhat/grub.cfg"
 
-  - name: grub_superuser
-    description: superusers for grub boot
-    type: String
-    value: "root"
-
   - name: grub_user_boot_files
-    description: Grub boot config files
+    desc: Grub boot config files
     type: Array
     value:
       - "/boot/grub2/user.cfg"
 
   - name: grub_uefi_user_boot_files
-    description: Grub boot config files
+    desc: Grub boot config files
     type: Array
     value:
       - "/boot/efi/EFI/redhat/user.cfg"
 
-  # V-204439
-  - name: efi_superusers
-    description: Superusers for efi boot
-    type: Array
-    value:
-      - "root"
-
-  # V-204444
+  # SV-204444
   - name: admin_logins
-    description: System accounts that support approved system activities
+    desc: System accounts that support approved system activities
     type: Array
     value: []
 
-  # V-204406
-  - name: max_rety
-    description: Maximum number of times to prompt user for new password
-    type: Numeric
-    value: 3
-
-  # V-204631
+  # SV-204631
   - name: mfa_pkg_list
-    description: The list of packages needed for MFA on RHEL
+    desc: The list of packages (including dependencies) needed for MFA
     type: Array
     value:
       - "nss-tools"
@@ -416,14 +348,14 @@ inputs:
       - "pcsc-lite"
       - "pcsc-lite-libs"
 
-  # V-204397
+  # SV-204397
   - name: multifactor_enabled
-    description: Should dconf have smart card authentication
+    desc: Should dconf have smart card authentication
     type: Boolean
     value: true
 
   - name: non_interactive_shells
-    description: These shells do not allow a user to login
+    desc: These shells do not allow a user to login
     type: Array
     value:
       - "/sbin/nologin"
@@ -433,15 +365,15 @@ inputs:
       - "/bin/sync"
       - "/bin/true"
 
-  # V-204493
+  # SV-204584
   - name: randomize_va_space
-    description: Randomize virtual address space kernel parameter
+    desc: Randomize virtual address space kernel parameter
     type: Numeric
     value: 2
 
-  # V-204488
+  # SV-204481
   - name: non_removable_media_fs
-    description: File systems that don't correspond to removable media
+    desc: File systems that don't correspond to removable media
     type: Array
     value:
       - "xfs"
@@ -449,33 +381,33 @@ inputs:
       - "swap"
       - "tmpfs"
 
-  # V-204629
+  # SV-204629
   - name: approved_tunnels
-    description: Approved configured tunnels prepended with word 'conn' (e.g., ['conn myTunnel'])
+    desc: Approved configured tunnels prepended with word 'conn' (e.g., ['conn myTunnel'])
     type: Array
     value: []
 
-  # V-204479
+  # SV-204479
   - name: virtual_machine
-    description: Is the target expected to be a virtual machine
+    desc: Is the target expected to be a virtual machine
     type: Boolean
     value: false
 
   # SV-204406
   - name: retry
-    description: number of allowed password retries
+    desc: number of allowed password retries
     type: Numeric
     value: 3
 
   # SV-204406
   - name: max_retry
-    description: maximum number of password retries by policy
+    desc: maximum number of password retries by policy
     type: Numeric
     value: 3
 
-  # V-204628
+  # SV-204628, SV-204577
   - name: firewalld_services
-    description: "Services that firewalld should be configured to allow."
+    desc: "Services that firewalld should be configured to allow."
     type: Array
     # Examples
     # 'dhcpv6-client',
@@ -483,17 +415,17 @@ inputs:
     value: []
 
   - name: firewalld_hosts_allow
-    description: "Hosts that firewalld should be configured to allow."
+    desc: "Hosts that firewalld should be configured to allow."
     type: Array
     value: []
 
   - name: firewalld_hosts_deny
-    description: "Hosts that firewalld should be configured to deny."
+    desc: "Hosts that firewalld should be configured to deny."
     type: Array
     value: []
 
   - name: firewalld_ports_allow
-    description: "Ports that firewalld should be configured to allow."
+    desc: "Ports that firewalld should be configured to allow."
     type: Array
     # Examples
     # '22/tcp',
@@ -501,7 +433,7 @@ inputs:
     value: []
 
   - name: firewalld_ports_deny
-    description: "Ports that firewalld should be configured to deny."
+    desc: "Ports that firewalld should be configured to deny."
     type: Hash
     # Examples
     # 'public':
@@ -510,7 +442,7 @@ inputs:
     value: {}
 
   - name: tcpwrappers_allow
-    description: "Allow rules from etc/hosts.allow."
+    desc: "Allow rules from etc/hosts.allow."
     # Example
     # 'daemon': 'ALL'
     # 'client_list':
@@ -520,7 +452,7 @@ inputs:
     value: {}
 
   - name: tcpwrappers_deny
-    description: "Deny rules from etc/hosts.deny."
+    desc: "Deny rules from etc/hosts.deny."
     type: Hash
     # Example
     # 'daemon': 'ALL'
@@ -530,15 +462,15 @@ inputs:
     value: {}
 
   - name: iptables_rules
-    description: "Iptable rules that should exist."
+    desc: "Iptable rules that should exist."
     type: Array
     # Example
     # '-P INPUT ACCEPT',
     value: []
 
-  # V-204577
+  # SV-204577
   - name: firewalld_services_deny
-    description: "Services that firewalld should be configured to deny."
+    desc: "Services that firewalld should be configured to deny."
     type: Hash
     # Examples (zone:[services])
     # public:
@@ -549,7 +481,7 @@ inputs:
     value: {}
 
   - name: firewalld_zones
-    description: "Zones that should be present on the system."
+    desc: "Zones that should be present on the system."
     type: Array
     # Examples
     # - 'drop'
@@ -565,48 +497,42 @@ inputs:
 
   # SV-204604
   - name: firewall_application_package
-    description: "If a third-party firewall application is in use (other than firewalld or iptables), indicate the package name here. Otherwise, set this value to an empty string"
+    desc: "If a third-party firewall application is in use (other than firewalld or iptables), indicate the package name here. Otherwise, set this value to an empty string"
     type: String
     value: ""
 
   # SV-204604
   - name: firewall_application_service
-    description: "If a third-party firewall application is in use (other than firewalld or iptables), indicate the service name here. Otherwise, set this value to an empty string"
+    desc: "If a third-party firewall application is in use (other than firewalld or iptables), indicate the service name here. Otherwise, set this value to an empty string"
     type: String
     value: ""
 
   # SV-204576
-  - name: expected_maxlogins_limit
-    description: "Expected value for the maxlogins setting."
-    type: Numeric
-    value: 10
-
-  # SV-204576
-  - name: max_maxlogins_limit
-    description: "The maxium value that can be used for maxlogins by policy."
+  - name: maxlogins_limit
+    desc: "Value for the maxlogins setting."
     type: Numeric
     value: 10
 
   # SV-214801
   - name: custom_antivirus
-    description: "Whether an antivirus solution, other than nails, is in use."
+    desc: "Whether an antivirus solution, other than nails, is in use."
     type: Boolean
     value: false
 
   - name: custom_antivirus_description
-    description: "Description of custom antivirus solution, when in use."
+    desc: "Description of custom antivirus solution, when in use."
     type: String
     # Default of 'None' is used by control code -- DO NOT CHANGE DEFAULT
     value: "None"
 
   # SV-204500
   - name: aide_exclude_patterns
-    description: "It is reasonable and advisable to skip checksum on frequently changing files"
+    desc: "It is reasonable and advisable to skip checksum on frequently changing files"
     type: Array
     value: []
 
   - name: required_rules
-    description: "Required PAM rules"
+    desc: "Required PAM rules"
     type: Array
     value:
       - "auth required pam_faillock.so unlock_time=.*"
@@ -614,7 +540,7 @@ inputs:
       - "auth [default=die] pam_faillock.so unlock_time=.*"
 
   - name: alternate_rules
-    description: "Alternate PAM rules"
+    desc: "Alternate PAM rules"
     type: Array
     value:
       - "auth required pam_faillock.so unlock_time=.*"
@@ -622,198 +548,157 @@ inputs:
       - "auth sufficient pam_unix.so try_first_pass"
       - "auth [default=die] pam_faillock.so unlock_time=.*"
 
-  - name: data_loss_prevention_installed
-    description: "is an HBSS with a Device Control Module and a Data Loss Prevention mechanism"
-    type: Boolean
-    value: true
-
   - name: alternate_logs
-    description: "An alternate method is used for logs than rsyslog"
+    desc: "An alternate method is used for logs than rsyslog"
     type: Boolean
     value: false
 
   - name: gssapi_approved
-    description: "is GSSAPI authentication approved"
+    desc: "is GSSAPI authentication approved"
     type: Boolean
     value: true
 
   - name: disconnected_system
-    description: "Set flag to true if the target system is disconnected"
+    desc: "Set flag to true if the target system is disconnected"
     type: Boolean
     value: false
 
   # SV-219059
   - name: automount_config
-    description: "Full path to config file for automount settings"
+    desc: "Full path to config file for automount settings"
     type: String
     value: "/etc/dconf/db/local.d/00-No-Automount"
 
   # SV-219059
   - name: automount_locks_config
-    description: "Full path to locks config file for automount settings"
+    desc: "Full path to locks config file for automount settings"
     type: String
     value: "/etc/dconf/db/local.d/locks/00-No-Automount"
 
-  # SV-204414
-  - name: classrepeat
-    description: "Expected system setting for the maximum number of allowed same consecutive characters in the same class of a new password. Maximum of 4"
-    type: Numeric
-    value: 4
-
   # SV-204414
   - name: max_classrepeat
-    description: "Maximum allowable value for classrepeat by policy."
+    desc: "System setting for the maximum number of allowed same consecutive characters in the same class of a new password."
     type: Numeric
     value: 4
 
   #SV-204603
   - name: maxpoll
-    description: "This option specifies the maximum interval between requests sent to the NTP server as a power of 2 in seconds."
+    desc: "This option specifies the maximum interval between requests sent to the NTP server as a power of 2 in seconds."
     type: Numeric
     value: 16
 
   #SV-204420
   - name: pass_max_days
-    description: "Password lifetime restriction for new user accounts"
-    type: Numeric
-    value: 60
-
-  #SV-204420
-  - name: max_pass_max_days
-    description: "Maximum password lifetime restriction for new user accounts, by policy"
+    desc: "Password lifetime restriction for new user accounts"
     type: Numeric
     value: 60
 
   #SV-204431
   - name: fail_delay
-    description: "Expected value for the delay between logon prompts following a failed console logon attempt in seconds"
-    type: Numeric
-    value: 4
-
-  #SV-204431
-  - name: min_fail_delay
-    description: "Minimum value for the delay between logon prompts following a failed console logon attempt in seconds, by policy"
+    desc: "Value for the delay between logon prompts following a failed console logon attempt in seconds"
     type: Numeric
     value: 4
 
   # SV-204468
   - name: home_dir_mode
-    description: Maximum mode allowed for user home directories (in octal format)
+    desc: Maximum mode allowed for user home directories (in octal format)
     type: String
     value: "0750"
 
   # SV-204473
   - name: home_dir_files_mode
-    description: Maximum mode allowed for files contained within user home directories (in octal format)
+    desc: Maximum mode allowed for files contained within user home directories (in octal format)
     type: String
     value: "0750"
 
   # SV-204476
   - name: init_files_mode
-    description: Maximum mode allowed for initialization files (in octal format)
+    desc: Maximum mode allowed for initialization files (in octal format)
     type: String
     value: "0740"
 
   # SV-204476
   - name: user_umask
-    description: Expected value for all user UMASK values (in octal format)
+    desc: Expected value for all user UMASK values (in octal format)
     type: String
     value: "0077"
 
   # SV-204509
   - name: audit_remote_server
-    description: "Address of the remote server to which audit logs can be sent -- if left blank, control will check that any non-local server is in use"
+    desc: "Address of the remote server to which audit logs can be sent -- if left blank, control will check that any non-local server is in use"
     type: String
     value: ""
 
   # SV-204511
   - name: expected_disk_full_action
-    description: "Action that the server should take to preserve audit logs when the disk becomes full -- must be one of syslog, single, halt"
+    desc: "Action that the server should take to preserve audit logs when the disk becomes full -- must be one of syslog, single, halt"
     type: String
     value: "single"
 
   # SV-204512
   - name: expected_network_failure_action
-    description: "Action that the server should take to preserve audit logs when the network fails -- must be one of syslog, single, halt"
+    desc: "Action that the server should take to preserve audit logs when the network fails -- must be one of syslog, single, halt"
     type: String
     value: "single"
 
   #SV-204513
   - name: min_space_left
-    description: "Minimum percentage for the space remaining in the audit log file before an alert is generated"
+    desc: "Minimum percentage for the space remaining in the audit log file before an alert is generated"
     type: Numeric
     value: 25
 
-  # SV-204581
+  # SV-204596
   - name: public_host_key_file_mode
-    description: Maximum mode allowed for directories containing SSH public host keys (in octal format)
+    desc: Maximum mode allowed for directories containing SSH public host keys (in octal format)
     type: String
     value: "0644"
 
-  # SV-204581
+  # SV-204596
   - name: public_host_key_directories
-    description: "List of any directories containing SSH public host keys"
+    desc: "List of any directories containing SSH public host keys"
     type: Array
     value:
       - /etc/ssh
 
-  # SV-204596
+  # SV-204597
   - name: private_host_key_file_mode
-    description: Maximum mode allowed for directories containing SSH private host keys (in octal format)
+    desc: Maximum mode allowed for directories containing SSH private host keys (in octal format)
     type: String
     value: "0640"
 
-  # SV-204596
+  # SV-204597
   - name: private_host_key_directories
-    description: "List of any directories containing SSH private host keys"
+    desc: "List of any directories containing SSH private host keys"
     type: Array
     value:
       - /
 
-  # SV-228564
-  - name: expected_audit_file_mode
-    description: Expected mode for the audit log (in octal format)
-    type: String
-    value: "0600"
-
   # SV-228564
   - name: max_audit_file_mode
-    description: Maximum mode allowed for the audit log (in octal format)
+    desc: Maximum mode allowed for the audit log (in octal format)
     type: String
     value: "0600"
 
   #SV-204412
-  - name: expected_minclass
-    description: "Value for the minimum number of characters that must change between password resets"
-    type: Numeric
-    value: 4
-
-  #SV-204412
-  - name: min_minclass
-    description: "Minimum value for the minimum number of characters that must change between password resets, as allowed by policy"
+  - name: minclass
+    desc: "Value for the minimum number of characters that must change between password resets"
     type: Numeric
     value: 4
 
-  #SV-204419
-  - name: expected_password_lifetime
-    description: "Expected value for the minimum lifetime of a password before it can be a reset"
-    type: Numeric
-    value: 1
-
   #SV-204419
   - name: min_password_lifetime
-    description: "Minimum value for the lifetime of a password before it needs a reset, as allowed by policy"
+    desc: "Minimum lifetime of a password before it can be a reset"
     type: Numeric
     value: 1
 
-  #SV-204421
-  - name: expected_max_password_lifetime
-    description: "Expected value for the maximum lifetime of a password before it needs a reset"
-    type: Numeric
-    value: 60
-
   #SV-204421
   - name: max_password_lifetime
-    description: "Maximum value for the maximum lifetime of a password before it needs a reset, as allowed by policy"
+    desc: "Maximum lifetime of a password before it needs a reset"
     type: Numeric
     value: 60
+  
+  #SV-254523
+  - name: emergency_accounts
+    desc: Emergency user accounts
+    type: Array
+    value: []
diff --git a/kitchen.inputs.yml b/kitchen.inputs.yml
index c06987460..a064f2325 100644
--- a/kitchen.inputs.yml
+++ b/kitchen.inputs.yml
@@ -2,7 +2,7 @@
 # used in the RHEL 7 DISA STIG.
 
 # Controls that are known to consistently have long run times can be disabled with this attribute
-disable_slow_controls: true
+disable_slow_controls: false
 
 # V-72081 - 'monitor_kernel_log', (bool)
 # Set this to false if your system availability concern is not documented or
@@ -23,10 +23,6 @@ banner_message_enabled: true
 # V-72211 (default: false)
 log_aggregation_server: false
 
-# V-72047 (default: [])
-# Known application groups that are allowed to have world-writeable files or directories
-application_groups: []
-
 # V-72307
 x11_enabled: false
 
@@ -150,10 +146,6 @@ difok: 8
 # number of reuse generations
 min_reuse_generations: 5
 
-# V-71935
-# (number of characters)
-min_len: 15
-
 # V-71941
 # (number of days)
 days_of_inactivity: 0
@@ -202,16 +194,9 @@ exempt_home_users: []
 # main grub boot config file
 grub_main_cfg: "/boot/grub2/grub.cfg"
 
-# superusers for grub boot ( array )
-grub_superusers: ["root"]
-
 # grub boot config files
 grub_user_boot_files: ["/boot/grub2/user.cfg"]
 
-# V-71963
-# superusers for efi boot ( array )
-efi_superusers: ["root"]
-
 # efi boot config files
 efi_user_boot_files: ["/boot/efi/EFI/redhat/user.cfg"]
 
diff --git a/libraries/pam.rb b/libraries/pam.rb
index 95ae77cb7..bf9ed275f 100644
--- a/libraries/pam.rb
+++ b/libraries/pam.rb
@@ -173,7 +173,7 @@ def services
     def service
       svcs = self.collect{|l| l.service}.sort.uniq
       if svcs.length > 1
-        raise PamError, %(More than one service found: '[#{svcs.join("', '")}]')
+        raise PamError, %q(More than one service found: '[#{svcs.join("', '")}]')
       end
 
       svcs.first
diff --git a/mockreport.json b/mockreport.json
new file mode 100644
index 000000000..9498c5a6b
--- /dev/null
+++ b/mockreport.json
@@ -0,0 +1 @@
+{"platform":{"name":"mock","release":"unknown"},"profiles":[{"name":"RHEL_7_STIG","version":"3.6.0","sha256":"e027c00d7c4c025873e9e5fadacc6cc75a98ca3657b5ea5e6bb0516a0eae8e34","title":"Red Hat Enterprise Linux 7 Security Technical Implementation Guide","maintainer":"MITRE SAF Team","summary":"Inspec Validation Profile for Red Hat Enterprise Linux 7 STIG","license":"Apache-2.0","copyright":"MITRE, 2022","copyright_email":"saf@groups.mitre.org","supports":[{"platform-name":"centos","release":"7.*"},{"platform-name":"redhat","release":"7.*"},{"platform-name":"amazon","release":"2*"}],"attributes":[{"name":"disable_slow_controls","options":{"type":"Boolean","value":false}},{"name":"monitor_kernel_log","options":{"type":"Boolean","value":true}},{"name":"rpm_verify_perms_except","options":{"type":"Array","value":["/etc/issue"]}},{"name":"rpm_verify_integrity_except","options":{"type":"Array","value":[]}},{"name":"banner_message_enabled","options":{"type":"Boolean","value":true}},{"name":"log_aggregation_server","options":{"type":"Boolean","value":false}},{"name":"x11_enabled","options":{"type":"Boolean","value":false}},{"name":"user_accounts","options":{"type":"Array","value":[]}},{"name":"known_system_accounts","options":{"type":"Array","value":["root","bin","daemon","adm","lp","sync","shutdown","halt","mail","operator","nobody","systemd-bus-proxy","dbus","polkitd","postfix","sssd","chrony","systemd-network","sshd","ntp"]}},{"name":"dconf_user","options":{"type":"String","value":""}},{"name":"banner_message_text_gui","options":{"type":"String","value":"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."}},{"name":"banner_message_text_gui_limited","options":{"type":"String","value":"I've read & consent to terms in IS user agreem't."}},{"name":"banner_message_text_cli","options":{"type":"String","value":"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."}},{"name":"banner_message_text_cli_limited","options":{"type":"String","value":"I've read & consent to terms in IS user agreem't."}},{"name":"banner_message_text_ral","options":{"type":"String","value":"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."}},{"name":"banner_message_text_ral_limited","options":{"type":"String","value":"I've read & consent to terms in IS user agreem't."}},{"name":"expected_lock_delay","options":{"type":"Numeric","value":5}},{"name":"expected_difok","options":{"type":"Numeric","value":8}},{"name":"max_difok","options":{"type":"Numeric","value":8}},{"name":"expected_passwd_repeats","options":{"type":"Numeric","value":3}},{"name":"max_passwd_repeats","options":{"type":"Numeric","value":3}},{"name":"expected_reuse_generations","options":{"type":"Numeric","value":5}},{"name":"min_reuse_generations","options":{"type":"Numeric","value":5}},{"name":"expected_minlen","options":{"type":"Numeric","value":15}},{"name":"min_minlen","options":{"type":"Numeric","value":15}},{"name":"expected_days_of_inactivity","options":{"type":"Numeric","value":35}},{"name":"max_days_of_inactivity","options":{"type":"Numeric","value":35}},{"name":"expected_unsuccessful_attempts","options":{"type":"Numeric","value":3}},{"name":"expected_fail_interval","options":{"type":"Numeric","value":900}},{"name":"expected_lockout_time","options":{"value":604800}},{"name":"max_unsuccessful_attempts","options":{"type":"Numeric","value":3}},{"name":"max_fail_interval","options":{"type":"Numeric","value":900}},{"name":"min_lockout_time","options":{"value":604800}},{"name":"file_integrity_tool","options":{"type":"String","value":"aide"}},{"name":"file_integrity_interval","options":{"type":"String","value":"weekly"}},{"name":"expected_system_activity_timeout","options":{"type":"Numeric","value":600}},{"name":"max_system_activity_timeout","options":{"type":"Numeric","value":600}},{"name":"expected_client_alive_interval","options":{"type":"Numeric","value":600}},{"name":"max_client_alive_interval","options":{"type":"Numeric","value":600}},{"name":"smart_card_status","options":{"type":"String","value":"enabled"}},{"name":"log_pkg_paths","options":{"type":"Array","value":["/etc/rsyslog.conf","/etc/rsyslog.d/*"]}},{"name":"exempt_home_users","options":{"type":"Array","value":[]}},{"name":"grub_main_cfg","options":{"type":"String","value":"/boot/grub2/grub.cfg"}},{"name":"grub_uefi_main_cfg","options":{"type":"String","value":"/boot/efi/EFI/redhat/grub.cfg"}},{"name":"grub_superuser","options":{"type":"String","value":"root"}},{"name":"grub_user_boot_files","options":{"type":"Array","value":["/boot/grub2/user.cfg"]}},{"name":"grub_uefi_user_boot_files","options":{"type":"Array","value":["/boot/efi/EFI/redhat/user.cfg"]}},{"name":"efi_superusers","options":{"type":"Array","value":["root"]}},{"name":"admin_logins","options":{"type":"Array","value":[]}},{"name":"max_rety","options":{"type":"Numeric","value":3}},{"name":"mfa_pkg_list","options":{"type":"Array","value":["nss-tools","nss-pam-ldapd","esc","pam_pkcs11","pam_krb5","opensc","pcsc-lite-ccid","gdm","authconfig","authconfig-gtk","krb5-libs","krb5-workstation","krb5-pkinit","pcsc-lite","pcsc-lite-libs"]}},{"name":"multifactor_enabled","options":{"type":"Boolean","value":true}},{"name":"non_interactive_shells","options":{"type":"Array","value":["/sbin/nologin","/sbin/halt","/sbin/shutdown","/bin/false","/bin/sync","/bin/true"]}},{"name":"randomize_va_space","options":{"type":"Numeric","value":2}},{"name":"non_removable_media_fs","options":{"type":"Array","value":["xfs","ext4","swap","tmpfs"]}},{"name":"approved_tunnels","options":{"type":"Array","value":[]}},{"name":"virtual_machine","options":{"type":"Boolean","value":false}},{"name":"retry","options":{"type":"Numeric","value":3}},{"name":"max_retry","options":{"type":"Numeric","value":3}},{"name":"firewalld_services","options":{"type":"Array","value":[]}},{"name":"firewalld_hosts_allow","options":{"type":"Array","value":[]}},{"name":"firewalld_hosts_deny","options":{"type":"Array","value":[]}},{"name":"firewalld_ports_allow","options":{"type":"Array","value":[]}},{"name":"firewalld_ports_deny","options":{"type":"Hash","value":{}}},{"name":"tcpwrappers_allow","options":{"type":"Hash","value":{}}},{"name":"tcpwrappers_deny","options":{"type":"Hash","value":{}}},{"name":"iptables_rules","options":{"type":"Array","value":[]}},{"name":"firewalld_services_deny","options":{"type":"Hash","value":{}}},{"name":"firewalld_zones","options":{"type":"Array","value":[]}},{"name":"firewall_application_package","options":{"type":"String","value":""}},{"name":"firewall_application_service","options":{"type":"String","value":""}},{"name":"expected_maxlogins_limit","options":{"type":"Numeric","value":10}},{"name":"max_maxlogins_limit","options":{"type":"Numeric","value":10}},{"name":"custom_antivirus","options":{"type":"Boolean","value":false}},{"name":"custom_antivirus_description","options":{"type":"String","value":"None"}},{"name":"aide_exclude_patterns","options":{"type":"Array","value":[]}},{"name":"required_rules","options":{"type":"Array","value":["auth required pam_faillock.so unlock_time=.*","auth sufficient pam_unix.so try_first_pass","auth [default=die] pam_faillock.so unlock_time=.*"]}},{"name":"alternate_rules","options":{"type":"Array","value":["auth required pam_faillock.so unlock_time=.*","auth sufficient pam_sss.so forward_pass","auth sufficient pam_unix.so try_first_pass","auth [default=die] pam_faillock.so unlock_time=.*"]}},{"name":"data_loss_prevention_installed","options":{"type":"Boolean","value":true}},{"name":"alternate_logs","options":{"type":"Boolean","value":false}},{"name":"gssapi_approved","options":{"type":"Boolean","value":true}},{"name":"disconnected_system","options":{"type":"Boolean","value":false}},{"name":"automount_config","options":{"type":"String","value":"/etc/dconf/db/local.d/00-No-Automount"}},{"name":"automount_locks_config","options":{"type":"String","value":"/etc/dconf/db/local.d/locks/00-No-Automount"}},{"name":"classrepeat","options":{"type":"Numeric","value":4}},{"name":"max_classrepeat","options":{"type":"Numeric","value":4}},{"name":"maxpoll","options":{"type":"Numeric","value":16}},{"name":"pass_max_days","options":{"type":"Numeric","value":60}},{"name":"max_pass_max_days","options":{"type":"Numeric","value":60}},{"name":"fail_delay","options":{"type":"Numeric","value":4}},{"name":"min_fail_delay","options":{"type":"Numeric","value":4}},{"name":"home_dir_mode","options":{"type":"String","value":"0750"}},{"name":"home_dir_files_mode","options":{"type":"String","value":"0750"}},{"name":"init_files_mode","options":{"type":"String","value":"0740"}},{"name":"user_umask","options":{"type":"String","value":"0077"}},{"name":"audit_remote_server","options":{"type":"String","value":""}},{"name":"expected_disk_full_action","options":{"type":"String","value":"single"}},{"name":"expected_network_failure_action","options":{"type":"String","value":"single"}},{"name":"min_space_left","options":{"type":"Numeric","value":25}},{"name":"public_host_key_file_mode","options":{"type":"String","value":"0644"}},{"name":"public_host_key_directories","options":{"type":"Array","value":["/etc/ssh"]}},{"name":"private_host_key_file_mode","options":{"type":"String","value":"0640"}},{"name":"private_host_key_directories","options":{"type":"Array","value":["/"]}},{"name":"expected_audit_file_mode","options":{"type":"String","value":"0600"}},{"name":"max_audit_file_mode","options":{"type":"String","value":"0600"}},{"name":"expected_minclass","options":{"type":"Numeric","value":4}},{"name":"min_minclass","options":{"type":"Numeric","value":4}},{"name":"expected_password_lifetime","options":{"type":"Numeric","value":1}},{"name":"min_password_lifetime","options":{"type":"Numeric","value":1}},{"name":"expected_max_password_lifetime","options":{"type":"Numeric","value":60}},{"name":"max_password_lifetime","options":{"type":"Numeric","value":60}},{"name":"x11-enabled","options":{"value":"Input 'x11-enabled' does not have a value. Skipping test."}}],"groups":[{"id":"controls/SV-204392.rb","controls":["SV-204392"]},{"id":"controls/SV-204393.rb","controls":["SV-204393"]},{"id":"controls/SV-204394.rb","controls":["SV-204394"]},{"id":"controls/SV-204395.rb","controls":["SV-204395"]},{"id":"controls/SV-204396.rb","controls":["SV-204396"]},{"id":"controls/SV-204397.rb","controls":["SV-204397"]},{"id":"controls/SV-204398.rb","controls":["SV-204398"]},{"id":"controls/SV-204399.rb","controls":["SV-204399"]},{"id":"controls/SV-204400.rb","controls":["SV-204400"]},{"id":"controls/SV-204402.rb","controls":["SV-204402"]},{"id":"controls/SV-204403.rb","controls":["SV-204403"]},{"id":"controls/SV-204404.rb","controls":["SV-204404"]},{"id":"controls/SV-204405.rb","controls":["SV-204405"]},{"id":"controls/SV-204406.rb","controls":["SV-204406"]},{"id":"controls/SV-204407.rb","controls":["SV-204407"]},{"id":"controls/SV-204408.rb","controls":["SV-204408"]},{"id":"controls/SV-204409.rb","controls":["SV-204409"]},{"id":"controls/SV-204410.rb","controls":["SV-204410"]},{"id":"controls/SV-204411.rb","controls":["SV-204411"]},{"id":"controls/SV-204412.rb","controls":["SV-204412"]},{"id":"controls/SV-204413.rb","controls":["SV-204413"]},{"id":"controls/SV-204414.rb","controls":["SV-204414"]},{"id":"controls/SV-204415.rb","controls":["SV-204415"]},{"id":"controls/SV-204416.rb","controls":["SV-204416"]},{"id":"controls/SV-204417.rb","controls":["SV-204417"]},{"id":"controls/SV-204418.rb","controls":["SV-204418"]},{"id":"controls/SV-204419.rb","controls":["SV-204419"]},{"id":"controls/SV-204420.rb","controls":["SV-204420"]},{"id":"controls/SV-204421.rb","controls":["SV-204421"]},{"id":"controls/SV-204422.rb","controls":["SV-204422"]},{"id":"controls/SV-204423.rb","controls":["SV-204423"]},{"id":"controls/SV-204424.rb","controls":["SV-204424"]},{"id":"controls/SV-204425.rb","controls":["SV-204425"]},{"id":"controls/SV-204426.rb","controls":["SV-204426"]},{"id":"controls/SV-204427.rb","controls":["SV-204427"]},{"id":"controls/SV-204428.rb","controls":["SV-204428"]},{"id":"controls/SV-204429.rb","controls":["SV-204429"]},{"id":"controls/SV-204430.rb","controls":["SV-204430"]},{"id":"controls/SV-204431.rb","controls":["SV-204431"]},{"id":"controls/SV-204432.rb","controls":["SV-204432"]},{"id":"controls/SV-204433.rb","controls":["SV-204433"]},{"id":"controls/SV-204434.rb","controls":["SV-204434"]},{"id":"controls/SV-204435.rb","controls":["SV-204435"]},{"id":"controls/SV-204437.rb","controls":["SV-204437"]},{"id":"controls/SV-204438.rb","controls":["SV-204438"]},{"id":"controls/SV-204440.rb","controls":["SV-204440"]},{"id":"controls/SV-204441.rb","controls":["SV-204441"]},{"id":"controls/SV-204442.rb","controls":["SV-204442"]},{"id":"controls/SV-204443.rb","controls":["SV-204443"]},{"id":"controls/SV-204444.rb","controls":["SV-204444"]},{"id":"controls/SV-204445.rb","controls":["SV-204445"]},{"id":"controls/SV-204446.rb","controls":["SV-204446"]},{"id":"controls/SV-204447.rb","controls":["SV-204447"]},{"id":"controls/SV-204448.rb","controls":["SV-204448"]},{"id":"controls/SV-204449.rb","controls":["SV-204449"]},{"id":"controls/SV-204450.rb","controls":["SV-204450"]},{"id":"controls/SV-204451.rb","controls":["SV-204451"]},{"id":"controls/SV-204452.rb","controls":["SV-204452"]},{"id":"controls/SV-204453.rb","controls":["SV-204453"]},{"id":"controls/SV-204454.rb","controls":["SV-204454"]},{"id":"controls/SV-204455.rb","controls":["SV-204455"]},{"id":"controls/SV-204456.rb","controls":["SV-204456"]},{"id":"controls/SV-204457.rb","controls":["SV-204457"]},{"id":"controls/SV-204458.rb","controls":["SV-204458"]},{"id":"controls/SV-204459.rb","controls":["SV-204459"]},{"id":"controls/SV-204460.rb","controls":["SV-204460"]},{"id":"controls/SV-204461.rb","controls":["SV-204461"]},{"id":"controls/SV-204462.rb","controls":["SV-204462"]},{"id":"controls/SV-204463.rb","controls":["SV-204463"]},{"id":"controls/SV-204464.rb","controls":["SV-204464"]},{"id":"controls/SV-204466.rb","controls":["SV-204466"]},{"id":"controls/SV-204467.rb","controls":["SV-204467"]},{"id":"controls/SV-204468.rb","controls":["SV-204468"]},{"id":"controls/SV-204469.rb","controls":["SV-204469"]},{"id":"controls/SV-204470.rb","controls":["SV-204470"]},{"id":"controls/SV-204471.rb","controls":["SV-204471"]},{"id":"controls/SV-204472.rb","controls":["SV-204472"]},{"id":"controls/SV-204473.rb","controls":["SV-204473"]},{"id":"controls/SV-204474.rb","controls":["SV-204474"]},{"id":"controls/SV-204475.rb","controls":["SV-204475"]},{"id":"controls/SV-204476.rb","controls":["SV-204476"]},{"id":"controls/SV-204477.rb","controls":["SV-204477"]},{"id":"controls/SV-204478.rb","controls":["SV-204478"]},{"id":"controls/SV-204479.rb","controls":["SV-204479"]},{"id":"controls/SV-204480.rb","controls":["SV-204480"]},{"id":"controls/SV-204481.rb","controls":["SV-204481"]},{"id":"controls/SV-204482.rb","controls":["SV-204482"]},{"id":"controls/SV-204483.rb","controls":["SV-204483"]},{"id":"controls/SV-204486.rb","controls":["SV-204486"]},{"id":"controls/SV-204487.rb","controls":["SV-204487"]},{"id":"controls/SV-204488.rb","controls":["SV-204488"]},{"id":"controls/SV-204489.rb","controls":["SV-204489"]},{"id":"controls/SV-204490.rb","controls":["SV-204490"]},{"id":"controls/SV-204491.rb","controls":["SV-204491"]},{"id":"controls/SV-204492.rb","controls":["SV-204492"]},{"id":"controls/SV-204493.rb","controls":["SV-204493"]},{"id":"controls/SV-204494.rb","controls":["SV-204494"]},{"id":"controls/SV-204495.rb","controls":["SV-204495"]},{"id":"controls/SV-204496.rb","controls":["SV-204496"]},{"id":"controls/SV-204497.rb","controls":["SV-204497"]},{"id":"controls/SV-204498.rb","controls":["SV-204498"]},{"id":"controls/SV-204499.rb","controls":["SV-204499"]},{"id":"controls/SV-204500.rb","controls":["SV-204500"]},{"id":"controls/SV-204501.rb","controls":["SV-204501"]},{"id":"controls/SV-204502.rb","controls":["SV-204502"]},{"id":"controls/SV-204503.rb","controls":["SV-204503"]},{"id":"controls/SV-204504.rb","controls":["SV-204504"]},{"id":"controls/SV-204506.rb","controls":["SV-204506"]},{"id":"controls/SV-204507.rb","controls":["SV-204507"]},{"id":"controls/SV-204508.rb","controls":["SV-204508"]},{"id":"controls/SV-204509.rb","controls":["SV-204509"]},{"id":"controls/SV-204510.rb","controls":["SV-204510"]},{"id":"controls/SV-204511.rb","controls":["SV-204511"]},{"id":"controls/SV-204512.rb","controls":["SV-204512"]},{"id":"controls/SV-204513.rb","controls":["SV-204513"]},{"id":"controls/SV-204514.rb","controls":["SV-204514"]},{"id":"controls/SV-204515.rb","controls":["SV-204515"]},{"id":"controls/SV-204516.rb","controls":["SV-204516"]},{"id":"controls/SV-204517.rb","controls":["SV-204517"]},{"id":"controls/SV-204521.rb","controls":["SV-204521"]},{"id":"controls/SV-204524.rb","controls":["SV-204524"]},{"id":"controls/SV-204531.rb","controls":["SV-204531"]},{"id":"controls/SV-204536.rb","controls":["SV-204536"]},{"id":"controls/SV-204537.rb","controls":["SV-204537"]},{"id":"controls/SV-204538.rb","controls":["SV-204538"]},{"id":"controls/SV-204539.rb","controls":["SV-204539"]},{"id":"controls/SV-204540.rb","controls":["SV-204540"]},{"id":"controls/SV-204541.rb","controls":["SV-204541"]},{"id":"controls/SV-204542.rb","controls":["SV-204542"]},{"id":"controls/SV-204543.rb","controls":["SV-204543"]},{"id":"controls/SV-204544.rb","controls":["SV-204544"]},{"id":"controls/SV-204545.rb","controls":["SV-204545"]},{"id":"controls/SV-204546.rb","controls":["SV-204546"]},{"id":"controls/SV-204547.rb","controls":["SV-204547"]},{"id":"controls/SV-204548.rb","controls":["SV-204548"]},{"id":"controls/SV-204549.rb","controls":["SV-204549"]},{"id":"controls/SV-204550.rb","controls":["SV-204550"]},{"id":"controls/SV-204551.rb","controls":["SV-204551"]},{"id":"controls/SV-204552.rb","controls":["SV-204552"]},{"id":"controls/SV-204553.rb","controls":["SV-204553"]},{"id":"controls/SV-204554.rb","controls":["SV-204554"]},{"id":"controls/SV-204555.rb","controls":["SV-204555"]},{"id":"controls/SV-204556.rb","controls":["SV-204556"]},{"id":"controls/SV-204557.rb","controls":["SV-204557"]},{"id":"controls/SV-204558.rb","controls":["SV-204558"]},{"id":"controls/SV-204559.rb","controls":["SV-204559"]},{"id":"controls/SV-204560.rb","controls":["SV-204560"]},{"id":"controls/SV-204562.rb","controls":["SV-204562"]},{"id":"controls/SV-204563.rb","controls":["SV-204563"]},{"id":"controls/SV-204564.rb","controls":["SV-204564"]},{"id":"controls/SV-204565.rb","controls":["SV-204565"]},{"id":"controls/SV-204566.rb","controls":["SV-204566"]},{"id":"controls/SV-204567.rb","controls":["SV-204567"]},{"id":"controls/SV-204568.rb","controls":["SV-204568"]},{"id":"controls/SV-204572.rb","controls":["SV-204572"]},{"id":"controls/SV-204574.rb","controls":["SV-204574"]},{"id":"controls/SV-204575.rb","controls":["SV-204575"]},{"id":"controls/SV-204576.rb","controls":["SV-204576"]},{"id":"controls/SV-204577.rb","controls":["SV-204577"]},{"id":"controls/SV-204578.rb","controls":["SV-204578"]},{"id":"controls/SV-204579.rb","controls":["SV-204579"]},{"id":"controls/SV-204580.rb","controls":["SV-204580"]},{"id":"controls/SV-204581.rb","controls":["SV-204581"]},{"id":"controls/SV-204582.rb","controls":["SV-204582"]},{"id":"controls/SV-204583.rb","controls":["SV-204583"]},{"id":"controls/SV-204584.rb","controls":["SV-204584"]},{"id":"controls/SV-204585.rb","controls":["SV-204585"]},{"id":"controls/SV-204586.rb","controls":["SV-204586"]},{"id":"controls/SV-204587.rb","controls":["SV-204587"]},{"id":"controls/SV-204588.rb","controls":["SV-204588"]},{"id":"controls/SV-204589.rb","controls":["SV-204589"]},{"id":"controls/SV-204590.rb","controls":["SV-204590"]},{"id":"controls/SV-204591.rb","controls":["SV-204591"]},{"id":"controls/SV-204592.rb","controls":["SV-204592"]},{"id":"controls/SV-204593.rb","controls":["SV-204593"]},{"id":"controls/SV-204594.rb","controls":["SV-204594"]},{"id":"controls/SV-204595.rb","controls":["SV-204595"]},{"id":"controls/SV-204596.rb","controls":["SV-204596"]},{"id":"controls/SV-204597.rb","controls":["SV-204597"]},{"id":"controls/SV-204598.rb","controls":["SV-204598"]},{"id":"controls/SV-204599.rb","controls":["SV-204599"]},{"id":"controls/SV-204600.rb","controls":["SV-204600"]},{"id":"controls/SV-204601.rb","controls":["SV-204601"]},{"id":"controls/SV-204602.rb","controls":["SV-204602"]},{"id":"controls/SV-204603.rb","controls":["SV-204603"]},{"id":"controls/SV-204604.rb","controls":["SV-204604"]},{"id":"controls/SV-204605.rb","controls":["SV-204605"]},{"id":"controls/SV-204606.rb","controls":["SV-204606"]},{"id":"controls/SV-204607.rb","controls":["SV-204607"]},{"id":"controls/SV-204608.rb","controls":["SV-204608"]},{"id":"controls/SV-204609.rb","controls":["SV-204609"]},{"id":"controls/SV-204610.rb","controls":["SV-204610"]},{"id":"controls/SV-204611.rb","controls":["SV-204611"]},{"id":"controls/SV-204612.rb","controls":["SV-204612"]},{"id":"controls/SV-204613.rb","controls":["SV-204613"]},{"id":"controls/SV-204614.rb","controls":["SV-204614"]},{"id":"controls/SV-204615.rb","controls":["SV-204615"]},{"id":"controls/SV-204616.rb","controls":["SV-204616"]},{"id":"controls/SV-204617.rb","controls":["SV-204617"]},{"id":"controls/SV-204618.rb","controls":["SV-204618"]},{"id":"controls/SV-204619.rb","controls":["SV-204619"]},{"id":"controls/SV-204620.rb","controls":["SV-204620"]},{"id":"controls/SV-204621.rb","controls":["SV-204621"]},{"id":"controls/SV-204622.rb","controls":["SV-204622"]},{"id":"controls/SV-204623.rb","controls":["SV-204623"]},{"id":"controls/SV-204624.rb","controls":["SV-204624"]},{"id":"controls/SV-204625.rb","controls":["SV-204625"]},{"id":"controls/SV-204626.rb","controls":["SV-204626"]},{"id":"controls/SV-204627.rb","controls":["SV-204627"]},{"id":"controls/SV-204628.rb","controls":["SV-204628"]},{"id":"controls/SV-204629.rb","controls":["SV-204629"]},{"id":"controls/SV-204630.rb","controls":["SV-204630"]},{"id":"controls/SV-204631.rb","controls":["SV-204631"]},{"id":"controls/SV-204632.rb","controls":["SV-204632"]},{"id":"controls/SV-204633.rb","controls":["SV-204633"]},{"id":"controls/SV-204634.rb","controls":["SV-204634"]},{"id":"controls/SV-214799.rb","controls":["SV-214799"]},{"id":"controls/SV-214800.rb","controls":["SV-214800"]},{"id":"controls/SV-214801.rb","controls":["SV-214801"]},{"id":"controls/SV-214937.rb","controls":["SV-214937"]},{"id":"controls/SV-219059.rb","controls":["SV-219059"]},{"id":"controls/SV-228563.rb","controls":["SV-228563"]},{"id":"controls/SV-228564.rb","controls":["SV-228564"]},{"id":"controls/SV-233307.rb","controls":["SV-233307"]},{"id":"controls/SV-237633.rb","controls":["SV-237633"]},{"id":"controls/SV-237634.rb","controls":["SV-237634"]},{"id":"controls/SV-237635.rb","controls":["SV-237635"]},{"id":"controls/SV-244557.rb","controls":["SV-244557"]},{"id":"controls/SV-244558.rb","controls":["SV-244558"]},{"id":"controls/SV-250312.rb","controls":["SV-250312"]},{"id":"controls/SV-250313.rb","controls":["SV-250313"]},{"id":"controls/SV-250314.rb","controls":["SV-250314"]},{"id":"controls/SV-251702.rb","controls":["SV-251702"]},{"id":"controls/SV-251703.rb","controls":["SV-251703"]},{"id":"controls/SV-251704.rb","controls":["SV-251704"]},{"id":"controls/SV-251705.rb","controls":["SV-251705"]},{"id":"controls/SV-254523.rb","controls":["SV-254523"]},{"id":"controls/SV-255925.rb","controls":["SV-255925"]},{"id":"controls/SV-255926.rb","controls":["SV-255926"]},{"id":"controls/SV-255927.rb","controls":["SV-255927"]},{"id":"controls/SV-255928.rb","controls":["SV-255928"]}],"controls":[{"id":"SV-204392","title":"The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership,\n    and group membership of system files and commands match the vendor values.","desc":"Discretionary access control is weakened if a user or group has access permissions to system files and\n    directories greater than the default.","descriptions":[{"label":"default","data":"Discretionary access control is weakened if a user or group has access permissions to system files and\n    directories greater than the default."},{"label":"check","data":"Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.\n\nCheck the default file permissions, ownership, and group membership of system files and commands with the following command:\n\n     # for i in `rpm -Va | grep -E '^.{1}M|^.{5}U|^.{6}G' | cut -d \" \" -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d \" \" -f 1,5,6,7 | grep $i;done;done\n\n     /var/log/gdm 040755 root root\n     /etc/audisp/audisp-remote.conf 0100640 root root\n     /usr/bin/passwd 0104755 root root\n\nFor each file returned, verify the current permissions, ownership, and group membership:\n     # ls -la <filename>\n\n     -rw-------. 1 root root 2017 Nov 1 10:03 /etc/audisp/audisp-remote.conf\n\nIf the file is more permissive than the default permissions, this is a finding.\n\nIf the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.\n\nIf the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding."},{"label":"fix","data":"Run the following command to determine which package owns the file:\n\n    # rpm -qf <filename>\n\n    Reset the user and group ownership of files within a package with the\nfollowing command:\n\n    #rpm --setugids <packagename>\n\n\n    Reset the permissions of files within a package with the following command:\n\n    #rpm --setperms <packagename>"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71849","SV-86473"],"severity":"high","gtitle":"SRG-OS-000257-GPOS-00098","satisfies":["SRG-OS-000257-GPOS-00098","SRG-OS-000278-GPOS-00108"],"gid":"V-204392","rid":"SV-204392r880752_rule","stig_id":"RHEL-07-010010","fix_id":"F-36302r880751_fix","cci":["CCI-001494","CCI-001496","CCI-002165","CCI-002235"],"nist":["AU-9","AU-9 (3)","AC-3 (4)","AC-6 (10)"],"subsystems":["permissions","package","rpm"],"host":null,"container":null},"code":"control 'SV-204392' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership,\n    and group membership of system files and commands match the vendor values.'\n  desc 'Discretionary access control is weakened if a user or group has access permissions to system files and\n    directories greater than the default.'\n  desc 'check', %q(Verify the file permissions, ownership, and group membership of system files and commands match the vendor values.\n\nCheck the default file permissions, ownership, and group membership of system files and commands with the following command:\n\n     # for i in `rpm -Va | grep -E '^.{1}M|^.{5}U|^.{6}G' | cut -d \" \" -f 4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d \" \" -f 1,5,6,7 | grep $i;done;done\n\n     /var/log/gdm 040755 root root\n     /etc/audisp/audisp-remote.conf 0100640 root root\n     /usr/bin/passwd 0104755 root root\n\nFor each file returned, verify the current permissions, ownership, and group membership:\n     # ls -la <filename>\n\n     -rw-------. 1 root root 2017 Nov 1 10:03 /etc/audisp/audisp-remote.conf\n\nIf the file is more permissive than the default permissions, this is a finding.\n\nIf the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding.\n\nIf the file is not a member of the default group and is not documented with the Information System Security Officer (ISSO), this is a finding.)\n  desc 'fix', 'Run the following command to determine which package owns the file:\n\n    # rpm -qf <filename>\n\n    Reset the user and group ownership of files within a package with the\nfollowing command:\n\n    #rpm --setugids <packagename>\n\n\n    Reset the permissions of files within a package with the following command:\n\n    #rpm --setperms <packagename>'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71849', 'SV-86473']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000257-GPOS-00098'\n  tag satisfies: ['SRG-OS-000257-GPOS-00098', 'SRG-OS-000278-GPOS-00108']\n  tag gid: 'V-204392'\n  tag rid: 'SV-204392r880752_rule'\n  tag stig_id: 'RHEL-07-010010'\n  tag fix_id: 'F-36302r880751_fix'\n  tag cci: ['CCI-001494', 'CCI-001496', 'CCI-002165', 'CCI-002235']\n  tag nist: ['AU-9', 'AU-9 (3)', 'AC-3 (4)', 'AC-6 (10)']\n  tag subsystems: ['permissions', 'package', 'rpm']\n  tag 'host'\n  tag 'container'\n\n  if input('disable_slow_controls')\n    describe \"This control consistently takes a long time to run and has been disabled\n    using the disable_slow_controls attribute.\" do\n      skip \"This control consistently takes a long time to run and has been disabled\n            using the disable_slow_controls attribute. You must enable this control for a\n            full accredidation for production.\"\n    end\n  else\n\n    allowlist = input('rpm_verify_perms_except')\n\n    misconfigured_packages = command('rpm -Va').stdout.split(\"\\n\")\n                                               .select { |package| package[0..7].match(/M|U|G/) }\n                                               .map { |package| package.match(/\\S+$/)[0] }\n\n    if misconfigured_packages.empty?\n      describe 'The list of rpm packages with permissions changed from the vendor values' do\n        subject { misconfigured_packages }\n        it { should be_empty }\n      end\n    else\n      describe 'The list of rpm packages with permissions changed from the vendor values' do\n        fail_msg = \"Files that have been modified from vendor-approved permissions but are not in the allowlist: #{(misconfigured_packages - allowlist).join(', ')}\"\n        it 'should all appear in the allowlist' do\n          expect(misconfigured_packages).to all(be_in allowlist), fail_msg\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204392.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"The list of rpm packages with permissions changed from the vendor values is expected to be empty","run_time":0.032757,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204393","title":"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent\n    Banner before granting local or remote access to the system via a graphical user logon.","desc":"Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\""},{"label":"check","data":"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the operating system via a graphical user logon.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Check to see if the operating system displays a banner at the logon screen with the following command:\n    # grep banner-message-enable /etc/dconf/db/local.d/*\n    banner-message-enable=true\n    If \"banner-message-enable\" is set to \"false\" or is missing, this is a finding."},{"label":"fix","data":"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the system.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the\n    following command:\n    # touch /etc/dconf/db/local.d/01-banner-message\n    Add the following line to the [org/gnome/login-screen] section of the \"/etc/dconf/db/local.d/01-banner-message\":\n    [org/gnome/login-screen]\n    banner-message-enable=true\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71859","SV-86483"],"severity":"medium","gtitle":"SRG-OS-000023-GPOS-00006","satisfies":["SRG-OS-000023-GPOS-00006","SRG-OS-000024-GPOS-00007","SRG-OS-000228-GPOS-00088"],"gid":"V-204393","rid":"SV-204393r603261_rule","stig_id":"RHEL-07-010030","fix_id":"F-4517r88372_fix","cci":["CCI-000048"],"nist":["AC-8 a"],"subsystems":["gui","banner"]},"code":"control 'SV-204393' do\n  title 'The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent\n    Banner before granting local or remote access to the system via a graphical user logon.'\n  desc 'Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"'\n  desc 'check', 'Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the operating system via a graphical user logon.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Check to see if the operating system displays a banner at the logon screen with the following command:\n    # grep banner-message-enable /etc/dconf/db/local.d/*\n    banner-message-enable=true\n    If \"banner-message-enable\" is set to \"false\" or is missing, this is a finding.'\n  desc 'fix', 'Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the system.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the\n    following command:\n    # touch /etc/dconf/db/local.d/01-banner-message\n    Add the following line to the [org/gnome/login-screen] section of the \"/etc/dconf/db/local.d/01-banner-message\":\n    [org/gnome/login-screen]\n    banner-message-enable=true\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71859', 'SV-86483']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000023-GPOS-00006'\n  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007', 'SRG-OS-000228-GPOS-00088']\n  tag gid: 'V-204393'\n  tag rid: 'SV-204393r603261_rule'\n  tag stig_id: 'RHEL-07-010030'\n  tag fix_id: 'F-4517r88372_fix'\n  tag cci: ['CCI-000048']\n  tag nist: ['AC-8 a']\n  tag subsystems: ['gui', 'banner']\n\n  if package('gnome-desktop3').installed?\n    if !input('dconf_user').nil? and command('whoami').stdout.strip == 'root'\n      describe command(\"sudo -u input('dconf_user') dconf read /org/gnome/login-screen/banner-message-enable\") do\n        its('stdout.strip') do\n          should cmp input('banner_message_enabled').to_s\n        end\n      end\n    else\n      describe command('dconf read /org/gnome/login-screen/banner-message-enable') do\n        its('stdout.strip') do\n          should cmp input('banner_message_enabled').to_s\n        end\n      end\n    end\n  else\n    impact 0.0\n    describe 'The GNOME desktop is not installed' do\n      skip 'The GNOME desktop is not installed, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204393.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The GNOME desktop is not installed","run_time":1.5e-05,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The GNOME desktop is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204394","title":"The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and\n    Consent Banner before granting local or remote access to the system via a graphical user logon.","desc":"Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy.\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy.\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\""},{"label":"check","data":"Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner\n    before granting access to the operating system via a graphical user logon.\n    Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\n    Check that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text\n    with the command:\n    # grep banner-message-text /etc/dconf/db/local.d/*\n    banner-message-text=\n    'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy\n    using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG\n    routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration\n    testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and\n    counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this\n    IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring,\n    interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security\n    measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or\n    privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative\n    searching or monitoring of the content of privileged communications, or work product, related to personal\n    representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and\n    work product are private and confidential. See User Agreement for details. '\n    Note: The \"\\n \" characters are for formatting only. They will not be displayed on the Graphical User Interface.\n    If the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding."},{"label":"fix","data":"Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent\n    Banner before granting access to the system.\n    Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\n    Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the\n    following command:\n    # touch /etc/dconf/db/local.d/01-banner-message\n    Add the following line to the [org/gnome/login-screen] section of the \"/etc/dconf/db/local.d/01-banner-message\":\n    [org/gnome/login-screen]\n    banner-message-enable=true\n    banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for\n    USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the\n    following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including,\n    but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct\n    (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and\n    seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to\n    routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS\n    includes security measures (e.g., authentication and access controls) to protect USG interests--not for your\n    personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI\n    investigative searching or monitoring of the content of privileged communications, or work product, related to\n    personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such\n    communications and work product are private and confidential. See User Agreement for details. '\n    Note: The \"\\n \" characters are for formatting only. They will not be displayed on the Graphical User Interface.\n    Run the following command to update the database:\n    # dconf update"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71861","SV-86485"],"severity":"medium","gtitle":"SRG-OS-000023-GPOS-00006","satisfies":["SRG-OS-000023-GPOS-00006","SRG-OS-000024-GPOS-00007","SRG-OS-000228-GPOS-00088"],"gid":"V-204394","rid":"SV-204394r603261_rule","stig_id":"RHEL-07-010040","fix_id":"F-4518r297479_fix","cci":["CCI-000048"],"nist":["AC-8 a"],"subsystems":["gdm"],"host":null},"code":"control 'SV-204394' do\n  title 'The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and\n    Consent Banner before granting local or remote access to the system via a graphical user logon.'\n  desc 'Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy.\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"'\n  desc 'check', %q(Verify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner\n    before granting access to the operating system via a graphical user logon.\n    Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\n    Check that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text\n    with the command:\n    # grep banner-message-text /etc/dconf/db/local.d/*\n    banner-message-text=\n    'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy\n    using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG\n    routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration\n    testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and\n    counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this\n    IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring,\n    interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security\n    measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or\n    privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative\n    searching or monitoring of the content of privileged communications, or work product, related to personal\n    representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and\n    work product are private and confidential. See User Agreement for details. '\n    Note: The \"\\n \" characters are for formatting only. They will not be displayed on the Graphical User Interface.\n    If the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.)\n  desc 'fix', %q(Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent\n    Banner before granting access to the system.\n    Note: If the system does not have a Graphical User Interface installed, this requirement is Not Applicable.\n    Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the\n    following command:\n    # touch /etc/dconf/db/local.d/01-banner-message\n    Add the following line to the [org/gnome/login-screen] section of the \"/etc/dconf/db/local.d/01-banner-message\":\n    [org/gnome/login-screen]\n    banner-message-enable=true\n    banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for\n    USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the\n    following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including,\n    but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct\n    (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and\n    seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to\n    routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS\n    includes security measures (e.g., authentication and access controls) to protect USG interests--not for your\n    personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI\n    investigative searching or monitoring of the content of privileged communications, or work product, related to\n    personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such\n    communications and work product are private and confidential. See User Agreement for details. '\n    Note: The \"\\n \" characters are for formatting only. They will not be displayed on the Graphical User Interface.\n    Run the following command to update the database:\n    # dconf update)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71861', 'SV-86485']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000023-GPOS-00006'\n  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007', 'SRG-OS-000228-GPOS-00088']\n  tag gid: 'V-204394'\n  tag rid: 'SV-204394r603261_rule'\n  tag stig_id: 'RHEL-07-010040'\n  tag fix_id: 'F-4518r297479_fix'\n  tag cci: ['CCI-000048']\n  tag nist: ['AC-8 a']\n  tag subsystems: ['gdm']\n  tag 'host'\n\n  if package('gnome-desktop3').installed?\n    # Get all files that have the banner-message-text specified.\n    banner_files =\n      command('grep -l banner-message-text /etc/dconf/db/local.d/*').stdout.split(\"\\n\")\n    # If there are no banner files then this is a finding.\n    banner_missing = banner_files.empty?\n    if banner_missing\n      describe 'If no files specify the banner text then this is a finding' do\n        subject { banner_missing }\n        it { should be false }\n      end\n    end\n    # If there are banner files then check them to make sure they have the correct text.\n    banner_files.each do |banner_file|\n      banner_message =\n        parse_config_file(banner_file).params('org/gnome/login-screen', 'banner-message-text').gsub(\n          /[\\r\\n\\s]/, ''\n        )\n      # dconf expects the banner-message-text to be quoted so remove leading and trailing quote.\n      # See https://developer.gnome.org/dconf/unstable/dconf-tool.html which states:\n      #  VALUE arguments must be in GVariant format, so e.g. a string must include\n      #  explicit quotes: \"'foo'\". This format is also used when printing out values.\n      if banner_message.start_with?('\"') || banner_message.start_with?('\\'')\n        banner_message = banner_message[1, banner_message.length]\n      end\n      if banner_message.end_with?('\"') || banner_message.end_with?('\\'')\n        banner_message = banner_message.chop\n      end\n      banner_message.gsub!('\\\\n', '')\n      foo = input('banner_message_text_gui')\n      foo2 = input('banner_message_text_gui_limited')\n      describe.one do\n        describe banner_message do\n          it { should cmp foo.gsub(/[\\r\\n\\s]/, '') }\n        end\n        describe banner_message do\n          it { should cmp foo2.gsub(/[\\r\\n\\s]/, '') }\n        end\n      end\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n        Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204394.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n        Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204395","title":"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent\n    Banner before granting local or remote access to the system via a command line user logon.","desc":"Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\""},{"label":"check","data":"Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the operating system via a command line user logon.\n    Check to see if the operating system displays a banner at the command line logon screen with the following command:\n    # more /etc/issue\n    The command should return the following text:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"\n    If the operating system does not display a graphical logon banner or the banner does not match the Standard\n    Mandatory DoD Notice and Consent Banner, this is a finding.\n    If the text in the \"/etc/issue\" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a\n    finding."},{"label":"fix","data":"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the system via the command line by editing the \"/etc/issue\" file.\n    Replace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are\n    private and confidential.  See User Agreement for details.\""}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71863","SV-86487"],"severity":"medium","gtitle":"SRG-OS-000023-GPOS-00006","satisfies":["SRG-OS-000023-GPOS-00006","SRG-OS-000024-GPOS-00007"],"gid":"V-204395","rid":"SV-204395r603261_rule","stig_id":"RHEL-07-010050","fix_id":"F-4519r88378_fix","cci":["CCI-000048"],"nist":["AC-8 a"],"subsystems":["banner","/etc/issue"],"host":null},"code":"control 'SV-204395' do\n  title 'The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent\n    Banner before granting local or remote access to the system via a command line user logon.'\n  desc 'Display of a standardized and approved use notification before granting access to the operating system\n    ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive\n    Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"'\n  desc 'check', 'Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the operating system via a command line user logon.\n    Check to see if the operating system displays a banner at the command line logon screen with the following command:\n    # more /etc/issue\n    The command should return the following text:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"\n    If the operating system does not display a graphical logon banner or the banner does not match the Standard\n    Mandatory DoD Notice and Consent Banner, this is a finding.\n    If the text in the \"/etc/issue\" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a\n    finding.'\n  desc 'fix', 'Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the system via the command line by editing the \"/etc/issue\" file.\n    Replace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants.  Such communications and work product are\n    private and confidential.  See User Agreement for details.\"'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71863', 'SV-86487']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000023-GPOS-00006'\n  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007']\n  tag gid: 'V-204395'\n  tag rid: 'SV-204395r603261_rule'\n  tag stig_id: 'RHEL-07-010050'\n  tag fix_id: 'F-4519r88378_fix'\n  tag cci: ['CCI-000048']\n  tag nist: ['AC-8 a']\n  tag subsystems: ['banner', '/etc/issue']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n\n    banner_message_text_cli = input('banner_message_text_cli')\n    banner_message_text_cli_limited = input('banner_message_text_cli_limited')\n\n    clean_banner = banner_message_text_cli.gsub(/[\\r\\n\\s]/, '')\n    clean_banner_limited = banner_message_text_cli_limited.gsub(/[\\r\\n\\s]/,\n                                                                '')\n    banner_file = file('/etc/issue')\n    banner_missing = !banner_file.exist?\n\n    if banner_missing\n      describe 'The banner text is not set because /etc/issue does not exist' do\n        subject { banner_missing }\n        it { should be false }\n      end\n    end\n\n    banner_message = banner_file.content.gsub(/[\\r\\n\\s]/, '')\n    unless banner_missing\n      describe.one do\n        describe 'The banner text should match the standard banner' do\n          subject { banner_message }\n          it { should cmp clean_banner }\n        end\n        describe 'The banner text should match the limited banner' do\n          subject { banner_message }\n          it { should cmp clean_banner_limited }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204395.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"The banner text is not set because /etc/issue does not exist is expected to equal false","run_time":0.003118,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected false\n     got true\n","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204395.rb:1 ","run_time":0.000121,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `gsub' for nil:NilClass","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204396","title":"The Red Hat Enterprise Linux operating system must enable a user session lock until that user\n    re-establishes access using established identification and authentication procedures.","desc":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in\n    place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.","descriptions":[{"label":"default","data":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in\n    place until the user reauthenticates. No other activity aside from reauthentication must unlock the system."},{"label":"check","data":"Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCheck to see if the screen lock is enabled with the following command:\n\n     # grep -ir lock-enabled /etc/dconf/db/local.d/ | grep -v locks\n     lock-enabled=true\n\nIf the \"lock-enabled\" setting is missing or is not set to \"true\", this is a finding."},{"label":"fix","data":"Configure the operating system to enable a user's session lock until that user re-establishes access\n    using established identification and authentication procedures.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    example:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Edit the \"[org/gnome/desktop/screensaver]\" section of the database file and add or update the following lines:\n    # Set this to true to lock the screen when the screensaver activates\n    lock-enabled=true\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86515","V-71891"],"severity":"medium","gtitle":"SRG-OS-000028-GPOS-00009","satisfies":["SRG-OS-000028-GPOS-00009","SRG-OS-000030-GPOS-00011"],"gid":"V-204396","rid":"SV-204396r880746_rule","stig_id":"RHEL-07-010060","fix_id":"F-4520r880745_fix","cci":["CCI-000056"],"nist":["AC-11 b"],"subsystems":["session","lock","gui","screensaver"],"host":null},"code":"control 'SV-204396' do\n  title 'The Red Hat Enterprise Linux operating system must enable a user session lock until that user\n    re-establishes access using established identification and authentication procedures.'\n  desc 'A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in\n    place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.'\n  desc 'check', %q(Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCheck to see if the screen lock is enabled with the following command:\n\n     # grep -ir lock-enabled /etc/dconf/db/local.d/ | grep -v locks\n     lock-enabled=true\n\nIf the \"lock-enabled\" setting is missing or is not set to \"true\", this is a finding.)\n  desc 'fix', %q(Configure the operating system to enable a user's session lock until that user re-establishes access\n    using established identification and authentication procedures.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    example:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Edit the \"[org/gnome/desktop/screensaver]\" section of the database file and add or update the following lines:\n    # Set this to true to lock the screen when the screensaver activates\n    lock-enabled=true\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect.)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86515', 'V-71891']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000028-GPOS-00009'\n  tag satisfies: ['SRG-OS-000028-GPOS-00009', 'SRG-OS-000030-GPOS-00011']\n  tag gid: 'V-204396'\n  tag rid: 'SV-204396r880746_rule'\n  tag stig_id: 'RHEL-07-010060'\n  tag fix_id: 'F-4520r880745_fix'\n  tag cci: ['CCI-000056']\n  tag nist: ['AC-11 b']\n  tag subsystems: ['session', 'lock', 'gui', 'screensaver']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n\n    describe command('gsettings get org.gnome.desktop.screensaver lock-enabled') do\n      its('stdout.strip') { should cmp 'true' }\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n        Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204396.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":8.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n        Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204397","title":"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using\n    multifactor authentication via a graphical user logon.","desc":"To assure accountability and prevent unauthenticated access, users must be identified and authenticated to\n    prevent potential misuse and compromise of the system.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.","descriptions":[{"label":"default","data":"To assure accountability and prevent unauthenticated access, users must be identified and authenticated to\n    prevent potential misuse and compromise of the system.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card."},{"label":"check","data":"Verify the operating system uniquely identifies and authenticates users using multifactor\n    authentication via a graphical user logon.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Determine which profile the system database is using with the following command:\n    # grep system-db /etc/dconf/profile/user\n    system-db:local\n    Note: The example is using the database local for the system, so the path is \"/etc/dconf/db/local.d\". This path must\n    be modified if a database other than local is being used.\n    # grep enable-smartcard-authentication /etc/dconf/db/local.d/*\n    enable-smartcard-authentication=true\n    If \"enable-smartcard-authentication\" is set to \"false\" or the keyword is missing, this is a finding."},{"label":"fix","data":"Configure the operating system to uniquely identify and authenticate users using multifactor\n    authentication via a graphical user logon.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example is using the database local for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/00-defaults\n    Edit \"[org/gnome/login-screen]\" and add or update the following line:\n    enable-smartcard-authentication=true\n    Update the system databases:\n    # dconf update"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-77819","SV-92515"],"severity":"medium","gtitle":"SRG-OS-000375-GPOS-00160","satisfies":["SRG-OS-000375-GPOS-00161","SRG-OS-000375-GPOS-00162"],"gid":"V-204397","rid":"SV-204397r853879_rule","stig_id":"RHEL-07-010061","fix_id":"F-4521r88384_fix","cci":["CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (11)","IA-2 (12)","IA-2 (12)"],"subsystems":["gui"],"host":null},"code":"control 'SV-204397' do\n  title 'The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using\n    multifactor authentication via a graphical user logon.'\n  desc 'To assure accountability and prevent unauthenticated access, users must be identified and authenticated to\n    prevent potential misuse and compromise of the system.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.'\n  desc 'check', 'Verify the operating system uniquely identifies and authenticates users using multifactor\n    authentication via a graphical user logon.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Determine which profile the system database is using with the following command:\n    # grep system-db /etc/dconf/profile/user\n    system-db:local\n    Note: The example is using the database local for the system, so the path is \"/etc/dconf/db/local.d\". This path must\n    be modified if a database other than local is being used.\n    # grep enable-smartcard-authentication /etc/dconf/db/local.d/*\n    enable-smartcard-authentication=true\n    If \"enable-smartcard-authentication\" is set to \"false\" or the keyword is missing, this is a finding.'\n  desc 'fix', 'Configure the operating system to uniquely identify and authenticate users using multifactor\n    authentication via a graphical user logon.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example is using the database local for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/00-defaults\n    Edit \"[org/gnome/login-screen]\" and add or update the following line:\n    enable-smartcard-authentication=true\n    Update the system databases:\n    # dconf update'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-77819', 'SV-92515']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000375-GPOS-00160'\n  tag satisfies: ['SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']\n  tag gid: 'V-204397'\n  tag rid: 'SV-204397r853879_rule'\n  tag stig_id: 'RHEL-07-010061'\n  tag fix_id: 'F-4521r88384_fix'\n  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']\n  tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']\n  tag subsystems: ['gui']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n\n    multifactor_enabled = input('multifactor_enabled')\n    dconf_user = input('dconf_user')\n\n    if package('gnome-desktop3').installed? && (package('pcsc-lite').installed? || package('esc').installed?)\n      impact 0.5\n      if !dconf_user.nil? && command('whoami').stdout.strip == 'root'\n        describe command(\"sudo -u #{dconf_user} dconf read /org/gnome/login-screen/enable-smartcard-authentication\") do\n          its('stdout.strip') { should eq multifactor_enabled.to_s }\n        end\n      else\n        describe command('dconf read /org/gnome/login-screen/enable-smartcard-authentication') do\n          its('stdout.strip') { should eq multifactor_enabled.to_s }\n        end\n      end\n    else\n      impact 0.0\n      unless package('gnome-desktop3').installed?\n        describe 'The GNOME desktop is not installed' do\n          skip 'The GNOME desktop is not installed, this control is Not Applicable.'\n        end\n      end\n\n      unless package('pcsc-lite').installed?\n        describe 'The pcsc-lite package is not installed' do\n          skip 'The pcsc-lite package is not installed, this control is Not Applicable.'\n        end\n      end\n      unless package('esc').installed?\n        describe 'The esc package is not installed' do\n          skip 'The esc package is not installed, this control is Not Applicable.'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204397.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The GNOME desktop is not installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The GNOME desktop is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"},{"status":"skipped","code_desc":"The pcsc-lite package is not installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The pcsc-lite package is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"},{"status":"skipped","code_desc":"The esc package is not installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The esc package is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204398","title":"The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of\n    inactivity for graphical user interfaces.","desc":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.","descriptions":[{"label":"default","data":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled."},{"label":"check","data":"Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCheck to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:\n\n     # grep -i idle-delay /etc/dconf/db/local.d/*\n     idle-delay=uint32 900\n\nIf the \"idle-delay\" setting is missing or is not set to \"900\" or less, this is a finding."},{"label":"fix","data":"Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for\n    graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Edit /etc/dconf/db/local.d/00-screensaver and add or update the following lines:\n    [org/gnome/desktop/session]\n    # Set the lock time out to 900 seconds before the session is considered idle\n    idle-delay=uint32 900\n    You must include the \"uint32\" along with the integer key values as shown.\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71893","SV-86517"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-204398","rid":"SV-204398r880770_rule","stig_id":"RHEL-07-010070","fix_id":"F-4522r880769_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui","screensaver","session","lock"],"host":null},"code":"control 'SV-204398' do\n  title 'The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of\n    inactivity for graphical user interfaces.'\n  desc \"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.\"\n  desc 'check', 'Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces.\n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nCheck to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command:\n\n     # grep -i idle-delay /etc/dconf/db/local.d/*\n     idle-delay=uint32 900\n\nIf the \"idle-delay\" setting is missing or is not set to \"900\" or less, this is a finding.'\n  desc 'fix', 'Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for\n    graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Edit /etc/dconf/db/local.d/00-screensaver and add or update the following lines:\n    [org/gnome/desktop/session]\n    # Set the lock time out to 900 seconds before the session is considered idle\n    idle-delay=uint32 900\n    You must include the \"uint32\" along with the integer key values as shown.\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71893', 'SV-86517']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-204398'\n  tag rid: 'SV-204398r880770_rule'\n  tag stig_id: 'RHEL-07-010070'\n  tag fix_id: 'F-4522r880769_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui', 'screensaver', 'session', 'lock']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n\n    describe command(\"gsettings get org.gnome.desktop.session idle-delay | cut -d ' ' -f2\") do\n      its('stdout.strip') { should cmp <= 900 }\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n        Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204398.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n        Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204399","title":"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver\n    lock-delay setting for the graphical user interface.","desc":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.","descriptions":[{"label":"default","data":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled."},{"label":"check","data":"Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n     system-db:local\n\nCheck for the lock delay setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i lock-delay /etc/dconf/db/local.d/locks/*\n     /org/gnome/desktop/screensaver/lock-delay\n\nIf the command does not return a result, this is a finding."},{"label":"fix","data":"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the screensaver lock delay:\n    /org/gnome/desktop/screensaver/lock-delay"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-73155","SV-87807"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-204399","rid":"SV-204399r880773_rule","stig_id":"RHEL-07-010081","fix_id":"F-4523r880772_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui"],"host":null},"code":"control 'SV-204399' do\n  title 'The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver\n    lock-delay setting for the graphical user interface.'\n  desc \"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.\"\n  desc 'check', 'Verify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n     system-db:local\n\nCheck for the lock delay setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i lock-delay /etc/dconf/db/local.d/locks/*\n     /org/gnome/desktop/screensaver/lock-delay\n\nIf the command does not return a result, this is a finding.'\n  desc 'fix', 'Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the screensaver lock delay:\n    /org/gnome/desktop/screensaver/lock-delay'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-73155', 'SV-87807']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-204399'\n  tag rid: 'SV-204399r880773_rule'\n  tag stig_id: 'RHEL-07-010081'\n  tag fix_id: 'F-4523r880772_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n\n    describe command('gsettings writable org.gnome.desktop.screensaver lock-delay') do\n      its('stdout.strip') { should cmp 'false' }\n    end\n  else\n    impact 0.0\n    describe 'The GNOME desktop is not installed' do\n      skip 'The GNOME desktop is not installed, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204399.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The GNOME desktop is not installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The GNOME desktop is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204400","title":"The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay\n    setting for the graphical user interface.","desc":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.","descriptions":[{"label":"default","data":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled."},{"label":"check","data":"Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n     system-db:local\n\nCheck for the session idle delay setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i idle-delay /etc/dconf/db/local.d/locks/*\n     /org/gnome/desktop/session/idle-delay\n\nIf the command does not return a result, this is a finding."},{"label":"fix","data":"Configure the operating system to prevent a user from overriding a session lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the session idle delay:\n    /org/gnome/desktop/session/idle-delay"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-73157","SV-87809"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-204400","rid":"SV-204400r880776_rule","stig_id":"RHEL-07-010082","fix_id":"F-4524r880775_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui"],"host":null},"code":"control 'SV-204400' do\n  title 'The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay\n    setting for the graphical user interface.'\n  desc \"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.\"\n  desc 'check', 'Verify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n     system-db:local\n\nCheck for the session idle delay setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i idle-delay /etc/dconf/db/local.d/locks/*\n     /org/gnome/desktop/session/idle-delay\n\nIf the command does not return a result, this is a finding.'\n  desc 'fix', 'Configure the operating system to prevent a user from overriding a session lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the session idle delay:\n    /org/gnome/desktop/session/idle-delay'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-73157', 'SV-87809']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-204400'\n  tag rid: 'SV-204400r880776_rule'\n  tag stig_id: 'RHEL-07-010082'\n  tag fix_id: 'F-4524r880775_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n\n    describe command('gsettings writable org.gnome.desktop.session idle-delay') do\n      its('stdout.strip') { should cmp 'false' }\n    end\n  else\n    impact 0.0\n    describe 'The GNOME desktop is not installed' do\n      skip 'The GNOME desktop is not installed, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204400.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The GNOME desktop is not installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The GNOME desktop is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204402","title":"The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a\n    period of inactivity for graphical user interfaces.","desc":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.","descriptions":[{"label":"default","data":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled."},{"label":"check","data":"Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces.\n\nNote: If the system does not have a GNOME installed, this requirement is Not Applicable.\n\nCheck for the session lock settings with the following commands:\n\n     # grep -i idle-activation-enabled /etc/dconf/db/local.d/*\n     idle-activation-enabled=true\n\nIf \"idle-activation-enabled\" is not set to \"true\", this is a finding."},{"label":"fix","data":"Configure the operating system to initiate a session lock after a 15-minute period of inactivity for\n    graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Add the setting to enable screensaver locking after 15 minutes of inactivity:\n    [org/gnome/desktop/screensaver]\n    idle-activation-enabled=true\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71899","SV-86523"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-204402","rid":"SV-204402r880782_rule","stig_id":"RHEL-07-010100","fix_id":"F-4526r880781_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui","session","lock"],"host":null},"code":"control 'SV-204402' do\n  title 'The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a\n    period of inactivity for graphical user interfaces.'\n  desc \"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.\"\n  desc 'check', 'Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces.\n\nNote: If the system does not have a GNOME installed, this requirement is Not Applicable.\n\nCheck for the session lock settings with the following commands:\n\n     # grep -i idle-activation-enabled /etc/dconf/db/local.d/*\n     idle-activation-enabled=true\n\nIf \"idle-activation-enabled\" is not set to \"true\", this is a finding.'\n  desc 'fix', 'Configure the operating system to initiate a session lock after a 15-minute period of inactivity for\n    graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Add the setting to enable screensaver locking after 15 minutes of inactivity:\n    [org/gnome/desktop/screensaver]\n    idle-activation-enabled=true\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71899', 'SV-86523']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-204402'\n  tag rid: 'SV-204402r880782_rule'\n  tag stig_id: 'RHEL-07-010100'\n  tag fix_id: 'F-4526r880781_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui', 'session', 'lock']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n\n    describe command('gsettings get org.gnome.desktop.screensaver idle-activation-enabled') do\n      its('stdout.strip') { should cmp 'true' }\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n        Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204402.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n        Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204403","title":"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver\n    idle-activation-enabled setting for the graphical user interface.","desc":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    The ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to\n    disengage the graphical user interface session lock provides the assurance that all sessions will lock after the\n    specified period of time.","descriptions":[{"label":"default","data":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    The ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to\n    disengage the graphical user interface session lock provides the assurance that all sessions will lock after the\n    specified period of time."},{"label":"check","data":"Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n\n     system-db:local\n\nCheck for the idle-activation-enabled setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*\n\n     /org/gnome/desktop/screensaver/idle-activation-enabled\n\nIf the command does not return a result, this is a finding."},{"label":"fix","data":"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the screensaver idle-activation-enabled setting:\n    /org/gnome/desktop/screensaver/idle-activation-enabled"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-78997","SV-93703"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-204403","rid":"SV-204403r880785_rule","stig_id":"RHEL-07-010101","fix_id":"F-4527r880784_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui"],"host":null},"code":"control 'SV-204403' do\n  title 'The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver\n    idle-activation-enabled setting for the graphical user interface.'\n  desc \"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    The ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to\n    disengage the graphical user interface session lock provides the assurance that all sessions will lock after the\n    specified period of time.\"\n  desc 'check', 'Verify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n\n     system-db:local\n\nCheck for the idle-activation-enabled setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/*\n\n     /org/gnome/desktop/screensaver/idle-activation-enabled\n\nIf the command does not return a result, this is a finding.'\n  desc 'fix', 'Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the screensaver idle-activation-enabled setting:\n    /org/gnome/desktop/screensaver/idle-activation-enabled'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-78997', 'SV-93703']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-204403'\n  tag rid: 'SV-204403r880785_rule'\n  tag stig_id: 'RHEL-07-010101'\n  tag fix_id: 'F-4527r880784_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n\n    if package('gnome-desktop3').installed?\n      impact 0.5\n    else\n      impact 0.0\n    end\n\n    if package('gnome-desktop3').installed?\n      describe command('gsettings writable org.gnome.desktop.screensaver idle-activation-enabled') do\n        its('stdout.strip') { should cmp 'false' }\n      end\n    end\n\n    unless package('gnome-desktop3').installed?\n      describe 'The GNOME desktop is not installed' do\n        skip 'The GNOME desktop is not installed, this control is Not Applicable.'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204403.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The GNOME desktop is not installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The GNOME desktop is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204404","title":"The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces\n    when the screensaver is activated.","desc":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.","descriptions":[{"label":"default","data":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled."},{"label":"check","data":"Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nIf GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:\n\n     # grep -i lock-delay /etc/dconf/db/local.d/*\n     lock-delay=uint32 5\n\nIf the \"lock-delay\" setting is missing, or is not set to \"5\" or less, this is a finding."},{"label":"fix","data":"Configure the operating system to initiate a session lock for graphical user interfaces when a\n    screensaver is activated.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Add the setting to enable session locking when a screensaver is activated:\n    [org/gnome/desktop/screensaver]\n    lock-delay=uint32 5\n    The \"uint32\" must be included along with the integer key values as shown.\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71901","SV-86525"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-204404","rid":"SV-204404r880788_rule","stig_id":"RHEL-07-010110","fix_id":"F-4528r880787_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui","screensaver","lock","session"],"host":null},"code":"control 'SV-204404' do\n  title 'The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces\n    when the screensaver is activated.'\n  desc \"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate\n    physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,\n    operating systems need to be able to identify when a user's session has idled and take action to initiate the\n    session lock.\n    The session lock is implemented at the point where session activity can be determined and/or controlled.\"\n  desc 'check', 'Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nIf GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command:\n\n     # grep -i lock-delay /etc/dconf/db/local.d/*\n     lock-delay=uint32 5\n\nIf the \"lock-delay\" setting is missing, or is not set to \"5\" or less, this is a finding.'\n  desc 'fix', 'Configure the operating system to initiate a session lock for graphical user interfaces when a\n    screensaver is activated.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    # touch /etc/dconf/db/local.d/00-screensaver\n    Add the setting to enable session locking when a screensaver is activated:\n    [org/gnome/desktop/screensaver]\n    lock-delay=uint32 5\n    The \"uint32\" must be included along with the integer key values as shown.\n    Update the system databases:\n    # dconf update\n    Users must log out and back in again before the system-wide settings take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71901', 'SV-86525']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-204404'\n  tag rid: 'SV-204404r880788_rule'\n  tag stig_id: 'RHEL-07-010110'\n  tag fix_id: 'F-4528r880787_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui', 'screensaver', 'lock', 'session']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n\n    describe command(\"gsettings get org.gnome.desktop.screensaver lock-delay | cut -d ' ' -f2\") do\n      its('stdout.strip') { should cmp input('expected_lock_delay') }\n      its('stdout.strip') { should cmp <= input('max_lock_delay') }\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n        Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204404.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n        Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204405","title":"The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements\n    /etc/pam.d/system-auth when changing passwords.","desc":"Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods.\n    PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important\n    security function could be bypassed if stack entries are not centralized.","descriptions":[{"label":"default","data":"Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods.\n    PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important\n    security function could be bypassed if stack entries are not centralized."},{"label":"check","data":"Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:\n    # cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth\n    password     substack     system-auth\n    If no results are returned, the line is commented out, this is a finding."},{"label":"fix","data":"Configure PAM to utilize /etc/pam.d/system-auth when changing passwords.\n    Add the following line to \"/etc/pam.d/passwd\" (or modify the line to have the required value):\n    password     substack    system-auth"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-95715","V-81003"],"severity":"medium","gtitle":"SRG-OS-000069-GPOS-00037","gid":"V-204405","rid":"SV-204405r603261_rule","stig_id":"RHEL-07-010118","fix_id":"F-4529r88408_fix","cci":["CCI-000192"],"subsystems":["pam","password"],"nist":["IA-5 (1) (a)"],"host":null,"container":null},"code":"control 'SV-204405' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that /etc/pam.d/passwd implements\n    /etc/pam.d/system-auth when changing passwords.'\n  desc 'Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods.\n    PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important\n    security function could be bypassed if stack entries are not centralized.'\n  desc 'check', 'Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:\n    # cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth\n    password     substack     system-auth\n    If no results are returned, the line is commented out, this is a finding.'\n  desc 'fix', 'Configure PAM to utilize /etc/pam.d/system-auth when changing passwords.\n    Add the following line to \"/etc/pam.d/passwd\" (or modify the line to have the required value):\n    password     substack    system-auth'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-95715', 'V-81003']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000069-GPOS-00037'\n  tag gid: 'V-204405'\n  tag rid: 'SV-204405r603261_rule'\n  tag stig_id: 'RHEL-07-010118'\n  tag fix_id: 'F-4529r88408_fix'\n  tag cci: ['CCI-000192']\n  tag subsystems: ['pam', 'password']\n  tag nist: ['IA-5 (1) (a)']\n  tag 'host'\n  tag 'container'\n\n  describe pam('/etc/pam.d/password-auth') do\n    its('lines') { should match_pam_rule('password substack system-auth') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204405.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] ","run_time":8.5e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `pam` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"}]},{"id":"SV-204406","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, pwquality must be used.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks. \"pwquality\" enforces complex password construction configuration and has the ability to\n    limit brute-force attacks on the system.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks. \"pwquality\" enforces complex password construction configuration and has the ability to\n    limit brute-force attacks on the system."},{"label":"check","data":"Verify the operating system uses \"pwquality\" to enforce the password complexity rules.\n    Check for the use of \"pwquality\" with the following command:\n    # cat /etc/pam.d/system-auth | grep pam_pwquality\n    password required pam_pwquality.so retry=3\n    If the command does not return an uncommented line containing the value \"pam_pwquality.so\", this is a finding.\n    If the value of \"retry\" is set to \"0\" or greater than \"3\", this is a finding."},{"label":"fix","data":"Configure the operating system to use \"pwquality\" to enforce password complexity rules.\n    Add the following line to \"/etc/pam.d/system-auth\" (or modify the line to have the required value):\n    password required pam_pwquality.so retry=3\n    Note: The value of \"retry\" should be between \"1\" and \"3\"."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87811","V-73159"],"severity":"medium","gtitle":"SRG-OS-000069-GPOS-00037","gid":"V-204406","rid":"SV-204406r603261_rule","stig_id":"RHEL-07-010119","fix_id":"F-4530r88411_fix","cci":["CCI-000192"],"nist":["IA-5 (1) (a)"],"subsystems":["pam","pwquality","password"],"host":null,"container":null},"code":"control 'SV-204406' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, pwquality must be used.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks. \"pwquality\" enforces complex password construction configuration and has the ability to\n    limit brute-force attacks on the system.'\n  desc 'check', 'Verify the operating system uses \"pwquality\" to enforce the password complexity rules.\n    Check for the use of \"pwquality\" with the following command:\n    # cat /etc/pam.d/system-auth | grep pam_pwquality\n    password required pam_pwquality.so retry=3\n    If the command does not return an uncommented line containing the value \"pam_pwquality.so\", this is a finding.\n    If the value of \"retry\" is set to \"0\" or greater than \"3\", this is a finding.'\n  desc 'fix', 'Configure the operating system to use \"pwquality\" to enforce password complexity rules.\n    Add the following line to \"/etc/pam.d/system-auth\" (or modify the line to have the required value):\n    password required pam_pwquality.so retry=3\n    Note: The value of \"retry\" should be between \"1\" and \"3\".'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87811', 'V-73159']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000069-GPOS-00037'\n  tag gid: 'V-204406'\n  tag rid: 'SV-204406r603261_rule'\n  tag stig_id: 'RHEL-07-010119'\n  tag fix_id: 'F-4530r88411_fix'\n  tag cci: ['CCI-000192']\n  tag nist: ['IA-5 (1) (a)']\n  tag subsystems: ['pam', 'pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe pam('/etc/pam.d/system-auth') do\n    its('lines') { should match_pam_rule(\"password required pam_pwquality.so retry=#{input('retry')}\") }\n  end\n\n  describe 'input value' do\n    it 'for retry should be in line with maximum/minimum allowed values by policy' do\n      expect(input('retry')).to be_between(1, input('max_retry'))\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204406.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] ","run_time":7.3e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `pam` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"},{"status":"passed","code_desc":"input value for retry should be in line with maximum/minimum allowed values by policy","run_time":0.004851,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204407","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, the new password must contain at least one upper-case character.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"Note: The value to require a number of upper-case characters to be set is expressed as a negative\n    number in \"/etc/security/pwquality.conf\".\n    Check the value for \"ucredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep ucredit /etc/security/pwquality.conf\n    ucredit = -1\n    If the value of \"ucredit\" is not set to a negative value, this is a finding."},{"label":"fix","data":"Configure the operating system to enforce password complexity by requiring that at least one\n    upper-case character be used by setting the \"ucredit\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    ucredit = -1"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86527","V-71903"],"severity":"medium","gtitle":"SRG-OS-000069-GPOS-00037","gid":"V-204407","rid":"SV-204407r603261_rule","stig_id":"RHEL-07-010120","fix_id":"F-4531r88414_fix","cci":["CCI-000192"],"nist":["IA-5 (1) (a)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204407' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, the new password must contain at least one upper-case character.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'Note: The value to require a number of upper-case characters to be set is expressed as a negative\n    number in \"/etc/security/pwquality.conf\".\n    Check the value for \"ucredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep ucredit /etc/security/pwquality.conf\n    ucredit = -1\n    If the value of \"ucredit\" is not set to a negative value, this is a finding.'\n  desc 'fix', 'Configure the operating system to enforce password complexity by requiring that at least one\n    upper-case character be used by setting the \"ucredit\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    ucredit = -1'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86527', 'V-71903']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000069-GPOS-00037'\n  tag gid: 'V-204407'\n  tag rid: 'SV-204407r603261_rule'\n  tag stig_id: 'RHEL-07-010120'\n  tag fix_id: 'F-4531r88414_fix'\n  tag cci: ['CCI-000192']\n  tag nist: ['IA-5 (1) (a)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('ucredit') { should cmp < 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204407.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":8.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204408","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, the new password must contain at least one lower-case character.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"Note: The value to require a number of lower-case characters to be set is expressed as a negative\n    number in \"/etc/security/pwquality.conf\".\n    Check the value for \"lcredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep lcredit /etc/security/pwquality.conf\n    lcredit = -1\n    If the value of \"lcredit\" is not set to a negative value, this is a finding."},{"label":"fix","data":"Configure the system to require at least one lower-case character when creating or changing a\n    password.\n    Add or modify the following line\n    in \"/etc/security/pwquality.conf\":\n    lcredit = -1"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86529","V-71905"],"severity":"medium","gtitle":"SRG-OS-000070-GPOS-00038","gid":"V-204408","rid":"SV-204408r603261_rule","stig_id":"RHEL-07-010130","fix_id":"F-4532r88417_fix","cci":["CCI-000193"],"nist":["IA-5 (1) (a)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204408' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, the new password must contain at least one lower-case character.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'Note: The value to require a number of lower-case characters to be set is expressed as a negative\n    number in \"/etc/security/pwquality.conf\".\n    Check the value for \"lcredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep lcredit /etc/security/pwquality.conf\n    lcredit = -1\n    If the value of \"lcredit\" is not set to a negative value, this is a finding.'\n  desc 'fix', 'Configure the system to require at least one lower-case character when creating or changing a\n    password.\n    Add or modify the following line\n    in \"/etc/security/pwquality.conf\":\n    lcredit = -1'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86529', 'V-71905']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000070-GPOS-00038'\n  tag gid: 'V-204408'\n  tag rid: 'SV-204408r603261_rule'\n  tag stig_id: 'RHEL-07-010130'\n  tag fix_id: 'F-4532r88417_fix'\n  tag cci: ['CCI-000193']\n  tag nist: ['IA-5 (1) (a)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('lcredit') { should cmp < 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204408.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204409","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are assigned, the new password must contain at least one numeric character.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"Note: The value to require a number of numeric characters to be set is expressed as a negative\n    number in \"/etc/security/pwquality.conf\".\n    Check the value for \"dcredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep dcredit /etc/security/pwquality.conf\n    dcredit = -1\n    If the value of \"dcredit\" is not set to a negative value, this is a finding."},{"label":"fix","data":"Configure the operating system to enforce password complexity by requiring that at least one numeric\n    character be used by setting the \"dcredit\" option.\n    Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value):\n    dcredit = -1"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86531","V-71907"],"severity":"medium","gtitle":"SRG-OS-000071-GPOS-00039","gid":"V-204409","rid":"SV-204409r603261_rule","stig_id":"RHEL-07-010140","fix_id":"F-4533r88420_fix","cci":["CCI-000194"],"nist":["IA-5 (1) (a)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204409' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are assigned, the new password must contain at least one numeric character.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'Note: The value to require a number of numeric characters to be set is expressed as a negative\n    number in \"/etc/security/pwquality.conf\".\n    Check the value for \"dcredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep dcredit /etc/security/pwquality.conf\n    dcredit = -1\n    If the value of \"dcredit\" is not set to a negative value, this is a finding.'\n  desc 'fix', 'Configure the operating system to enforce password complexity by requiring that at least one numeric\n    character be used by setting the \"dcredit\" option.\n    Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value):\n    dcredit = -1'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86531', 'V-71907']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000071-GPOS-00039'\n  tag gid: 'V-204409'\n  tag rid: 'SV-204409r603261_rule'\n  tag stig_id: 'RHEL-07-010140'\n  tag fix_id: 'F-4533r88420_fix'\n  tag cci: ['CCI-000194']\n  tag nist: ['IA-5 (1) (a)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('dcredit') { should cmp < 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204409.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204410","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, the new password must contain at least one special character.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"Verify the operating system enforces password complexity by requiring that at least one special\n    character be used.\n    Note: The value to require a number of special characters to be set is expressed as a negative number in\n    \"/etc/security/pwquality.conf\".\n    Check the value for \"ocredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep ocredit /etc/security/pwquality.conf\n    ocredit=-1\n    If the value of \"ocredit\" is not set to a negative value, this is a finding."},{"label":"fix","data":"Configure the operating system to enforce password complexity by requiring that at least one special\n    character be used by setting the \"ocredit\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    ocredit = -1"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86533","V-71909"],"severity":"medium","gtitle":"SRG-OS-000266-GPOS-00101","gid":"V-204410","rid":"SV-204410r603261_rule","stig_id":"RHEL-07-010150","fix_id":"F-4534r88423_fix","cci":["CCI-001619"],"nist":["IA-5 (1) (a)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204410' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed or new\n    passwords are established, the new password must contain at least one special character.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'Verify the operating system enforces password complexity by requiring that at least one special\n    character be used.\n    Note: The value to require a number of special characters to be set is expressed as a negative number in\n    \"/etc/security/pwquality.conf\".\n    Check the value for \"ocredit\" in \"/etc/security/pwquality.conf\" with the following command:\n    # grep ocredit /etc/security/pwquality.conf\n    ocredit=-1\n    If the value of \"ocredit\" is not set to a negative value, this is a finding.'\n  desc 'fix', 'Configure the operating system to enforce password complexity by requiring that at least one special\n    character be used by setting the \"ocredit\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    ocredit = -1'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86533', 'V-71909']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000266-GPOS-00101'\n  tag gid: 'V-204410'\n  tag rid: 'SV-204410r603261_rule'\n  tag stig_id: 'RHEL-07-010150'\n  tag fix_id: 'F-4534r88423_fix'\n  tag cci: ['CCI-001619']\n  tag nist: ['IA-5 (1) (a)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('ocredit') { should cmp < 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204410.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":1.7e-05,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204411","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a\n    minimum of eight of the total number of characters must be changed.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"The \"difok\" option sets the number of characters in a password that must not be present in the old\n    password.\n    Check for the value of the \"difok\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep difok /etc/security/pwquality.conf\n    difok = 8\n    If the value of \"difok\" is set to less than \"8\", this is a finding."},{"label":"fix","data":"Configure the operating system to require the change of at least eight of the total number of\n    characters when passwords are changed by setting the \"difok\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    difok = 8"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71911","SV-86535"],"severity":"medium","gtitle":"SRG-OS-000072-GPOS-00040","gid":"V-204411","rid":"SV-204411r603261_rule","stig_id":"RHEL-07-010160","fix_id":"F-4535r88426_fix","cci":["CCI-000195"],"nist":["IA-5 (1) (b)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204411' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a\n    minimum of eight of the total number of characters must be changed.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'The \"difok\" option sets the number of characters in a password that must not be present in the old\n    password.\n    Check for the value of the \"difok\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep difok /etc/security/pwquality.conf\n    difok = 8\n    If the value of \"difok\" is set to less than \"8\", this is a finding.'\n  desc 'fix', 'Configure the operating system to require the change of at least eight of the total number of\n    characters when passwords are changed by setting the \"difok\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    difok = 8'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71911', 'SV-86535']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000072-GPOS-00040'\n  tag gid: 'V-204411'\n  tag rid: 'SV-204411r603261_rule'\n  tag stig_id: 'RHEL-07-010160'\n  tag fix_id: 'F-4535r88426_fix'\n  tag cci: ['CCI-000195']\n  tag nist: ['IA-5 (1) (b)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('difok') { should cmp input('expected_difok') }\n    its('difok') { should cmp <= input('max_difok') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204411.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204412","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a\n    minimum of four character classes must be changed.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"The \"minclass\" option sets the minimum number of required classes of characters for the new password\n    (digits, upper-case, lower-case, others).\n    Check for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep minclass /etc/security/pwquality.conf\n    minclass = 4\n    If the value of \"minclass\" is set to less than \"4\", this is a finding."},{"label":"fix","data":"Configure the operating system to require the change of at least four character classes when passwords\n    are changed by setting the \"minclass\" option.\n    Add the following line to \"/etc/security/pwquality.conf conf\" (or modify the line to have the required value):\n    minclass = 4"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71913","SV-86537"],"severity":"medium","gtitle":"SRG-OS-000072-GPOS-00040","gid":"V-204412","rid":"SV-204412r603261_rule","stig_id":"RHEL-07-010170","fix_id":"F-4536r88429_fix","cci":["CCI-000195"],"nist":["IA-5 (1) (b)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204412' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed a\n    minimum of four character classes must be changed.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'The \"minclass\" option sets the minimum number of required classes of characters for the new password\n    (digits, upper-case, lower-case, others).\n    Check for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep minclass /etc/security/pwquality.conf\n    minclass = 4\n    If the value of \"minclass\" is set to less than \"4\", this is a finding.'\n  desc 'fix', 'Configure the operating system to require the change of at least four character classes when passwords\n    are changed by setting the \"minclass\" option.\n    Add the following line to \"/etc/security/pwquality.conf conf\" (or modify the line to have the required value):\n    minclass = 4'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71913', 'SV-86537']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000072-GPOS-00040'\n  tag gid: 'V-204412'\n  tag rid: 'SV-204412r603261_rule'\n  tag stig_id: 'RHEL-07-010170'\n  tag fix_id: 'F-4536r88429_fix'\n  tag cci: ['CCI-000195']\n  tag nist: ['IA-5 (1) (b)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('minclass') { should cmp input('expected_minclass') }\n    its('minclass') { should cmp >= input('min_minclass') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204412.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204413","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the\n    number of repeating consecutive characters must not be more than three characters.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"The \"maxrepeat\" option sets the maximum number of allowed same consecutive characters in a new\n    password.\n    Check for the value of the \"maxrepeat\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep maxrepeat /etc/security/pwquality.conf\n    maxrepeat = 3\n    If the value of \"maxrepeat\" is set to more than \"3\", this is a finding."},{"label":"fix","data":"Configure the operating system to require the change of the number of repeating consecutive characters\n    when passwords are changed by setting the \"maxrepeat\" option.\n    Add the following line to \"/etc/security/pwquality.conf conf\" (or modify the line to have the required value):\n    maxrepeat = 3"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86539","V-71915"],"severity":"medium","gtitle":"SRG-OS-000072-GPOS-00040","gid":"V-204413","rid":"SV-204413r603261_rule","stig_id":"RHEL-07-010180","fix_id":"F-4537r88432_fix","cci":["CCI-000195"],"nist":["IA-5 (1) (b)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204413' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the\n    number of repeating consecutive characters must not be more than three characters.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'The \"maxrepeat\" option sets the maximum number of allowed same consecutive characters in a new\n    password.\n    Check for the value of the \"maxrepeat\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep maxrepeat /etc/security/pwquality.conf\n    maxrepeat = 3\n    If the value of \"maxrepeat\" is set to more than \"3\", this is a finding.'\n  desc 'fix', 'Configure the operating system to require the change of the number of repeating consecutive characters\n    when passwords are changed by setting the \"maxrepeat\" option.\n    Add the following line to \"/etc/security/pwquality.conf conf\" (or modify the line to have the required value):\n    maxrepeat = 3'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86539', 'V-71915']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000072-GPOS-00040'\n  tag gid: 'V-204413'\n  tag rid: 'SV-204413r603261_rule'\n  tag stig_id: 'RHEL-07-010180'\n  tag fix_id: 'F-4537r88432_fix'\n  tag cci: ['CCI-000195']\n  tag nist: ['IA-5 (1) (b)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('maxrepeat') { should cmp input('expected_passwd_repeats') }\n    its('maxrepeat') { should cmp <= input('max_passwd_repeats') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204413.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204414","title":"The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the\n    number of repeating characters of the same character class must not be more than four characters.","desc":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.","descriptions":[{"label":"default","data":"Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised."},{"label":"check","data":"The \"maxclassrepeat\" option sets the maximum number of allowed same consecutive characters in the\n    same class in the new password.\n    Check for the value of the \"maxclassrepeat\" option in \"/etc/security/pwquality.conf\" with the following command:\n    $ sudo grep maxclassrepeat /etc/security/pwquality.conf\n    maxclassrepeat = 4\n    If the value of \"maxclassrepeat\" is set to \"0\", more than \"4\" or is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to require the change of the number of repeating characters of the same\n    character class when passwords are changed by setting the \"maxclassrepeat\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" conf (or modify the line to have the required value):\n    maxclassrepeat = 4"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86541","V-71917"],"severity":"medium","gtitle":"SRG-OS-000072-GPOS-00040","gid":"V-204414","rid":"SV-204414r809186_rule","stig_id":"RHEL-07-010190","fix_id":"F-4538r88435_fix","cci":["CCI-000195"],"nist":["IA-5 (1) (b)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204414' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that when passwords are changed the\n    number of repeating characters of the same character class must not be more than four characters.'\n  desc 'Use of a complex password helps to increase the time and resources required to compromise the password.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks.\n    Password complexity is one factor of several that determines how long it takes to crack a password. The more complex\n    the password, the greater the number of possible combinations that need to be tested before the password is\n    compromised.'\n  desc 'check', 'The \"maxclassrepeat\" option sets the maximum number of allowed same consecutive characters in the\n    same class in the new password.\n    Check for the value of the \"maxclassrepeat\" option in \"/etc/security/pwquality.conf\" with the following command:\n    $ sudo grep maxclassrepeat /etc/security/pwquality.conf\n    maxclassrepeat = 4\n    If the value of \"maxclassrepeat\" is set to \"0\", more than \"4\" or is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to require the change of the number of repeating characters of the same\n    character class when passwords are changed by setting the \"maxclassrepeat\" option.\n    Add the following line to \"/etc/security/pwquality.conf\" conf (or modify the line to have the required value):\n    maxclassrepeat = 4'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86541', 'V-71917']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000072-GPOS-00040'\n  tag gid: 'V-204414'\n  tag rid: 'SV-204414r809186_rule'\n  tag stig_id: 'RHEL-07-010190'\n  tag fix_id: 'F-4538r88435_fix'\n  tag cci: ['CCI-000195']\n  tag nist: ['IA-5 (1) (b)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('maxclassrepeat') { should cmp input('classrepeat') }\n    its('maxclassrepeat') { should_not cmp > input('max_classrepeat') }\n    its('maxclassrepeat') { should_not cmp <= 0 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204414.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204415","title":"The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is\n    configured to store only encrypted representations of passwords.","desc":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text.","descriptions":[{"label":"default","data":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text."},{"label":"check","data":"Verify the PAM system service is configured to store only encrypted representations of passwords.\n    The strength of encryption that must be used to hash passwords for all accounts is SHA512.\n    Check that the system is configured to create SHA512 hashed passwords with the following command:\n    # grep password /etc/pam.d/system-auth /etc/pam.d/password-auth\n    Outcome should look like following:\n    /etc/pam.d/system-auth-ac:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n    /etc/pam.d/password-auth:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n    If the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" configuration files allow for password hashes other\n    than SHA512 to be used, this is a finding."},{"label":"fix","data":"Configure the operating system to store only SHA512 encrypted representations of passwords.\n\nAdd the following line in \"/etc/pam.d/system-auth\":\n     pam_unix.so sha512 shadow try_first_pass use_authtok\n\nAdd the following line in \"/etc/pam.d/password-auth\":\n     pam_unix.so sha512 shadow try_first_pass use_authtok\n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71919","SV-86543"],"severity":"medium","gtitle":"SRG-OS-000073-GPOS-00041","gid":"V-204415","rid":"SV-204415r880833_rule","stig_id":"RHEL-07-010200","fix_id":"F-4539r880832_fix","cci":["CCI-000196"],"nist":["IA-5 (1) (c)"],"subsystems":["pam","password"],"host":null,"container":null},"code":"control 'SV-204415' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the PAM system service is\n    configured to store only encrypted representations of passwords.'\n  desc 'Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text.'\n  desc 'check', 'Verify the PAM system service is configured to store only encrypted representations of passwords.\n    The strength of encryption that must be used to hash passwords for all accounts is SHA512.\n    Check that the system is configured to create SHA512 hashed passwords with the following command:\n    # grep password /etc/pam.d/system-auth /etc/pam.d/password-auth\n    Outcome should look like following:\n    /etc/pam.d/system-auth-ac:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n    /etc/pam.d/password-auth:password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n    If the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" configuration files allow for password hashes other\n    than SHA512 to be used, this is a finding.'\n  desc 'fix', 'Configure the operating system to store only SHA512 encrypted representations of passwords.\n\nAdd the following line in \"/etc/pam.d/system-auth\":\n     pam_unix.so sha512 shadow try_first_pass use_authtok\n\nAdd the following line in \"/etc/pam.d/password-auth\":\n     pam_unix.so sha512 shadow try_first_pass use_authtok\n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71919', 'SV-86543']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000073-GPOS-00041'\n  tag gid: 'V-204415'\n  tag rid: 'SV-204415r880833_rule'\n  tag stig_id: 'RHEL-07-010200'\n  tag fix_id: 'F-4539r880832_fix'\n  tag cci: ['CCI-000196']\n  tag nist: ['IA-5 (1) (c)']\n  tag subsystems: ['pam', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    describe pam('/etc/pam.d/password-auth') do\n      its('lines') { should match_pam_rule('password sufficient pam_unix.so sha512') }\n      its('lines') { should_not match_pam_rule('password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)') }\n    end\n    describe pam('/etc/pam.d/system-auth') do\n      its('lines') { should match_pam_rule('password sufficient pam_unix.so sha512') }\n      its('lines') { should_not match_pam_rule('password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)') }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204415.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] lines is expected to include password sufficient pam_unix.so sha512","run_time":0.00028,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] lines is expected not to include password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)","run_time":0.00018,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] lines is expected to include password sufficient pam_unix.so sha512","run_time":0.000168,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] lines is expected not to include password .* pam_unix.so (md5|bigcrypt|sha256|blowfish)","run_time":0.000352,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"}]},{"id":"SV-204416","title":"The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only\n    encrypted representations of passwords.","desc":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text.","descriptions":[{"label":"default","data":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text."},{"label":"check","data":"Verify the system's shadow file is configured to store only encrypted representations of passwords.\n    The strength of encryption that must be used to hash passwords for all accounts is SHA512.\n    Check that the system is configured to create SHA512 hashed passwords with the following command:\n    # grep -i encrypt /etc/login.defs\n    ENCRYPT_METHOD SHA512\n    If the \"/etc/login.defs\" configuration file does not exist or allows for password hashes other than SHA512 to be\n    used, this is a finding."},{"label":"fix","data":"Configure the operating system to store only SHA512 encrypted representations of passwords.\n    Add or update the following line in \"/etc/login.defs\":\n    ENCRYPT_METHOD SHA512"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71921","SV-86545"],"severity":"medium","gtitle":"SRG-OS-000073-GPOS-00041","gid":"V-204416","rid":"SV-204416r877397_rule","stig_id":"RHEL-07-010210","fix_id":"F-4540r88441_fix","cci":["CCI-000196"],"nist":["IA-5 (1) (c)"],"subsystems":["login_defs","password"],"host":null,"container":null},"code":"control 'SV-204416' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to use the shadow file to store only\n    encrypted representations of passwords.'\n  desc 'Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text.'\n  desc 'check', %q(Verify the system's shadow file is configured to store only encrypted representations of passwords.\n    The strength of encryption that must be used to hash passwords for all accounts is SHA512.\n    Check that the system is configured to create SHA512 hashed passwords with the following command:\n    # grep -i encrypt /etc/login.defs\n    ENCRYPT_METHOD SHA512\n    If the \"/etc/login.defs\" configuration file does not exist or allows for password hashes other than SHA512 to be\n    used, this is a finding.)\n  desc 'fix', 'Configure the operating system to store only SHA512 encrypted representations of passwords.\n    Add or update the following line in \"/etc/login.defs\":\n    ENCRYPT_METHOD SHA512'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71921', 'SV-86545']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000073-GPOS-00041'\n  tag gid: 'V-204416'\n  tag rid: 'SV-204416r877397_rule'\n  tag stig_id: 'RHEL-07-010210'\n  tag fix_id: 'F-4540r88441_fix'\n  tag cci: ['CCI-000196']\n  tag nist: ['IA-5 (1) (c)']\n  tag subsystems: ['login_defs', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe login_defs do\n    its('ENCRYPT_METHOD') { should cmp 'SHA512' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204416.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"login.defs","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"login.defs","skip_message":"Can't find file: /etc/login.defs","resource_class":"login_defs","resource_params":"[]"}]},{"id":"SV-204417","title":"The Red Hat Enterprise Linux operating system must be configured so that user and group account\n    administration utilities are configured to store only encrypted representations of passwords.","desc":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text.","descriptions":[{"label":"default","data":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text."},{"label":"check","data":"Verify the user and group account administration utilities are configured to store only encrypted\n    representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is\n    \"SHA512\".\n    Check that the system is configured to create \"SHA512\" hashed passwords with the following command:\n    # grep -i sha512 /etc/libuser.conf\n    crypt_style = sha512\n    If the \"crypt_style\" variable is not set to \"sha512\", is not in the defaults section, is commented out, or does not\n    exist, this is a finding."},{"label":"fix","data":"Configure the operating system to store only SHA512 encrypted representations of passwords.\n    Add or update the following line in \"/etc/libuser.conf\" in the [defaults] section:\n    crypt_style = sha512"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71923","SV-86547"],"severity":"medium","gtitle":"SRG-OS-000073-GPOS-00041","gid":"V-204417","rid":"SV-204417r877397_rule","stig_id":"RHEL-07-010220","fix_id":"F-4541r88444_fix","cci":["CCI-000196"],"nist":["IA-5 (1) (c)"],"subsystems":["libuser_conf","password"],"host":null,"container":null},"code":"control 'SV-204417' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that user and group account\n    administration utilities are configured to store only encrypted representations of passwords.'\n  desc 'Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.\n    If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords\n    encrypted with a weak algorithm are no more protected than if they are kept in plain text.'\n  desc 'check', 'Verify the user and group account administration utilities are configured to store only encrypted\n    representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is\n    \"SHA512\".\n    Check that the system is configured to create \"SHA512\" hashed passwords with the following command:\n    # grep -i sha512 /etc/libuser.conf\n    crypt_style = sha512\n    If the \"crypt_style\" variable is not set to \"sha512\", is not in the defaults section, is commented out, or does not\n    exist, this is a finding.'\n  desc 'fix', 'Configure the operating system to store only SHA512 encrypted representations of passwords.\n    Add or update the following line in \"/etc/libuser.conf\" in the [defaults] section:\n    crypt_style = sha512'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71923', 'SV-86547']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000073-GPOS-00041'\n  tag gid: 'V-204417'\n  tag rid: 'SV-204417r877397_rule'\n  tag stig_id: 'RHEL-07-010220'\n  tag fix_id: 'F-4541r88444_fix'\n  tag cci: ['CCI-000196']\n  tag nist: ['IA-5 (1) (c)']\n  tag subsystems: ['libuser_conf', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe command('cat /etc/libuser.conf | grep -i sha512') do\n    its('stdout.strip') { should match(/^crypt_style = sha512$/) }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204417.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `cat /etc/libuser.conf | grep -i sha512` ","run_time":8.6e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"cat /etc/libuser.conf | grep -i sha512\"]"}]},{"id":"SV-204418","title":"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are\n    restricted to a 24 hours/1 day minimum lifetime.","desc":"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password\n    reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,\n    the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding\n    password reuse.","descriptions":[{"label":"default","data":"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password\n    reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,\n    the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding\n    password reuse."},{"label":"check","data":"Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user\n    accounts.\n    Check for the value of \"PASS_MIN_DAYS\" in \"/etc/login.defs\" with the following command:\n    # grep -i pass_min_days /etc/login.defs\n    PASS_MIN_DAYS     1\n    If the \"PASS_MIN_DAYS\" parameter value is not \"1\" or greater, or is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime.\n    Add the following line in \"/etc/login.defs\" (or modify the line to have the required value):\n    PASS_MIN_DAYS     1"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71925","SV-86549"],"severity":"medium","gtitle":"SRG-OS-000075-GPOS-00043","gid":"V-204418","rid":"SV-204418r603261_rule","stig_id":"RHEL-07-010230","fix_id":"F-4542r88447_fix","cci":["CCI-000198"],"nist":["IA-5 (1) (d)"],"subsystems":["login_defs","password"]},"code":"control 'SV-204418' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are\n    restricted to a 24 hours/1 day minimum lifetime.'\n  desc \"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password\n    reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,\n    the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding\n    password reuse.\"\n  desc 'check', 'Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user\n    accounts.\n    Check for the value of \"PASS_MIN_DAYS\" in \"/etc/login.defs\" with the following command:\n    # grep -i pass_min_days /etc/login.defs\n    PASS_MIN_DAYS     1\n    If the \"PASS_MIN_DAYS\" parameter value is not \"1\" or greater, or is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime.\n    Add the following line in \"/etc/login.defs\" (or modify the line to have the required value):\n    PASS_MIN_DAYS     1'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71925', 'SV-86549']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000075-GPOS-00043'\n  tag gid: 'V-204418'\n  tag rid: 'SV-204418r603261_rule'\n  tag stig_id: 'RHEL-07-010230'\n  tag fix_id: 'F-4542r88447_fix'\n  tag cci: ['CCI-000198']\n  tag nist: ['IA-5 (1) (d)']\n  tag subsystems: ['login_defs', 'password']\n\n  describe login_defs do\n    its('PASS_MIN_DAYS') { should cmp >= 1 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204418.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"login.defs","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"login.defs","skip_message":"Can't find file: /etc/login.defs","resource_class":"login_defs","resource_params":"[]"}]},{"id":"SV-204419","title":"The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24\n    hours/1 day minimum lifetime.","desc":"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password\n    reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,\n    the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding\n    password reuse.","descriptions":[{"label":"default","data":"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password\n    reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,\n    the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding\n    password reuse."},{"label":"check","data":"Check whether the minimum time period between password changes for each user account is one day or\n    greater.\n    # awk -F: '$4 < 1 {print $1 \" \" $4}' /etc/shadow\n    If any results are returned that are not associated with a system account, this is a finding."},{"label":"fix","data":"Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:\n    # chage -m 1 [user]"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86551","V-71927"],"severity":"medium","gtitle":"SRG-OS-000075-GPOS-00043","gid":"V-204419","rid":"SV-204419r603261_rule","stig_id":"RHEL-07-010240","fix_id":"F-4543r88450_fix","cci":["CCI-000198"],"nist":["IA-5 (1) (d)"],"subsystems":["password","/etc/shadow"],"host":null},"code":"control 'SV-204419' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that passwords are restricted to a 24\n    hours/1 day minimum lifetime.'\n  desc \"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password\n    reuse or history enforcement requirement. If users are allowed to immediately and continually change their password,\n    the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding\n    password reuse.\"\n  desc 'check', %q(Check whether the minimum time period between password changes for each user account is one day or\n    greater.\n    # awk -F: '$4 < 1 {print $1 \" \" $4}' /etc/shadow\n    If any results are returned that are not associated with a system account, this is a finding.)\n  desc 'fix', 'Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime:\n    # chage -m 1 [user]'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86551', 'V-71927']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000075-GPOS-00043'\n  tag gid: 'V-204419'\n  tag rid: 'SV-204419r603261_rule'\n  tag stig_id: 'RHEL-07-010240'\n  tag fix_id: 'F-4543r88450_fix'\n  tag cci: ['CCI-000198']\n  tag nist: ['IA-5 (1) (d)']\n  tag subsystems: ['password', '/etc/shadow']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    shadow.users.each do |user|\n      # filtering on non-system accounts (uid >= 1000)\n      next unless user(user).uid >= 1000\n\n      describe shadow.users(user) do\n        its('min_days.first') { should cmp input('expected_password_lifetime') }\n        its('min_days.first') { should cmp >= input('min_password_lifetime') }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204419.rb"},"waiver_data":{},"results":[]},{"id":"SV-204420","title":"The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are\n    restricted to a 60-day maximum lifetime.","desc":"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed\n    periodically. If the operating system does not limit the lifetime of passwords and force users to change their\n    passwords, there is the risk that the operating system passwords could be compromised.","descriptions":[{"label":"default","data":"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed\n    periodically. If the operating system does not limit the lifetime of passwords and force users to change their\n    passwords, there is the risk that the operating system passwords could be compromised."},{"label":"check","data":"If passwords are not being used for authentication, this is Not Applicable.\n    Verify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.\n    Check for the value of \"PASS_MAX_DAYS\" in \"/etc/login.defs\" with the following command:\n    # grep -i pass_max_days /etc/login.defs\n    PASS_MAX_DAYS 60\n    If the \"PASS_MAX_DAYS\" parameter value is not 60 or less, or is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to enforce a 60-day maximum password lifetime restriction.\n    Add the following line in \"/etc/login.defs\" (or modify the line to have the required value):\n    PASS_MAX_DAYS     60"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71929","SV-86553"],"severity":"medium","gtitle":"SRG-OS-000076-GPOS-00044","gid":"V-204420","rid":"SV-204420r603261_rule","stig_id":"RHEL-07-010250","fix_id":"F-4544r88453_fix","cci":["CCI-000199"],"nist":["IA-5 (1) (d)"],"subsystems":["login_defs","password"],"host":null,"container":null},"code":"control 'SV-204420' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that passwords for new users are\n    restricted to a 60-day maximum lifetime.'\n  desc 'Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed\n    periodically. If the operating system does not limit the lifetime of passwords and force users to change their\n    passwords, there is the risk that the operating system passwords could be compromised.'\n  desc 'check', 'If passwords are not being used for authentication, this is Not Applicable.\n    Verify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts.\n    Check for the value of \"PASS_MAX_DAYS\" in \"/etc/login.defs\" with the following command:\n    # grep -i pass_max_days /etc/login.defs\n    PASS_MAX_DAYS 60\n    If the \"PASS_MAX_DAYS\" parameter value is not 60 or less, or is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to enforce a 60-day maximum password lifetime restriction.\n    Add the following line in \"/etc/login.defs\" (or modify the line to have the required value):\n    PASS_MAX_DAYS     60'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71929', 'SV-86553']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000076-GPOS-00044'\n  tag gid: 'V-204420'\n  tag rid: 'SV-204420r603261_rule'\n  tag stig_id: 'RHEL-07-010250'\n  tag fix_id: 'F-4544r88453_fix'\n  tag cci: ['CCI-000199']\n  tag nist: ['IA-5 (1) (d)']\n  tag subsystems: ['login_defs', 'password']\n  tag 'host'\n  tag 'container'\n\n  if command(\"grep 'pam_unix.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'optional'\").stdout.empty? && command(\"grep 'pam_permit.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'required'\").stdout.empty?\n    describe login_defs do\n      its('PASS_MAX_DAYS') { should cmp input('pass_max_days') }\n      its('PASS_MAX_DAYS') { should cmp <= input('max_pass_max_days') }\n    end\n  else\n    impact 0.0\n    describe 'The system is not using password for authentication' do\n      skip 'The system is not using password for authentication, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204420.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"login.defs","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"login.defs","skip_message":"Can't find file: /etc/login.defs","resource_class":"login_defs","resource_params":"[]"}]},{"id":"SV-204421","title":"The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted\n    to a 60-day maximum lifetime.","desc":"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed\n    periodically. If the operating system does not limit the lifetime of passwords and force users to change their\n    passwords, there is the risk that the operating system passwords could be compromised.","descriptions":[{"label":"default","data":"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed\n    periodically. If the operating system does not limit the lifetime of passwords and force users to change their\n    passwords, there is the risk that the operating system passwords could be compromised."},{"label":"check","data":"Check whether the maximum time period for existing passwords is restricted to 60 days.\n    # awk -F: '$5 > 60 {print $1 \" \" $5}' /etc/shadow\n    If any results are returned that are not associated with a system account, this is a finding."},{"label":"fix","data":"Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.\n    # chage -M 60 [user]"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71931","SV-86555"],"severity":"medium","gtitle":"SRG-OS-000076-GPOS-00044","gid":"V-204421","rid":"SV-204421r603261_rule","stig_id":"RHEL-07-010260","fix_id":"F-4545r88456_fix","cci":["CCI-000199"],"nist":["IA-5 (1) (d)"],"subsystems":["password","/etc/shadow","tty"],"host":null},"code":"control 'SV-204421' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that existing passwords are restricted\n    to a 60-day maximum lifetime.'\n  desc 'Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed\n    periodically. If the operating system does not limit the lifetime of passwords and force users to change their\n    passwords, there is the risk that the operating system passwords could be compromised.'\n  desc 'check', %q(Check whether the maximum time period for existing passwords is restricted to 60 days.\n    # awk -F: '$5 > 60 {print $1 \" \" $5}' /etc/shadow\n    If any results are returned that are not associated with a system account, this is a finding.)\n  desc 'fix', 'Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction.\n    # chage -M 60 [user]'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71931', 'SV-86555']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000076-GPOS-00044'\n  tag gid: 'V-204421'\n  tag rid: 'SV-204421r603261_rule'\n  tag stig_id: 'RHEL-07-010260'\n  tag fix_id: 'F-4545r88456_fix'\n  tag cci: ['CCI-000199']\n  tag nist: ['IA-5 (1) (d)']\n  tag subsystems: ['password', '/etc/shadow', 'tty']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    shadow.users.each do |user|\n      # filtering on non-system accounts (uid >= 1000)\n      next unless user(user).uid >= 1000\n\n      describe shadow.users(user) do\n        its('max_days.first') { should cmp input('expected_max_password_lifetime') }\n        its('max_days.first') { should cmp <= input('max_password_lifetime') }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204421.rb"},"waiver_data":{},"results":[]},{"id":"SV-204422","title":"The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from\n    reuse for a minimum of five generations.","desc":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at\n    guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse\n    their password when that password has exceeded its defined lifetime, the end result is a password that is not\n    changed per policy requirements.","descriptions":[{"label":"default","data":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at\n    guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse\n    their password when that password has exceeded its defined lifetime, the end result is a password that is not\n    changed per policy requirements."},{"label":"check","data":"Verify the operating system prohibits password reuse for a minimum of five generations.\n    Check for the value of the \"remember\" argument in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" with the\n    following command:\n    # grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth\n    password    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\n    If the line containing the \"pam_pwhistory.so\" line does not have the \"remember\" module argument set, is commented\n    out, or the value of the \"remember\" module argument is set to less than \"5\", this is a finding."},{"label":"fix","data":"Configure the operating system to prohibit password reuse for a minimum of five generations.\n\nAdd the following line in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" (or modify the line to have the required value):\n\n     password     requisite     pam_pwhistory.so use_authtok remember=5 retry=3\n   \nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71933","SV-86557"],"severity":"medium","gtitle":"SRG-OS-000077-GPOS-00045","gid":"V-204422","rid":"SV-204422r880836_rule","stig_id":"RHEL-07-010270","fix_id":"F-4546r880835_fix","cci":["CCI-000200"],"nist":["IA-5 (1) (e)"],"subsystems":["pam","password"],"host":null,"container":null},"code":"control 'SV-204422' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that passwords are prohibited from\n    reuse for a minimum of five generations.'\n  desc 'Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at\n    guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse\n    their password when that password has exceeded its defined lifetime, the end result is a password that is not\n    changed per policy requirements.'\n  desc 'check', 'Verify the operating system prohibits password reuse for a minimum of five generations.\n    Check for the value of the \"remember\" argument in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" with the\n    following command:\n    # grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth\n    password    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\n    If the line containing the \"pam_pwhistory.so\" line does not have the \"remember\" module argument set, is commented\n    out, or the value of the \"remember\" module argument is set to less than \"5\", this is a finding.'\n  desc 'fix', 'Configure the operating system to prohibit password reuse for a minimum of five generations.\n\nAdd the following line in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" (or modify the line to have the required value):\n\n     password     requisite     pam_pwhistory.so use_authtok remember=5 retry=3\n   \nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71933', 'SV-86557']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000077-GPOS-00045'\n  tag gid: 'V-204422'\n  tag rid: 'SV-204422r880836_rule'\n  tag stig_id: 'RHEL-07-010270'\n  tag fix_id: 'F-4546r880835_fix'\n  tag cci: ['CCI-000200']\n  tag nist: ['IA-5 (1) (e)']\n  tag subsystems: ['pam', 'password']\n  tag 'host'\n  tag 'container'\n\n  reuse_generations = input('expected_reuse_generations')\n\n  describe.one do\n    describe pam('/etc/pam.d/system-auth') do\n      its('lines') { should match_pam_rule(\"password (required|requisite|sufficient) pam_(unix|pwhistory).so remember=#{reuse_generations}\") }\n    end\n    describe pam('/etc/pam.d/password-auth') do\n      its('lines') { should match_pam_rule(\"password (required|requisite|sufficient) pam_(unix|pwhistory).soremember=#{reuse_generations}\") }\n    end\n  end\n\n  describe 'input value' do\n    it 'for reuse_generations should be in line with maximum/minimum allowed values by policy' do\n      expect(input('expected_reuse_generations')).to cmp >= input('min_reuse_generations')\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204422.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] lines is expected to include password (required|requisite|sufficient) pam_(unix|pwhistory).so remember=5","run_time":0.000167,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] lines is expected to include password (required|requisite|sufficient) pam_(unix|pwhistory).soremember=5","run_time":0.000159,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"},{"status":"passed","code_desc":"input value for reuse_generations should be in line with maximum/minimum allowed values by policy","run_time":0.00022,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204423","title":"The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15\n    characters in length.","desc":"The shorter the password, the lower the number of possible combinations that need to be tested before the\n    password is compromised.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it\n    takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or\n    resources required to compromise the password.","descriptions":[{"label":"default","data":"The shorter the password, the lower the number of possible combinations that need to be tested before the\n    password is compromised.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it\n    takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or\n    resources required to compromise the password."},{"label":"check","data":"Verify the operating system enforces a minimum 15-character password length. The \"minlen\" option\n    sets the minimum number of characters in a new password.\n    Check for the value of the \"minlen\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep minlen /etc/security/pwquality.conf\n    minlen = 15\n    If the command does not return a \"minlen\" value of 15 or greater, this is a finding."},{"label":"fix","data":"Configure operating system to enforce a minimum 15-character password length.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    minlen = 15"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71935","SV-86559"],"severity":"medium","gtitle":"SRG-OS-000078-GPOS-00046","gid":"V-204423","rid":"SV-204423r603261_rule","stig_id":"RHEL-07-010280","fix_id":"F-4547r88462_fix","cci":["CCI-000205"],"nist":["IA-5 (1) (a)"],"subsystems":["pwquality","password"],"host":null,"container":null},"code":"control 'SV-204423' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that passwords are a minimum of 15\n    characters in length.'\n  desc 'The shorter the password, the lower the number of possible combinations that need to be tested before the\n    password is compromised.\n    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing\n    and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it\n    takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or\n    resources required to compromise the password.'\n  desc 'check', 'Verify the operating system enforces a minimum 15-character password length. The \"minlen\" option\n    sets the minimum number of characters in a new password.\n    Check for the value of the \"minlen\" option in \"/etc/security/pwquality.conf\" with the following command:\n    # grep minlen /etc/security/pwquality.conf\n    minlen = 15\n    If the command does not return a \"minlen\" value of 15 or greater, this is a finding.'\n  desc 'fix', 'Configure operating system to enforce a minimum 15-character password length.\n    Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\n    minlen = 15'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71935', 'SV-86559']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000078-GPOS-00046'\n  tag gid: 'V-204423'\n  tag rid: 'SV-204423r603261_rule'\n  tag stig_id: 'RHEL-07-010280'\n  tag fix_id: 'F-4547r88462_fix'\n  tag cci: ['CCI-000205']\n  tag nist: ['IA-5 (1) (a)']\n  tag subsystems: ['pwquality', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/security/pwquality.conf') do\n    its('minlen') { should cmp input('expected_minlen') }\n    its('minlen') { should cmp input('min_minlen') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204423.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/security/pwquality.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/security/pwquality.conf","skip_message":"Can't find file: /etc/security/pwquality.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/security/pwquality.conf\"]"}]},{"id":"SV-204424","title":"The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null\n    passwords.","desc":"If an account has an empty password, anyone could log on and run commands with the privileges of that\n    account. Accounts with empty passwords should never be used in operational environments.","descriptions":[{"label":"default","data":"If an account has an empty password, anyone could log on and run commands with the privileges of that\n    account. Accounts with empty passwords should never be used in operational environments."},{"label":"check","data":"To verify that null passwords cannot be used, run the following command:\n    # grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth\n    If this produces any output, it may be possible to log on with accounts with empty passwords.\n    If null passwords can be used, this is a finding."},{"label":"fix","data":"If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.\n\nRemove any instances of the \"nullok\" option in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" to prevent logons with empty passwords.\n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71937","SV-86561"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204424","rid":"SV-204424r880839_rule","stig_id":"RHEL-07-010290","fix_id":"F-4548r880838_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["pam","password"],"host":null,"container":null},"code":"control 'SV-204424' do\n  title 'The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null\n    passwords.'\n  desc 'If an account has an empty password, anyone could log on and run commands with the privileges of that\n    account. Accounts with empty passwords should never be used in operational environments.'\n  desc 'check', 'To verify that null passwords cannot be used, run the following command:\n    # grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth\n    If this produces any output, it may be possible to log on with accounts with empty passwords.\n    If null passwords can be used, this is a finding.'\n  desc 'fix', 'If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating.\n\nRemove any instances of the \"nullok\" option in \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" to prevent logons with empty passwords.\n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71937', 'SV-86561']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204424'\n  tag rid: 'SV-204424r880839_rule'\n  tag stig_id: 'RHEL-07-010290'\n  tag fix_id: 'F-4548r880838_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['pam', 'password']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    describe pam('/etc/pam.d/system-auth') do\n      its('lines') { should_not match_pam_rule('.* .* pam_unix.so nullok') }\n    end\n    describe pam('/etc/pam.d/password-auth') do\n      its('lines') { should_not match_pam_rule('.* .* pam_unix.so nullok') }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204424.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] lines is expected not to include .* .* pam_unix.so nullok","run_time":0.000365,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] lines is expected not to include .* .* pam_unix.so nullok","run_time":0.000175,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"}]},{"id":"SV-204425","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using an empty password.","desc":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.","descriptions":[{"label":"default","data":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere."},{"label":"check","data":"To determine how the SSH daemon's \"PermitEmptyPasswords\" option is set, run the following command:\n    # grep -i PermitEmptyPasswords /etc/ssh/sshd_config\n    PermitEmptyPasswords no\n    If no line, a commented line, or a line indicating the value \"no\" is returned, the required value is set.\n    If the required value is not set, this is a finding."},{"label":"fix","data":"To explicitly disallow remote logon from accounts with empty passwords, add or correct the following\n    line in \"/etc/ssh/sshd_config\":\n    PermitEmptyPasswords no\n    The SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled\n    immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86563","V-71939"],"severity":"high","gtitle":"SRG-OS-000106-GPOS-00053","gid":"V-204425","rid":"SV-204425r603261_rule","stig_id":"RHEL-07-010300","fix_id":"F-4549r88468_fix","cci":["CCI-000766"],"nist":["IA-2 (2)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204425' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using an empty password.'\n  desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.'\n  desc 'check', %q(To determine how the SSH daemon's \"PermitEmptyPasswords\" option is set, run the following command:\n    # grep -i PermitEmptyPasswords /etc/ssh/sshd_config\n    PermitEmptyPasswords no\n    If no line, a commented line, or a line indicating the value \"no\" is returned, the required value is set.\n    If the required value is not set, this is a finding.)\n  desc 'fix', 'To explicitly disallow remote logon from accounts with empty passwords, add or correct the following\n    line in \"/etc/ssh/sshd_config\":\n    PermitEmptyPasswords no\n    The SSH service must be restarted for changes to take effect.  Any accounts with empty passwords should be disabled\n    immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86563', 'V-71939']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000106-GPOS-00053'\n  tag gid: 'V-204425'\n  tag rid: 'SV-204425r603261_rule'\n  tag stig_id: 'RHEL-07-010300'\n  tag fix_id: 'F-4549r88468_fix'\n  tag cci: ['CCI-000766']\n  tag nist: ['IA-2 (2)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('PermitEmptyPasswords') { should eq 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204425.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204426","title":"The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles,\n    and devices) if the password expires.","desc":"Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive\n    identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if\n    unauthorized access to their user account has been obtained.\n    Operating systems need to track periods of inactivity and disable application identifiers after 35 days of\n    inactivity.","descriptions":[{"label":"default","data":"Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive\n    identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if\n    unauthorized access to their user account has been obtained.\n    Operating systems need to track periods of inactivity and disable application identifiers after 35 days of\n    inactivity."},{"label":"check","data":"If passwords are not being used for authentication, this is Not Applicable.\n    Verify the operating system disables account identifiers (individuals, groups, roles, and devices) after the\n    password expires with the following command:\n    # grep -i inactive /etc/default/useradd\n    INACTIVE=35\n    If \"INACTIVE\" is set to \"-1\", a value greater than \"35\", is commented out, or is not defined, this is a finding."},{"label":"fix","data":"Configure the operating system to disable account identifiers (individuals, groups, roles, and\n    devices) 35 days after the password expires.\n    Add the following line to \"/etc/default/useradd\" (or modify the line to have the required value):\n    INACTIVE=35\n    DoD recommendation is 35 days, but a lower value is acceptable. The value \"-1\" will disable this feature, and \"0\"\n    will disable the account immediately after the password expires."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86565","V-71941"],"severity":"medium","gtitle":"SRG-OS-000118-GPOS-00060","gid":"V-204426","rid":"SV-204426r809190_rule","stig_id":"RHEL-07-010310","fix_id":"F-4550r809189_fix","cci":["CCI-000795"],"nist":["IA-4 e"],"subsystems":["user"],"host":null,"container":null},"code":"control 'SV-204426' do\n  title 'The Red Hat Enterprise Linux operating system must disable account identifiers (individuals, groups, roles,\n    and devices) if the password expires.'\n  desc 'Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive\n    identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if\n    unauthorized access to their user account has been obtained.\n    Operating systems need to track periods of inactivity and disable application identifiers after 35 days of\n    inactivity.'\n  desc 'check', 'If passwords are not being used for authentication, this is Not Applicable.\n    Verify the operating system disables account identifiers (individuals, groups, roles, and devices) after the\n    password expires with the following command:\n    # grep -i inactive /etc/default/useradd\n    INACTIVE=35\n    If \"INACTIVE\" is set to \"-1\", a value greater than \"35\", is commented out, or is not defined, this is a finding.'\n  desc 'fix', 'Configure the operating system to disable account identifiers (individuals, groups, roles, and\n    devices) 35 days after the password expires.\n    Add the following line to \"/etc/default/useradd\" (or modify the line to have the required value):\n    INACTIVE=35\n    DoD recommendation is 35 days, but a lower value is acceptable. The value \"-1\" will disable this feature, and \"0\"\n    will disable the account immediately after the password expires.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86565', 'V-71941']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000118-GPOS-00060'\n  tag gid: 'V-204426'\n  tag rid: 'SV-204426r809190_rule'\n  tag stig_id: 'RHEL-07-010310'\n  tag fix_id: 'F-4550r809189_fix'\n  tag cci: ['CCI-000795']\n  tag nist: ['IA-4 e']\n  tag subsystems: ['user']\n  tag 'host'\n  tag 'container'\n\n  if command(\"grep 'pam_unix.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'optional'\").stdout.empty? && command(\"grep 'pam_permit.so' /etc/pam.d/system-auth | grep 'auth ' | grep 'required'\").stdout.empty?\n    describe parse_config_file('/etc/default/useradd') do\n      its('INACTIVE') { should cmp input('expected_days_of_inactivity') }\n      its('INACTIVE') { should cmp <= input('max_days_of_inactivity') }\n    end\n  else\n    impact 0.0\n    describe 'The system is not using password for authentication' do\n      skip 'The system is not using password for authentication, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204426.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/default/useradd","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/default/useradd","skip_message":"Can't find file: /etc/default/useradd","resource_class":"parse_config_file","resource_params":"[\"/etc/default/useradd\"]"}]},{"id":"SV-204427","title":"The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15\n    minutes after three unsuccessful logon attempts within a 15-minute timeframe.","desc":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password\n    guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.","descriptions":[{"label":"default","data":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password\n    guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account."},{"label":"check","data":"Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon\n    attempts within a period of 15 minutes with the following command:\n    # grep pam_faillock.so /etc/pam.d/password-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"deny\" parameter is set to \"0\" or a value greater than \"3\" on both \"auth\" lines with the \"pam_faillock.so\"\n    module, or is missing from these lines, this is a finding.\n    If the \"even_deny_root\" parameter is not set on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing\n    from these lines, this is a finding.\n    If the \"fail_interval\" parameter is set to \"0\" or is set to a value less than \"900\" on both \"auth\" lines with the\n    \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n    If the \"unlock_time\" parameter is not set to \"0\", \"never\", or is set to a value less than \"900\" on both \"auth\" lines\n    with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n    Note: The maximum configurable value for \"unlock_time\" is \"604800\".\n    If any line referencing the \"pam_faillock.so\" module is commented out, this is a finding.\n    # grep pam_faillock.so /etc/pam.d/system-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"deny\" parameter is set to \"0\" or a value greater than \"3\" on both \"auth\" lines with the \"pam_faillock.so\"\n    module, or is missing from these lines, this is a finding.\n    If the \"even_deny_root\" parameter is not set on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing\n    from these lines, this is a finding.\n    If the \"fail_interval\" parameter is set to \"0\" or is set to a value less than \"900\" on both \"auth\" lines with the\n    \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n    If the \"unlock_time\" parameter is not set to \"0\", \"never\", or is set to a value less than \"900\" on both \"auth\" lines\n    with the \"pam_faillock.so\" module or is missing from these lines, this is a finding.\n    Note: The maximum configurable value for \"unlock_time\" is \"604800\".\n    If any line referencing the \"pam_faillock.so\" module is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.\n\nAdd/Modify the appropriate sections of the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" files to match the following lines:\n\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount     required      pam_faillock.so   \n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71943","SV-86567"],"severity":"medium","gtitle":"SRG-OS-000329-GPOS-00128","satisfies":["SRG-OS-000329-GPOS-00128","SRG-OS-000021-GPOS-00005"],"gid":"V-204427","rid":"SV-204427r880842_rule","stig_id":"RHEL-07-010320","fix_id":"F-4551r880841_fix","cci":["CCI-000044","CCI-002236","CCI-002237","CCI-002238"],"nist":["AC-7 a","AC-7 b","AC-7 b","AC-7 b"],"subsystems":["pam","faillock"],"host":null,"container":null},"code":"control 'SV-204427' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to lock accounts for a minimum of 15\n    minutes after three unsuccessful logon attempts within a 15-minute timeframe.'\n  desc 'By limiting the number of failed logon attempts, the risk of unauthorized system access via user password\n    guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the account.'\n  desc 'check', 'Check that the system locks an account for a minimum of 15 minutes after three unsuccessful logon\n    attempts within a period of 15 minutes with the following command:\n    # grep pam_faillock.so /etc/pam.d/password-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"deny\" parameter is set to \"0\" or a value greater than \"3\" on both \"auth\" lines with the \"pam_faillock.so\"\n    module, or is missing from these lines, this is a finding.\n    If the \"even_deny_root\" parameter is not set on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing\n    from these lines, this is a finding.\n    If the \"fail_interval\" parameter is set to \"0\" or is set to a value less than \"900\" on both \"auth\" lines with the\n    \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n    If the \"unlock_time\" parameter is not set to \"0\", \"never\", or is set to a value less than \"900\" on both \"auth\" lines\n    with the \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n    Note: The maximum configurable value for \"unlock_time\" is \"604800\".\n    If any line referencing the \"pam_faillock.so\" module is commented out, this is a finding.\n    # grep pam_faillock.so /etc/pam.d/system-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"deny\" parameter is set to \"0\" or a value greater than \"3\" on both \"auth\" lines with the \"pam_faillock.so\"\n    module, or is missing from these lines, this is a finding.\n    If the \"even_deny_root\" parameter is not set on both \"auth\" lines with the \"pam_faillock.so\" module, or is missing\n    from these lines, this is a finding.\n    If the \"fail_interval\" parameter is set to \"0\" or is set to a value less than \"900\" on both \"auth\" lines with the\n    \"pam_faillock.so\" module, or is missing from these lines, this is a finding.\n    If the \"unlock_time\" parameter is not set to \"0\", \"never\", or is set to a value less than \"900\" on both \"auth\" lines\n    with the \"pam_faillock.so\" module or is missing from these lines, this is a finding.\n    Note: The maximum configurable value for \"unlock_time\" is \"604800\".\n    If any line referencing the \"pam_faillock.so\" module is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made.\n\nAdd/Modify the appropriate sections of the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" files to match the following lines:\n\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount     required      pam_faillock.so   \n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71943', 'SV-86567']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000329-GPOS-00128'\n  tag satisfies: ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']\n  tag gid: 'V-204427'\n  tag rid: 'SV-204427r880842_rule'\n  tag stig_id: 'RHEL-07-010320'\n  tag fix_id: 'F-4551r880841_fix'\n  tag cci: ['CCI-000044', 'CCI-002236', 'CCI-002237', 'CCI-002238']\n  tag nist: ['AC-7 a', 'AC-7 b', 'AC-7 b', 'AC-7 b']\n  tag subsystems: ['pam', 'faillock']\n  tag 'host'\n  tag 'container'\n\n  # pam rules files to check\n  pa_rules = pam('/etc/pam.d/password-auth').lines\n  sa_rules = pam('/etc/pam.d/system-auth').lines\n\n  # rule patterns to match for\n  faillock_rule_pattern = 'auth [default=die]|required pam_faillock.so'\n  deny_pattern = faillock_rule_pattern + \" deny=#{input('expected_unsuccessful_attempts')}\"\n  fail_interval_pattern = faillock_rule_pattern + \" fail_interval=#{input('expected_fail_interval')}\"\n  unlock_time_pattern = faillock_rule_pattern + \" unlock_time=(0|never|#{input('expected_lockout_time')})\"\n\n  # explicit rulesets to look for\n  req = input('required_rules')\n  alt = input('alternate_rules')\n\n  describe.one do\n    describe 'pam rules for the faillock module' do\n      it 'should exactly match an appropriately configured ruleset in password-auth' do\n        expect(pa_rules).to match_pam_rules(req).exactly, \"missing required rules: #{req.select { |rule| !pa_rules.include?(rule) }}\"\n      end\n    end\n    describe 'pam rules for the faillock module' do\n      it 'should exactly match an appropriately configured ruleset in password-auth' do\n        expect(pa_rules).to match_pam_rules(alt).exactly, \"missing alternate rules: #{alt.select { |rule| !pa_rules.include?(rule) }}\"\n      end\n    end\n  end\n\n  describe 'pam rules for the faillock module' do\n    it 'should have the expected settings enabled in password-auth' do\n      expect(pa_rules).to match_pam_rule(deny_pattern), \"missing: #{deny_pattern}\"\n      expect(pa_rules).to match_pam_rule(fail_interval_pattern), \"missing: #{fail_interval_pattern}\"\n      expect(pa_rules).to match_pam_rule(unlock_time_pattern), 'missing or misconfigured unlock_time'\n    end\n  end\n\n  describe.one do\n    describe 'pam rules for the faillock module' do\n      it 'should exactly match an appropriately configured ruleset in system-auth' do\n        expect(sa_rules).to match_pam_rules(req).exactly, \"missing required rules: #{req.select { |rule| !sa_rules.include?(rule) }}\"\n      end\n    end\n    describe 'pam rules for the faillock module' do\n      it 'should exactly match an appropriately configured ruleset in system-auth' do\n        expect(sa_rules).to match_pam_rules(alt).exactly, \"missing alternate rules: #{alt.select { |rule| !sa_rules.include?(rule) }}\"\n      end\n    end\n  end\n\n  describe 'pam rules for the faillock module' do\n    it 'should have the expected settings enabled in system-auth' do\n      expect(sa_rules).to match_pam_rule(deny_pattern), \"missing: #{deny_pattern}\"\n      expect(sa_rules).to match_pam_rule(fail_interval_pattern), \"missing: #{fail_interval_pattern}\"\n      expect(sa_rules).to match_pam_rule(unlock_time_pattern), 'missing or misconfigured unlock_time'\n    end\n  end\n\n  describe 'input value' do\n    it 'for unsuccessful_attempts should be in line with maximum/minimum allowed values by policy' do\n      expect(input('expected_unsuccessful_attempts')).to cmp <= input('max_unsuccessful_attempts')\n    end\n    it 'for fail_interval should be in line with maximum/minimum allowed values by policy' do\n      expect(input('expected_fail_interval')).to cmp <= input('max_fail_interval')\n    end\n    it 'for lockout_time should be in line with maximum/minimum allowed values by policy' do\n      expect(input('expected_lockout_time')).to cmp >= input('min_lockout_time')\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204427.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"pam rules for the faillock module should exactly match an appropriately configured ruleset in password-auth","run_time":0.000125,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"pam rules for the faillock module should exactly match an appropriately configured ruleset in password-auth","run_time":0.000112,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"pam rules for the faillock module should have the expected settings enabled in password-auth","run_time":0.000133,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"NoMethodError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/resources/file.rb:53:in `block (2 levels) in <class:FileResource>'","libraries/pam.rb:289:in `get_service_name'","libraries/pam.rb:230:in `include?'","libraries/matchers.rb:69:in `block (2 levels) in load_with_context'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/matchers/dsl.rb:135:in `block (2 levels) in match'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-support-3.11.0/lib/rspec/support.rb:118:in `with_failure_notifier'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/matchers/dsl.rb:133:in `block in match'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/handler.rb:51:in `block in handle_matcher'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/handler.rb:27:in `with_matcher'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/handler.rb:48:in `handle_matcher'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/expectation_target.rb:65:in `to'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/expectation_target.rb:101:in `to'","./controls/SV-204427.rb:91:in `block (3 levels) in load_with_context'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"pam rules for the faillock module should exactly match an appropriately configured ruleset in system-auth","run_time":0.000112,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"pam rules for the faillock module should exactly match an appropriately configured ruleset in system-auth","run_time":0.000118,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"pam rules for the faillock module should have the expected settings enabled in system-auth","run_time":0.000138,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"NoMethodError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/resources/file.rb:53:in `block (2 levels) in <class:FileResource>'","libraries/pam.rb:289:in `get_service_name'","libraries/pam.rb:230:in `include?'","libraries/matchers.rb:69:in `block (2 levels) in load_with_context'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/matchers/dsl.rb:135:in `block (2 levels) in match'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-support-3.11.0/lib/rspec/support.rb:118:in `with_failure_notifier'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/matchers/dsl.rb:133:in `block in match'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/handler.rb:51:in `block in handle_matcher'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/handler.rb:27:in `with_matcher'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/handler.rb:48:in `handle_matcher'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/expectation_target.rb:65:in `to'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-expectations-3.11.0/lib/rspec/expectations/expectation_target.rb:101:in `to'","./controls/SV-204427.rb:112:in `block (3 levels) in load_with_context'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"input value for unsuccessful_attempts should be in line with maximum/minimum allowed values by policy","run_time":0.00018,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"input value for fail_interval should be in line with maximum/minimum allowed values by policy","run_time":0.000171,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"input value for lockout_time should be in line with maximum/minimum allowed values by policy","run_time":0.000168,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204428","title":"The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful\n    root logon attempts are made within a 15-minute period.","desc":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password\n    guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.","descriptions":[{"label":"default","data":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password\n    guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account."},{"label":"check","data":"Verify the operating system automatically locks the root account, for a minimum of 15 minutes, when\n    three unsuccessful logon attempts in 15 minutes are made.\n    # grep pam_faillock.so /etc/pam.d/password-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"even_deny_root\" setting is not defined on both lines with the \"pam_faillock.so\" module, is commented out, or\n    is missing from a line, this is a finding.\n    # grep pam_faillock.so /etc/pam.d/system-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"even_deny_root\" setting is not defined on both lines with the \"pam_faillock.so\" module, is commented out, or\n    is missing from a line, this is a finding."},{"label":"fix","data":"Configure the operating system to automatically lock the root account, for a minimum of 15 minutes, when three unsuccessful logon attempts in 15 minutes are made.\n\nModify the first three lines of the auth section and the first line of the account section of the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" files to match the following lines:\n\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount     required      pam_faillock.so\n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71945","SV-86569"],"severity":"medium","gtitle":"SRG-OS-000329-GPOS-00128","satisfies":["SRG-OS-000329-GPOS-00128","SRG-OS-000021-GPOS-00005"],"gid":"V-204428","rid":"SV-204428r880845_rule","stig_id":"RHEL-07-010330","fix_id":"F-4552r880844_fix","cci":["CCI-002238"],"nist":["AC-7 b"],"subsystems":["pam"],"host":null,"container":null},"code":"control 'SV-204428' do\n  title 'The Red Hat Enterprise Linux operating system must lock the associated account after three unsuccessful\n    root logon attempts are made within a 15-minute period.'\n  desc 'By limiting the number of failed logon attempts, the risk of unauthorized system access via user password\n    guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.'\n  desc 'check', 'Verify the operating system automatically locks the root account, for a minimum of 15 minutes, when\n    three unsuccessful logon attempts in 15 minutes are made.\n    # grep pam_faillock.so /etc/pam.d/password-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"even_deny_root\" setting is not defined on both lines with the \"pam_faillock.so\" module, is commented out, or\n    is missing from a line, this is a finding.\n    # grep pam_faillock.so /etc/pam.d/system-auth\n    auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n    account required pam_faillock.so\n    If the \"even_deny_root\" setting is not defined on both lines with the \"pam_faillock.so\" module, is commented out, or\n    is missing from a line, this is a finding.'\n  desc 'fix', 'Configure the operating system to automatically lock the root account, for a minimum of 15 minutes, when three unsuccessful logon attempts in 15 minutes are made.\n\nModify the first three lines of the auth section and the first line of the account section of the \"/etc/pam.d/system-auth\" and \"/etc/pam.d/password-auth\" files to match the following lines:\n\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\naccount     required      pam_faillock.so\n\nNote: Per requirement RHEL-07-010199, RHEL 7 must be configured to not overwrite custom authentication configuration settings while using the authconfig utility, otherwise manual changes to the listed files will be overwritten whenever the authconfig utility is used.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71945', 'SV-86569']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000329-GPOS-00128'\n  tag satisfies: ['SRG-OS-000329-GPOS-00128', 'SRG-OS-000021-GPOS-00005']\n  tag gid: 'V-204428'\n  tag rid: 'SV-204428r880845_rule'\n  tag stig_id: 'RHEL-07-010330'\n  tag fix_id: 'F-4552r880844_fix'\n  tag cci: ['CCI-002238']\n  tag nist: ['AC-7 b']\n  tag subsystems: ['pam']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    describe pam('/etc/pam.d/password-auth') do\n      its('lines') do\n        should match_pam_rule('auth .* pam_faillock.so preauth even_deny_root')\n      end\n      its('lines') do\n        should match_pam_rule('auth .* pam_faillock.so authfail even_deny_root')\n      end\n    end\n    describe pam('/etc/pam.d/system-auth') do\n      its('lines') do\n        should match_pam_rule('auth .* pam_faillock.so preauth even_deny_root')\n      end\n      its('lines') do\n        should match_pam_rule('auth .* pam_faillock.so authfail even_deny_root')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204428.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] lines is expected to include auth .* pam_faillock.so preauth even_deny_root","run_time":0.000162,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/password-auth] lines is expected to include auth .* pam_faillock.so authfail even_deny_root","run_time":0.000155,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621b74388 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/password-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/password-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] lines is expected to include auth .* pam_faillock.so preauth even_deny_root","run_time":0.000347,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/system-auth] lines is expected to include auth .* pam_faillock.so authfail even_deny_root","run_time":0.000149,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8620f887b8 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/system-auth\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/system-auth\"]"}]},{"id":"SV-204429","title":"The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for\n    privilege escalation.","desc":"Without re-authentication, users may access resources or perform tasks for which they do not have\n    authorization.\n    When operating systems provide the capability to escalate a functional capability, it is critical the user\n    re-authenticate.","descriptions":[{"label":"default","data":"Without re-authentication, users may access resources or perform tasks for which they do not have\n    authorization.\n    When operating systems provide the capability to escalate a functional capability, it is critical the user\n    re-authenticate."},{"label":"check","data":"Verify the operating system requires users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" and \"/etc/sudoers.d/*\" files with the following command:\n\n$ sudo grep -ir nopasswd /etc/sudoers /etc/sudoers.d\n\nIf any occurrences of \"NOPASSWD\" are returned from the command and have not been documented with the Information System Security Officer (ISSO) as an organizationally defined administrative group utilizing MFA, this is a finding."},{"label":"fix","data":"Configure the operating system to require users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" file with the following command:\n$ sudo visudo\n\nRemove any occurrences of \"NOPASSWD\" tags in the file.\n\nCheck the configuration of the /etc/sudoers.d/* files with the following command:\n$ sudo grep -ir nopasswd /etc/sudoers.d\n\nRemove any occurrences of \"NOPASSWD\" tags in the file."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71947","SV-86571"],"severity":"medium","gtitle":"SRG-OS-000373-GPOS-00156","satisfies":["SRG-OS-000373-GPOS-00156","SRG-OS-000373-GPOS-00157","SRG-OS-000373-GPOS-00158"],"gid":"V-204429","rid":"SV-204429r861003_rule","stig_id":"RHEL-07-010340","fix_id":"F-36303r861002_fix","cci":["CCI-002038"],"nist":["IA-11"],"subsystems":["sudo"],"host":null},"code":"control 'SV-204429' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that users must provide a password for\n    privilege escalation.'\n  desc 'Without re-authentication, users may access resources or perform tasks for which they do not have\n    authorization.\n    When operating systems provide the capability to escalate a functional capability, it is critical the user\n    re-authenticate.'\n  desc 'check', 'Verify the operating system requires users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" and \"/etc/sudoers.d/*\" files with the following command:\n\n$ sudo grep -ir nopasswd /etc/sudoers /etc/sudoers.d\n\nIf any occurrences of \"NOPASSWD\" are returned from the command and have not been documented with the Information System Security Officer (ISSO) as an organizationally defined administrative group utilizing MFA, this is a finding.'\n  desc 'fix', 'Configure the operating system to require users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/sudoers\" file with the following command:\n$ sudo visudo\n\nRemove any occurrences of \"NOPASSWD\" tags in the file.\n\nCheck the configuration of the /etc/sudoers.d/* files with the following command:\n$ sudo grep -ir nopasswd /etc/sudoers.d\n\nRemove any occurrences of \"NOPASSWD\" tags in the file.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71947', 'SV-86571']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000373-GPOS-00156'\n  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157', 'SRG-OS-000373-GPOS-00158']\n  tag gid: 'V-204429'\n  tag rid: 'SV-204429r861003_rule'\n  tag stig_id: 'RHEL-07-010340'\n  tag fix_id: 'F-36303r861002_fix'\n  tag cci: ['CCI-002038']\n  tag nist: ['IA-11']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    processed = []\n    to_process = ['/etc/sudoers', '/etc/sudoers.d']\n\n    until to_process.empty?\n      in_process = to_process.pop\n      next if processed.include? in_process\n\n      processed.push in_process\n\n      if file(in_process).directory?\n        to_process.concat(\n          command(\"find #{in_process} -maxdepth 1 -mindepth 1\")\n            .stdout.strip.split(\"\\n\")\n            .select { |f| file(f).file? }\n        )\n      elsif file(in_process).file?\n        to_process.concat(\n          command(\"grep -E '#include\\\\s+' #{in_process} | sed 's/.*#include[[:space:]]*//g'\")\n            .stdout.strip.split(\"\\n\")\n            .map do |f|\n            if f.start_with?('/')\n              f\n            else\n              File.join(\n                File.dirname(in_process), f\n              )\n            end\n          end\n            .select do |f|\n            file(f).exist?\n          end\n        )\n        to_process.concat(\n          command(\"grep -E '#includedir\\\\s+' #{in_process} | sed 's/.*#includedir[[:space:]]*//g'\")\n            .stdout.strip.split(\"\\n\")\n            .map do |f|\n            if f.start_with?('/')\n              f\n            else\n              File.join(\n                File.dirname(in_process), f\n              )\n            end\n          end\n            .select do |f|\n            file(f).exist?\n          end\n        )\n      end\n    end\n\n    sudoers = processed.select { |f| file(f).file? }\n\n    sudoers.each do |sudoer|\n      sudo_content = file(sudoer).content.strip.split(\"\\n\")\n      nopasswd_lines = sudo_content.select { |l| l.match?(/^[^#].*NOPASSWD/) }\n      describe \"#{sudoer} rules containing NOPASSWD\" do\n        subject { nopasswd_lines }\n        it { should be_empty }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204429.rb"},"waiver_data":{},"results":[]},{"id":"SV-204430","title":"The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for\n    privilege escalation.","desc":"Without re-authentication, users may access resources or perform tasks for which they do not have\n    authorization.\n    When operating systems provide the capability to escalate a functional capability, it is critical the user\n    reauthenticate.","descriptions":[{"label":"default","data":"Without re-authentication, users may access resources or perform tasks for which they do not have\n    authorization.\n    When operating systems provide the capability to escalate a functional capability, it is critical the user\n    reauthenticate."},{"label":"check","data":"Verify the operating system requires users to reauthenticate for privilege escalation.\n    Check the configuration of the \"/etc/sudoers\" and \"/etc/sudoers.d/*\" files with the following command:\n    # grep -i authenticate /etc/sudoers /etc/sudoers.d/*\n    If any uncommented line is found with a \"!authenticate\" tag, this is a finding."},{"label":"fix","data":"Configure the operating system to require users to reauthenticate for privilege escalation.\n    Check the configuration of the \"/etc/sudoers\" file with the following command:\n    # visudo\n    Remove any occurrences of \"!authenticate\" tags in the file.\n    Check the configuration of the \"/etc/sudoers.d/*\" files with the following command:\n    # grep -i authenticate /etc/sudoers /etc/sudoers.d/*\n    Remove any occurrences of \"!authenticate\" tags in the file(s)."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71949","SV-86573"],"severity":"medium","gtitle":"SRG-OS-000373-GPOS-00156","satisfies":["SRG-OS-000373-GPOS-00156","SRG-OS-000373-GPOS-00157","SRG-OS-000373-GPOS-00158"],"gid":"V-204430","rid":"SV-204430r853885_rule","stig_id":"RHEL-07-010350","fix_id":"F-4554r88483_fix","cci":["CCI-002038"],"nist":["IA-11"],"subsystems":["sudo"],"host":null},"code":"control 'SV-204430' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for\n    privilege escalation.'\n  desc 'Without re-authentication, users may access resources or perform tasks for which they do not have\n    authorization.\n    When operating systems provide the capability to escalate a functional capability, it is critical the user\n    reauthenticate.'\n  desc 'check', 'Verify the operating system requires users to reauthenticate for privilege escalation.\n    Check the configuration of the \"/etc/sudoers\" and \"/etc/sudoers.d/*\" files with the following command:\n    # grep -i authenticate /etc/sudoers /etc/sudoers.d/*\n    If any uncommented line is found with a \"!authenticate\" tag, this is a finding.'\n  desc 'fix', 'Configure the operating system to require users to reauthenticate for privilege escalation.\n    Check the configuration of the \"/etc/sudoers\" file with the following command:\n    # visudo\n    Remove any occurrences of \"!authenticate\" tags in the file.\n    Check the configuration of the \"/etc/sudoers.d/*\" files with the following command:\n    # grep -i authenticate /etc/sudoers /etc/sudoers.d/*\n    Remove any occurrences of \"!authenticate\" tags in the file(s).'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71949', 'SV-86573']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000373-GPOS-00156'\n  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157', 'SRG-OS-000373-GPOS-00158']\n  tag gid: 'V-204430'\n  tag rid: 'SV-204430r853885_rule'\n  tag stig_id: 'RHEL-07-010350'\n  tag fix_id: 'F-4554r88483_fix'\n  tag cci: ['CCI-002038']\n  tag nist: ['IA-11']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    describe command('grep -ir authenticate /etc/sudoers /etc/sudoers.d/*') do\n      its('stdout') { should_not match(/!authenticate/) }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204430.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `grep -ir authenticate /etc/sudoers /etc/sudoers.d/*` ","run_time":7.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"grep -ir authenticate /etc/sudoers /etc/sudoers.d/*\"]"}]},{"id":"SV-204431","title":"The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts\n    following a failed console logon attempt is at least four seconds.","desc":"Configuring the operating system to implement organization-wide security implementation guides and security\n    checklists verifies compliance with federal standards and establishes a common security baseline across DoD that\n    reflects the most restrictive security posture consistent with operational requirements.\n    Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components\n    of the system that affect the security posture and/or functionality of the system. Security-related parameters are\n    those parameters impacting the security state of the system, including the parameters required to satisfy other\n    security control requirements. Security-related parameters include, for example, registry settings; account, file,\n    and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","descriptions":[{"label":"default","data":"Configuring the operating system to implement organization-wide security implementation guides and security\n    checklists verifies compliance with federal standards and establishes a common security baseline across DoD that\n    reflects the most restrictive security posture consistent with operational requirements.\n    Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components\n    of the system that affect the security posture and/or functionality of the system. Security-related parameters are\n    those parameters impacting the security state of the system, including the parameters required to satisfy other\n    security control requirements. Security-related parameters include, for example, registry settings; account, file,\n    and directory permission settings; and settings for functions, ports, protocols, services, and remote connections."},{"label":"check","data":"Verify the operating system enforces a delay of at least four seconds between console logon prompts\n    following a failed logon attempt.\n    Check the value of the \"fail_delay\" parameter in the \"/etc/login.defs\" file with the following command:\n    # grep -i fail_delay /etc/login.defs\n    FAIL_DELAY 4\n    If the value of \"FAIL_DELAY\" is not set to \"4\" or greater, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to enforce a delay of at least four seconds between logon prompts\n    following a failed console logon attempt.\n    Modify the \"/etc/login.defs\" file to set the \"FAIL_DELAY\" parameter to \"4\" or greater:\n    FAIL_DELAY 4"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86575","V-71951"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00226","gid":"V-204431","rid":"SV-204431r603261_rule","stig_id":"RHEL-07-010430","fix_id":"F-4555r88486_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["login_defs"],"host":null,"container":null},"code":"control 'SV-204431' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the delay between logon prompts\n    following a failed console logon attempt is at least four seconds.'\n  desc 'Configuring the operating system to implement organization-wide security implementation guides and security\n    checklists verifies compliance with federal standards and establishes a common security baseline across DoD that\n    reflects the most restrictive security posture consistent with operational requirements.\n    Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components\n    of the system that affect the security posture and/or functionality of the system. Security-related parameters are\n    those parameters impacting the security state of the system, including the parameters required to satisfy other\n    security control requirements. Security-related parameters include, for example, registry settings; account, file,\n    and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.'\n  desc 'check', 'Verify the operating system enforces a delay of at least four seconds between console logon prompts\n    following a failed logon attempt.\n    Check the value of the \"fail_delay\" parameter in the \"/etc/login.defs\" file with the following command:\n    # grep -i fail_delay /etc/login.defs\n    FAIL_DELAY 4\n    If the value of \"FAIL_DELAY\" is not set to \"4\" or greater, or the line is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to enforce a delay of at least four seconds between logon prompts\n    following a failed console logon attempt.\n    Modify the \"/etc/login.defs\" file to set the \"FAIL_DELAY\" parameter to \"4\" or greater:\n    FAIL_DELAY 4'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86575', 'V-71951']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00226'\n  tag gid: 'V-204431'\n  tag rid: 'SV-204431r603261_rule'\n  tag stig_id: 'RHEL-07-010430'\n  tag fix_id: 'F-4555r88486_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['login_defs']\n  tag 'host'\n  tag 'container'\n\n  describe login_defs do\n    its('FAIL_DELAY') { should cmp input('fail_delay') }\n    its('FAIL_DELAY') { should cmp >= input('min_fail_delay') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204431.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"login.defs","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"login.defs","skip_message":"Can't find file: /etc/login.defs","resource_class":"login_defs","resource_params":"[]"}]},{"id":"SV-204432","title":"The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system\n    via a graphical user interface.","desc":"Failure to restrict system access to authenticated users negatively impacts operating system security.","descriptions":[{"label":"default","data":"Failure to restrict system access to authenticated users negatively impacts operating system security."},{"label":"check","data":"Verify the operating system does not allow an unattended or automatic logon to the system via a\n    graphical user interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Check for the value of the \"AutomaticLoginEnable\" in the \"/etc/gdm/custom.conf\" file with the following command:\n    # grep -i automaticloginenable /etc/gdm/custom.conf\n    AutomaticLoginEnable=false\n    If the value of \"AutomaticLoginEnable\" is not set to \"false\", this is a finding."},{"label":"fix","data":"Configure the operating system to not allow an unattended or automatic logon to the system via a\n    graphical user interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Add or edit the line for the \"AutomaticLoginEnable\" parameter in the [daemon] section of the \"/etc/gdm/custom.conf\"\n    file to \"false\":\n    [daemon]\n    AutomaticLoginEnable=false"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71953","SV-86577"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-204432","rid":"SV-204432r877377_rule","stig_id":"RHEL-07-010440","fix_id":"F-4556r88489_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["gdm"],"host":null},"code":"control 'SV-204432' do\n  title 'The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system\n    via a graphical user interface.'\n  desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'\n  desc 'check', 'Verify the operating system does not allow an unattended or automatic logon to the system via a\n    graphical user interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Check for the value of the \"AutomaticLoginEnable\" in the \"/etc/gdm/custom.conf\" file with the following command:\n    # grep -i automaticloginenable /etc/gdm/custom.conf\n    AutomaticLoginEnable=false\n    If the value of \"AutomaticLoginEnable\" is not set to \"false\", this is a finding.'\n  desc 'fix', 'Configure the operating system to not allow an unattended or automatic logon to the system via a\n    graphical user interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Add or edit the line for the \"AutomaticLoginEnable\" parameter in the [daemon] section of the \"/etc/gdm/custom.conf\"\n    file to \"false\":\n    [daemon]\n    AutomaticLoginEnable=false'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71953', 'SV-86577']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00229'\n  tag gid: 'V-204432'\n  tag rid: 'SV-204432r877377_rule'\n  tag stig_id: 'RHEL-07-010440'\n  tag fix_id: 'F-4556r88489_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['gdm']\n  tag 'host'\n\n  custom_conf = '/etc/gdm/custom.conf'\n\n  if package('gdm').installed?\n    if (f = file(custom_conf)).exist?\n      describe ini(custom_conf) do\n        its('daemon.AutomaticLoginEnable') { cmp false }\n      end\n    else\n      describe f do\n        it { should exist }\n      end\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GDM installed' do\n      skip 'The system does not have GDM installed, this requirement is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204432.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GDM installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GDM installed, this requirement is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204433","title":"The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.","desc":"Failure to restrict system access to authenticated users negatively impacts operating system security.","descriptions":[{"label":"default","data":"Failure to restrict system access to authenticated users negatively impacts operating system security."},{"label":"check","data":"Verify the operating system does not allow an unrestricted logon to the system via a graphical user\n    interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Check for the value of the \"TimedLoginEnable\" parameter in \"/etc/gdm/custom.conf\" file with the following command:\n    # grep -i timedloginenable /etc/gdm/custom.conf\n    TimedLoginEnable=false\n    If the value of \"TimedLoginEnable\" is not set to \"false\", this is a finding."},{"label":"fix","data":"Configure the operating system to not allow an unrestricted account to log on to the system via a\n    graphical user interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Add or edit the line for the \"TimedLoginEnable\" parameter in the [daemon] section of the \"/etc/gdm/custom.conf\" file\n    to \"false\":\n    [daemon]\n    TimedLoginEnable=false"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71955","SV-86579"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-204433","rid":"SV-204433r877377_rule","stig_id":"RHEL-07-010450","fix_id":"F-4557r88492_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["gdm"],"host":null},"code":"control 'SV-204433' do\n  title 'The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.'\n  desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'\n  desc 'check', 'Verify the operating system does not allow an unrestricted logon to the system via a graphical user\n    interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Check for the value of the \"TimedLoginEnable\" parameter in \"/etc/gdm/custom.conf\" file with the following command:\n    # grep -i timedloginenable /etc/gdm/custom.conf\n    TimedLoginEnable=false\n    If the value of \"TimedLoginEnable\" is not set to \"false\", this is a finding.'\n  desc 'fix', 'Configure the operating system to not allow an unrestricted account to log on to the system via a\n    graphical user interface.\n    Note: If the system does not have GNOME installed, this requirement is Not Applicable.\n    Add or edit the line for the \"TimedLoginEnable\" parameter in the [daemon] section of the \"/etc/gdm/custom.conf\" file\n    to \"false\":\n    [daemon]\n    TimedLoginEnable=false'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71955', 'SV-86579']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00229'\n  tag gid: 'V-204433'\n  tag rid: 'SV-204433r877377_rule'\n  tag stig_id: 'RHEL-07-010450'\n  tag fix_id: 'F-4557r88492_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['gdm']\n  tag 'host'\n\n  custom_conf = '/etc/gdm/custom.conf'\n\n  if package('gdm').installed?\n    impact 0.7\n    if (f = file(custom_conf)).exist?\n      describe ini(custom_conf) do\n        its('daemon.TimedLoginEnable') { cmp false }\n      end\n    else\n      describe f do\n        it { should exist }\n      end\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GDM installed' do\n      skip 'The system does not have GDM installed, this requirement is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204433.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GDM installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GDM installed, this requirement is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204434","title":"The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.","desc":"Failure to restrict system access to authenticated users negatively impacts operating system security.","descriptions":[{"label":"default","data":"Failure to restrict system access to authenticated users negatively impacts operating system security."},{"label":"check","data":"Verify the operating system does not allow users to override environment variables to the SSH\n    daemon.\n    Check for the value of the \"PermitUserEnvironment\" keyword with the following command:\n    # grep -i permituserenvironment /etc/ssh/sshd_config\n    PermitUserEnvironment no\n    If the \"PermitUserEnvironment\" keyword is not set to \"no\", is missing, or is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to not allow users to override environment variables to the SSH daemon.\n    Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for \"PermitUserEnvironment\" keyword and set the\n    value to \"no\":\n    PermitUserEnvironment no\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86581","V-71957"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-204434","rid":"SV-204434r877377_rule","stig_id":"RHEL-07-010460","fix_id":"F-4558r88495_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204434' do\n  title 'The Red Hat Enterprise Linux operating system must not allow users to override SSH environment variables.'\n  desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'\n  desc 'check', 'Verify the operating system does not allow users to override environment variables to the SSH\n    daemon.\n    Check for the value of the \"PermitUserEnvironment\" keyword with the following command:\n    # grep -i permituserenvironment /etc/ssh/sshd_config\n    PermitUserEnvironment no\n    If the \"PermitUserEnvironment\" keyword is not set to \"no\", is missing, or is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to not allow users to override environment variables to the SSH daemon.\n    Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for \"PermitUserEnvironment\" keyword and set the\n    value to \"no\":\n    PermitUserEnvironment no\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86581', 'V-71957']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00229'\n  tag gid: 'V-204434'\n  tag rid: 'SV-204434r877377_rule'\n  tag stig_id: 'RHEL-07-010460'\n  tag fix_id: 'F-4558r88495_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('PermitUserEnvironment') { should eq 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204434.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204435","title":"The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to\n    the system.","desc":"Failure to restrict system access to authenticated users negatively impacts operating system security.","descriptions":[{"label":"default","data":"Failure to restrict system access to authenticated users negatively impacts operating system security."},{"label":"check","data":"Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.\n    Check for the value of the \"HostbasedAuthentication\" keyword with the following command:\n    # grep -i hostbasedauthentication /etc/ssh/sshd_config\n    HostbasedAuthentication no\n    If the \"HostbasedAuthentication\" keyword is not set to \"no\", is missing, or is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to not allow a non-certificate trusted host SSH logon to the system.\n    Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for \"HostbasedAuthentication\" keyword and set the\n    value to \"no\":\n    HostbasedAuthentication no\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86583","V-71959"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00229","gid":"V-204435","rid":"SV-204435r877377_rule","stig_id":"RHEL-07-010470","fix_id":"F-4559r88498_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204435' do\n  title 'The Red Hat Enterprise Linux operating system must not allow a non-certificate trusted host SSH logon to\n    the system.'\n  desc 'Failure to restrict system access to authenticated users negatively impacts operating system security.'\n  desc 'check', 'Verify the operating system does not allow a non-certificate trusted host SSH logon to the system.\n    Check for the value of the \"HostbasedAuthentication\" keyword with the following command:\n    # grep -i hostbasedauthentication /etc/ssh/sshd_config\n    HostbasedAuthentication no\n    If the \"HostbasedAuthentication\" keyword is not set to \"no\", is missing, or is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to not allow a non-certificate trusted host SSH logon to the system.\n    Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for \"HostbasedAuthentication\" keyword and set the\n    value to \"no\":\n    HostbasedAuthentication no\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86583', 'V-71959']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00229'\n  tag gid: 'V-204435'\n  tag rid: 'SV-204435r877377_rule'\n  tag stig_id: 'RHEL-07-010470'\n  tag fix_id: 'F-4559r88498_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('HostbasedAuthentication') { should eq 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204435.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204437","title":"The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and\n    maintenance modes.","desc":"If the system does not require valid root authentication before it boots into single-user or maintenance\n    mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.","descriptions":[{"label":"default","data":"If the system does not require valid root authentication before it boots into single-user or maintenance\n    mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system."},{"label":"check","data":"Verify the operating system must require authentication upon booting into single-user and\n    maintenance modes.\n    Check that the operating system requires authentication upon booting into single-user mode with the following\n    command:\n    # grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin\n    ExecStart=-/bin/sh -c \"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\"\n    If \"ExecStart\" does not have \"/usr/sbin/sulogin\" as an option, this is a finding."},{"label":"fix","data":"Configure the operating system to require authentication upon booting into single-user and maintenance\n    modes.\n    Add or modify the \"ExecStart\" line in \"/usr/lib/systemd/system/rescue.service\" to include \"/usr/sbin/sulogin\":\n    ExecStart=-/bin/sh -c \"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\""}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-77823","SV-92519"],"severity":"medium","gtitle":"SRG-OS-000080-GPOS-00048","gid":"V-204437","rid":"SV-204437r603261_rule","stig_id":"RHEL-07-010481","fix_id":"F-4561r88504_fix","cci":["CCI-000213"],"nist":["AC-3"],"subsystems":["root","sulogin"],"host":null,"container":null},"code":"control 'SV-204437' do\n  title 'The Red Hat Enterprise Linux operating system must require authentication upon booting into single-user and\n    maintenance modes.'\n  desc 'If the system does not require valid root authentication before it boots into single-user or maintenance\n    mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.'\n  desc 'check', 'Verify the operating system must require authentication upon booting into single-user and\n    maintenance modes.\n    Check that the operating system requires authentication upon booting into single-user mode with the following\n    command:\n    # grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin\n    ExecStart=-/bin/sh -c \"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\"\n    If \"ExecStart\" does not have \"/usr/sbin/sulogin\" as an option, this is a finding.'\n  desc 'fix', 'Configure the operating system to require authentication upon booting into single-user and maintenance\n    modes.\n    Add or modify the \"ExecStart\" line in \"/usr/lib/systemd/system/rescue.service\" to include \"/usr/sbin/sulogin\":\n    ExecStart=-/bin/sh -c \"/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default\"'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-77823', 'SV-92519']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000080-GPOS-00048'\n  tag gid: 'V-204437'\n  tag rid: 'SV-204437r603261_rule'\n  tag stig_id: 'RHEL-07-010481'\n  tag fix_id: 'F-4561r88504_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n  tag subsystems: ['root', 'sulogin']\n  tag 'host'\n  tag 'container'\n\n  describe command('grep -i execstart /usr/lib/systemd/system/rescue.service') do\n    its('stdout.strip') { should match %r{/usr/sbin/sulogin} }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204437.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `grep -i execstart /usr/lib/systemd/system/rescue.service` ","run_time":7.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"grep -i execstart /usr/lib/systemd/system/rescue.service\"]"}]},{"id":"SV-204438","title":"Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS)\n    must require authentication upon booting into single-user and maintenance modes.","desc":"If the system does not require valid authentication before it boots into single-user or maintenance mode,\n    anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2\n    is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make\n    modifications to the boot menu.","descriptions":[{"label":"default","data":"If the system does not require valid authentication before it boots into single-user or maintenance mode,\n    anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2\n    is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make\n    modifications to the boot menu."},{"label":"check","data":"For systems that use UEFI, this is Not Applicable.\n    For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n    Check to see if an encrypted grub superusers password is set. On systems that use a BIOS, use the following command:\n    $ sudo grep -iw grub2_password /boot/grub2/user.cfg\n    GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\n    If the grub superusers password does not begin with \"grub.pbkdf2.sha512\", this is a finding."},{"label":"fix","data":"Configure the system to encrypt the boot password for the grub superusers account with the\n    grub2-setpassword command, which creates/overwrites the /boot/grub2/user.cfg file.\n    Generate an encrypted grub2 password for the grub superusers account with the following command:\n    $ sudo grub2-setpassword\n    Enter password:\n    Confirm password:"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-95717","V-81005"],"severity":"high","gtitle":"SRG-OS-000080-GPOS-00048","gid":"V-204438","rid":"SV-204438r744095_rule","stig_id":"RHEL-07-010482","fix_id":"F-4562r744094_fix","cci":["CCI-000213"],"nist":["AC-3"],"subsystems":["boot","bios"],"host":null},"code":"control 'SV-204438' do\n  title 'Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS)\n    must require authentication upon booting into single-user and maintenance modes.'\n  desc 'If the system does not require valid authentication before it boots into single-user or maintenance mode,\n    anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2\n    is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make\n    modifications to the boot menu.'\n  desc 'check', 'For systems that use UEFI, this is Not Applicable.\n    For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n    Check to see if an encrypted grub superusers password is set. On systems that use a BIOS, use the following command:\n    $ sudo grep -iw grub2_password /boot/grub2/user.cfg\n    GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\n    If the grub superusers password does not begin with \"grub.pbkdf2.sha512\", this is a finding.'\n  desc 'fix', 'Configure the system to encrypt the boot password for the grub superusers account with the\n    grub2-setpassword command, which creates/overwrites the /boot/grub2/user.cfg file.\n    Generate an encrypted grub2 password for the grub superusers account with the following command:\n    $ sudo grub2-setpassword\n    Enter password:\n    Confirm password:'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-95717', 'V-81005']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000080-GPOS-00048'\n  tag gid: 'V-204438'\n  tag rid: 'SV-204438r744095_rule'\n  tag stig_id: 'RHEL-07-010482'\n  tag fix_id: 'F-4562r744094_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n  tag subsystems: ['boot', 'bios']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  elsif file('/sys/firmware/efi').exist?\n    impact 0.0\n    describe 'System running UEFI' do\n      skip 'The System is running UEFI, this control is Not Applicable.'\n    end\n  elsif os[:release] >= '7.2'\n    impact 0.7\n    input('grub_user_boot_files').each do |grub_user_file|\n      describe parse_config_file(grub_user_file) do\n        its('GRUB2_PASSWORD') { should include 'grub.pbkdf2.sha512' }\n      end\n    end\n  else\n    impact 0.0\n    describe 'System running version of RHEL prior to 7.2' do\n      skip 'The System is running an outdated version of RHEL, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204438.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /boot/grub2/user.cfg","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /boot/grub2/user.cfg","skip_message":"Can't find file: /boot/grub2/user.cfg","resource_class":"parse_config_file","resource_params":"[\"/boot/grub2/user.cfg\"]"}]},{"id":"SV-204440","title":"Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface\n    (UEFI) must require authentication upon booting into single-user and maintenance modes.","desc":"If the system does not require valid authentication before it boots into single-user or maintenance mode,\n    anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2\n    is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make\n    modifications to the boot menu.","descriptions":[{"label":"default","data":"If the system does not require valid authentication before it boots into single-user or maintenance mode,\n    anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2\n    is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make\n    modifications to the boot menu."},{"label":"check","data":"For systems that use BIOS, this is Not Applicable.\n    For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n    Check to see if an encrypted grub superusers password is set. On systems that use UEFI, use the following command:\n    $ sudo grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg\n    GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\n    If the grub superusers password does not begin with \"grub.pbkdf2.sha512\", this is a finding."},{"label":"fix","data":"Configure the system to encrypt the boot password for the grub superusers account with the\n    grub2-setpassword command, which creates/overwrites the /boot/efi/EFI/redhat/user.cfg file.\n    Generate an encrypted grub2 password for the grub superusers account with the following command:\n    $ sudo grub2-setpassword\n    Enter password:\n    Confirm password:"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-95719","V-81007"],"severity":"high","gtitle":"SRG-OS-000080-GPOS-00048","gid":"V-204440","rid":"SV-204440r744098_rule","stig_id":"RHEL-07-010491","fix_id":"F-4564r744097_fix","cci":["CCI-000213"],"nist":["AC-3"],"subsystems":["boot","uefi"],"host":null},"code":"control 'SV-204440' do\n  title 'Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface\n    (UEFI) must require authentication upon booting into single-user and maintenance modes.'\n  desc 'If the system does not require valid authentication before it boots into single-user or maintenance mode,\n    anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2\n    is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make\n    modifications to the boot menu.'\n  desc 'check', 'For systems that use BIOS, this is Not Applicable.\n    For systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n    Check to see if an encrypted grub superusers password is set. On systems that use UEFI, use the following command:\n    $ sudo grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg\n    GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash]\n    If the grub superusers password does not begin with \"grub.pbkdf2.sha512\", this is a finding.'\n  desc 'fix', 'Configure the system to encrypt the boot password for the grub superusers account with the\n    grub2-setpassword command, which creates/overwrites the /boot/efi/EFI/redhat/user.cfg file.\n    Generate an encrypted grub2 password for the grub superusers account with the following command:\n    $ sudo grub2-setpassword\n    Enter password:\n    Confirm password:'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-95719', 'V-81007']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000080-GPOS-00048'\n  tag gid: 'V-204440'\n  tag rid: 'SV-204440r744098_rule'\n  tag stig_id: 'RHEL-07-010491'\n  tag fix_id: 'F-4564r744097_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n  tag subsystems: ['boot', 'uefi']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  elsif file('/sys/firmware/efi').exist?\n\n    if os[:release] >= '7.2'\n      impact 0.7\n      input('grub_uefi_user_boot_files').each do |grub_user_file|\n        describe parse_config_file(grub_user_file) do\n          its('GRUB2_PASSWORD') { should include 'grub.pbkdf2.sha512' }\n        end\n      end\n\n      describe parse_config_file(input('grub_uefi_main_cfg')) do\n        its('set superusers') { should cmp '\"root\"' }\n      end\n    else\n      impact 0.0\n      describe 'System running version of RHEL prior to 7.2' do\n        skip 'The System is running an outdated version of RHEL, this control is Not Applicable.'\n      end\n    end\n  else\n    impact 0.0\n    describe 'System running BIOS' do\n      skip 'The System is running BIOS, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204440.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System running BIOS","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The System is running BIOS, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204441","title":"The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational\n    users (or processes acting on behalf of organizational users) using multifactor authentication.","desc":"To assure accountability and prevent unauthenticated access, organizational users must be identified and\n    authenticated to prevent potential misuse and compromise of the system.\n    Organizational users include organizational employees or individuals the organization deems to have equivalent\n    status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be\n    uniquely identified and authenticated to all accesses, except for the following:\n    1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions\n    that can be performed on the information system without identification or authentication;\n    and\n    2) Accesses that occur through authorized use of group authenticators without individual authentication.\n    Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts)\n    or for detailed accountability of individual activity.","descriptions":[{"label":"default","data":"To assure accountability and prevent unauthenticated access, organizational users must be identified and\n    authenticated to prevent potential misuse and compromise of the system.\n    Organizational users include organizational employees or individuals the organization deems to have equivalent\n    status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be\n    uniquely identified and authenticated to all accesses, except for the following:\n    1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions\n    that can be performed on the information system without identification or authentication;\n    and\n    2) Accesses that occur through authorized use of group authenticators without individual authentication.\n    Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts)\n    or for detailed accountability of individual activity."},{"label":"check","data":"Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.\n\nCheck to see if smartcard authentication is enforced on the system:\n\n# authconfig --test | grep \"pam_pkcs11 is enabled\"\n\nIf no results are returned, this is a finding.\n\n# authconfig --test | grep \"smartcard removal action\"\n\nIf \"smartcard removal action\" is blank, this is a finding.\n\n# authconfig --test | grep \"smartcard module\"\n\nIf any of the above checks are not configured, ask the administrator to indicate the AO-approved multifactor authentication in use and the configuration to support it. If there is no evidence of multifactor authentication, this is a finding."},{"label":"fix","data":"Configure the operating system to require individuals to be authenticated with a multifactor\n    authenticator.\n    Enable smartcard logons with the following commands:\n    # authconfig --enablesmartcard --smartcardaction=0 --update\n    # authconfig --enablerequiresmartcard -update\n    Modify the \"/etc/pam_pkcs11/pkcs11_eventmgr.conf\" file to uncomment the following line:\n    #/usr/X11R6/bin/xscreensaver-command -lock\n    Modify the \"/etc/pam_pkcs11/pam_pkcs11.conf\" file to use the cackey module if required."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71965","SV-86589"],"severity":"medium","gtitle":"SRG-OS-000104-GPOS-00051","satisfies":["SRG-OS-000104-GPOS-00051","SRG-OS-000106-GPOS-00053","SRG-OS-000107-GPOS-00054","SRG-OS-000109-GPOS-00056","SRG-OS-000108-GPOS-00055","SRG-OS-000108-GPOS-00057","SRG-OS-000108-GPOS-00058"],"gid":"V-204441","rid":"SV-204441r818813_rule","stig_id":"RHEL-07-010500","fix_id":"F-4565r88516_fix","cci":["CCI-000766"],"nist":["IA-2 (2)"],"subsystems":["pam","smartcard"],"host":null},"code":"control 'SV-204441' do\n  title 'The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate organizational\n    users (or processes acting on behalf of organizational users) using multifactor authentication.'\n  desc 'To assure accountability and prevent unauthenticated access, organizational users must be identified and\n    authenticated to prevent potential misuse and compromise of the system.\n    Organizational users include organizational employees or individuals the organization deems to have equivalent\n    status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be\n    uniquely identified and authenticated to all accesses, except for the following:\n    1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions\n    that can be performed on the information system without identification or authentication;\n    and\n    2) Accesses that occur through authorized use of group authenticators without individual authentication.\n    Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts)\n    or for detailed accountability of individual activity.'\n  desc 'check', 'Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication.\n\nCheck to see if smartcard authentication is enforced on the system:\n\n# authconfig --test | grep \"pam_pkcs11 is enabled\"\n\nIf no results are returned, this is a finding.\n\n# authconfig --test | grep \"smartcard removal action\"\n\nIf \"smartcard removal action\" is blank, this is a finding.\n\n# authconfig --test | grep \"smartcard module\"\n\nIf any of the above checks are not configured, ask the administrator to indicate the AO-approved multifactor authentication in use and the configuration to support it. If there is no evidence of multifactor authentication, this is a finding.'\n  desc 'fix', 'Configure the operating system to require individuals to be authenticated with a multifactor\n    authenticator.\n    Enable smartcard logons with the following commands:\n    # authconfig --enablesmartcard --smartcardaction=0 --update\n    # authconfig --enablerequiresmartcard -update\n    Modify the \"/etc/pam_pkcs11/pkcs11_eventmgr.conf\" file to uncomment the following line:\n    #/usr/X11R6/bin/xscreensaver-command -lock\n    Modify the \"/etc/pam_pkcs11/pam_pkcs11.conf\" file to use the cackey module if required.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71965', 'SV-86589']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000104-GPOS-00051'\n  tag satisfies: ['SRG-OS-000104-GPOS-00051', 'SRG-OS-000106-GPOS-00053', 'SRG-OS-000107-GPOS-00054', 'SRG-OS-000109-GPOS-00056', 'SRG-OS-000108-GPOS-00055', 'SRG-OS-000108-GPOS-00057', 'SRG-OS-000108-GPOS-00058']\n  tag gid: 'V-204441'\n  tag rid: 'SV-204441r818813_rule'\n  tag stig_id: 'RHEL-07-010500'\n  tag fix_id: 'F-4565r88516_fix'\n  tag cci: ['CCI-000766']\n  tag nist: ['IA-2 (2)']\n  tag subsystems: ['pam', 'smartcard']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n    smart_card_status = input('smart_card_status')\n    if smart_card_status.eql?('enabled')\n      impact 0.5\n      describe command('authconfig --test | grep -i smartcard') do\n        its('stdout') do\n          should match(/use\\sonly\\ssmartcard\\sfor\\slogin\\sis\\s#{smart_card_status}/)\n        end\n        its('stdout') { should match(/smartcard\\smodule\\s=\\s\".+\"/) }\n        its('stdout') { should match(/smartcard\\sremoval\\saction\\s=\\s\".+\"/) }\n      end\n    else\n      impact 0.0\n      describe 'The system is not smartcard enabled' do\n        skip 'The system is not using Smartcards / PIVs to fulfil the MFA requirement, this control is Not Applicable.'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204441.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `authconfig --test | grep -i smartcard` ","run_time":7.5e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"authconfig --test | grep -i smartcard\"]"}]},{"id":"SV-204442","title":"The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.","desc":"It is detrimental for operating systems to provide, or install by default, functionality exceeding\n    requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore\n    may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services, provided by default, may not be necessary to support essential organizational operations (e.g., key\n    missions, functions).\n    The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality\n    and integrity of user passwords or the remote session and has very weak authentication.\n    If a privileged user were to log on using this service, the privileged user password could be compromised.","descriptions":[{"label":"default","data":"It is detrimental for operating systems to provide, or install by default, functionality exceeding\n    requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore\n    may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services, provided by default, may not be necessary to support essential organizational operations (e.g., key\n    missions, functions).\n    The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality\n    and integrity of user passwords or the remote session and has very weak authentication.\n    If a privileged user were to log on using this service, the privileged user password could be compromised."},{"label":"check","data":"Check to see if the rsh-server package is installed with the following command:\n    # yum list installed rsh-server\n    If the rsh-server package is installed, this is a finding."},{"label":"fix","data":"Configure the operating system to disable non-essential capabilities by removing the rsh-server\n    package from the system with the following command:\n    # yum remove rsh-server"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71967","SV-86591"],"severity":"high","gtitle":"SRG-OS-000095-GPOS-00049","gid":"V-204442","rid":"SV-204442r603261_rule","stig_id":"RHEL-07-020000","fix_id":"F-4566r88519_fix","cci":["CCI-000381"],"nist":["CM-7 a"],"subsystems":["packages"],"host":null,"container":null},"code":"control 'SV-204442' do\n  title 'The Red Hat Enterprise Linux operating system must not have the rsh-server package installed.'\n  desc 'It is detrimental for operating systems to provide, or install by default, functionality exceeding\n    requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore\n    may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services, provided by default, may not be necessary to support essential organizational operations (e.g., key\n    missions, functions).\n    The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality\n    and integrity of user passwords or the remote session and has very weak authentication.\n    If a privileged user were to log on using this service, the privileged user password could be compromised.'\n  desc 'check', 'Check to see if the rsh-server package is installed with the following command:\n    # yum list installed rsh-server\n    If the rsh-server package is installed, this is a finding.'\n  desc 'fix', 'Configure the operating system to disable non-essential capabilities by removing the rsh-server\n    package from the system with the following command:\n    # yum remove rsh-server'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71967', 'SV-86591']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000095-GPOS-00049'\n  tag gid: 'V-204442'\n  tag rid: 'SV-204442r603261_rule'\n  tag stig_id: 'RHEL-07-020000'\n  tag fix_id: 'F-4566r88519_fix'\n  tag cci: ['CCI-000381']\n  tag nist: ['CM-7 a']\n  tag subsystems: ['packages']\n  tag 'host'\n  tag 'container'\n\n  describe package('rsh-server') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204442.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package rsh-server","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package rsh-server","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"rsh-server\"]"}]},{"id":"SV-204443","title":"The Red Hat Enterprise Linux operating system must not have the ypserv package installed.","desc":"Removing the \"ypserv\" package decreases the risk of the accidental (or intentional) activation of NIS or\n    NIS+ services.","descriptions":[{"label":"default","data":"Removing the \"ypserv\" package decreases the risk of the accidental (or intentional) activation of NIS or\n    NIS+ services."},{"label":"check","data":"The NIS service provides an unencrypted authentication service that does not provide for the\n    confidentiality and integrity of user passwords or the remote session.\n    Check to see if the \"ypserve\" package is installed with the following command:\n    # yum list installed ypserv\n    If the \"ypserv\" package is installed, this is a finding."},{"label":"fix","data":"Configure the operating system to disable non-essential capabilities by removing the \"ypserv\" package\n    from the system with the following command:\n    # yum remove ypserv"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71969","SV-86593"],"severity":"high","gtitle":"SRG-OS-000095-GPOS-00049","gid":"V-204443","rid":"SV-204443r603261_rule","stig_id":"RHEL-07-020010","fix_id":"F-4567r88522_fix","cci":["CCI-000381"],"nist":["CM-7 a"],"subsystems":["packages"],"host":null,"container":null},"code":"control 'SV-204443' do\n  title 'The Red Hat Enterprise Linux operating system must not have the ypserv package installed.'\n  desc 'Removing the \"ypserv\" package decreases the risk of the accidental (or intentional) activation of NIS or\n    NIS+ services.'\n  desc 'check', 'The NIS service provides an unencrypted authentication service that does not provide for the\n    confidentiality and integrity of user passwords or the remote session.\n    Check to see if the \"ypserve\" package is installed with the following command:\n    # yum list installed ypserv\n    If the \"ypserv\" package is installed, this is a finding.'\n  desc 'fix', 'Configure the operating system to disable non-essential capabilities by removing the \"ypserv\" package\n    from the system with the following command:\n    # yum remove ypserv'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71969', 'SV-86593']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000095-GPOS-00049'\n  tag gid: 'V-204443'\n  tag rid: 'SV-204443r603261_rule'\n  tag stig_id: 'RHEL-07-020010'\n  tag fix_id: 'F-4567r88522_fix'\n  tag cci: ['CCI-000381']\n  tag nist: ['CM-7 a']\n  tag subsystems: ['packages']\n  tag 'host'\n  tag 'container'\n\n  describe package('ypserv') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204443.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package ypserv","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package ypserv","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"ypserv\"]"}]},{"id":"SV-204444","title":"The Red Hat Enterprise Linux operating system must prevent non-privileged users from executing privileged\n    functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.","desc":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized\n    individuals or processes may gain unnecessary access to information or privileges.\n    Privileged functions include, for example, establishing accounts, performing system integrity checks, or\n    administering cryptographic key management activities. Non-privileged users are individuals who do not possess\n    appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection\n    mechanisms are examples of privileged functions that require protection from non-privileged users.","descriptions":[{"label":"default","data":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized\n    individuals or processes may gain unnecessary access to information or privileges.\n    Privileged functions include, for example, establishing accounts, performing system integrity checks, or\n    administering cryptographic key management activities. Non-privileged users are individuals who do not possess\n    appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection\n    mechanisms are examples of privileged functions that require protection from non-privileged users."},{"label":"check","data":"Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL)\n    in conjunction with SELinux.\n    Verify the operating system prevents non-privileged users from executing privileged functions to include disabling,\n    circumventing, or altering implemented security safeguards/countermeasures.\n    Get a list of authorized users for the system.\n    Check the list against the system by using the following command:\n    $ sudo semanage login -l | more\n    Login Name SELinux User MLS/MCS Range Service\n    __default__ user_u s0-s0:c0.c1023 *\n    root unconfined_u s0-s0:c0.c1023 *\n    system_u system_u s0-s0:c0.c1023 *\n    joe staff_u s0-s0:c0.c1023 *\n    All administrators must be mapped to the , \"staff_u\", or an appropriately tailored confined SELinux user as defined\n    by the organization.\n    All authorized non-administrative users must be mapped to the \"user_u\" SELinux user.\n    If they are not mapped in this way, this is a finding.\n    If administrator accounts are mapped to the \"sysadm_u\" SELinux user and are not documented as an operational\n    requirement with the ISSO, this is a finding.\n    If administrator accounts are mapped to the \"sysadm_u\" SELinux user and are documented as an operational requirement\n    with the ISSO, this can be downgraded to a CAT III."},{"label":"fix","data":"Configure the operating system to prevent non-privileged users from executing privileged functions to\n    include disabling, circumventing, or altering implemented security safeguards/countermeasures.\n    Use the following command to map a new user to the \"staff_u\" SELinux user:\n    $ sudo semanage login -a -s staff_u <username>\n    Use the following command to map an existing user to the \"staff_u\" SELinux user:\n    $ sudo semanage login -m -s staff_u <username>\n    Use the following command to map a new user to the \"user_u\" SELinux user:\n    $ sudo semanage login -a -s user_u <username>\n    Use the following command to map an existing user to the \"user_u\" SELinux user:\n    $ sudo semanage login -m -s user_u <username>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86595","V-71971"],"severity":"medium","gtitle":"SRG-OS-000324-GPOS-00125","gid":"V-204444","rid":"SV-204444r877392_rule","stig_id":"RHEL-07-020020","fix_id":"F-4568r792825_fix","cci":["CCI-002165","CCI-002235"],"nist":["AC-3 (4)","AC-6 (10)"],"subsystems":["selinux"],"host":null},"code":"control 'SV-204444' do\n  title 'The Red Hat Enterprise Linux operating system must prevent non-privileged users from executing privileged\n    functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.'\n  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized\n    individuals or processes may gain unnecessary access to information or privileges.\n    Privileged functions include, for example, establishing accounts, performing system integrity checks, or\n    administering cryptographic key management activities. Non-privileged users are individuals who do not possess\n    appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection\n    mechanisms are examples of privileged functions that require protection from non-privileged users.'\n  desc 'check', 'Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL)\n    in conjunction with SELinux.\n    Verify the operating system prevents non-privileged users from executing privileged functions to include disabling,\n    circumventing, or altering implemented security safeguards/countermeasures.\n    Get a list of authorized users for the system.\n    Check the list against the system by using the following command:\n    $ sudo semanage login -l | more\n    Login Name SELinux User MLS/MCS Range Service\n    __default__ user_u s0-s0:c0.c1023 *\n    root unconfined_u s0-s0:c0.c1023 *\n    system_u system_u s0-s0:c0.c1023 *\n    joe staff_u s0-s0:c0.c1023 *\n    All administrators must be mapped to the , \"staff_u\", or an appropriately tailored confined SELinux user as defined\n    by the organization.\n    All authorized non-administrative users must be mapped to the \"user_u\" SELinux user.\n    If they are not mapped in this way, this is a finding.\n    If administrator accounts are mapped to the \"sysadm_u\" SELinux user and are not documented as an operational\n    requirement with the ISSO, this is a finding.\n    If administrator accounts are mapped to the \"sysadm_u\" SELinux user and are documented as an operational requirement\n    with the ISSO, this can be downgraded to a CAT III.'\n  desc 'fix', 'Configure the operating system to prevent non-privileged users from executing privileged functions to\n    include disabling, circumventing, or altering implemented security safeguards/countermeasures.\n    Use the following command to map a new user to the \"staff_u\" SELinux user:\n    $ sudo semanage login -a -s staff_u <username>\n    Use the following command to map an existing user to the \"staff_u\" SELinux user:\n    $ sudo semanage login -m -s staff_u <username>\n    Use the following command to map a new user to the \"user_u\" SELinux user:\n    $ sudo semanage login -a -s user_u <username>\n    Use the following command to map an existing user to the \"user_u\" SELinux user:\n    $ sudo semanage login -m -s user_u <username>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86595', 'V-71971']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000324-GPOS-00125'\n  tag gid: 'V-204444'\n  tag rid: 'SV-204444r877392_rule'\n  tag stig_id: 'RHEL-07-020020'\n  tag fix_id: 'F-4568r792825_fix'\n  tag cci: ['CCI-002165', 'CCI-002235']\n  tag nist: ['AC-3 (4)', 'AC-6 (10)']\n  tag subsystems: ['selinux']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - SELinux settings must be handled on host' do\n      skip 'Control not applicable - SELinux settings must be handled on host'\n    end\n  else\n\n    admin_logins = input('admin_logins')\n\n    describe command('selinuxenabled') do\n      its('exist?') { should be true }\n      its('exit_status') { should eq 0 }\n    end\n\n    selinux_mode = file('/etc/selinux/config').content.lines\n                                              .grep(/\\A\\s*SELINUXTYPE=/).last.split('=').last.strip\n\n    seusers = file(\"/etc/selinux/#{selinux_mode}/seusers\").content.lines\n                                                          .grep_v(/(#|\\A\\s+\\Z)/).map(&:strip)\n\n    seusers = seusers.map { |x| x.split(':')[0..1] }\n\n    describe 'seusers' do\n      it { expect(seusers).to_not be_empty }\n    end\n\n    users_to_ignore = [\n      'root',\n      'system_u'\n    ]\n\n    seusers.each do |user, context|\n      next if users_to_ignore.include?(user)\n\n      describe \"SELinux login #{user}\" do\n        if user == '__default__'\n          let(:valid_users) { ['user_u'] }\n        elsif admin_logins.include?(user)\n          let(:valid_users) do\n            [\n              'staff_u'\n            ]\n          end\n        else\n          let(:valid_users) do\n            [\n              'user_u',\n              'guest_u',\n              'xguest_u'\n            ]\n          end\n        end\n\n        it { expect(context).to be_in(valid_users) }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204444.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `selinuxenabled` ","run_time":7.6e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"selinuxenabled\"]"},{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204444.rb:1 ","run_time":8.4e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `lines' for nil:NilClass","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204445","title":"The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the\n    baseline operating system configuration at least weekly.","desc":"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.","descriptions":[{"label":"default","data":"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item."},{"label":"check","data":"Verify the operating system routinely checks the baseline configuration for unauthorized changes.\n\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.\n\nCheck for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.\n\nCheck the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\n\n     # ls -al /etc/cron.* | grep aide\n     -rwxr-xr-x 1 root root 602 Mar 6 20:02 aide\n\n     # grep aide /etc/crontab /var/spool/cron/root\n     /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check\n     /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check\n\nIf the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding."},{"label":"fix","data":"Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:  \n\n     # more /etc/cron.daily/aide\n     #!/bin/bash\n\n     /usr/sbin/aide --check | /var/spool/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86597","V-71973"],"severity":"medium","gtitle":"SRG-OS-000363-GPOS-00150","gid":"V-204445","rid":"SV-204445r880848_rule","stig_id":"RHEL-07-020030","fix_id":"F-36304r880847_fix","cci":["CCI-001744"],"nist":["CM-3 (5)"],"subsystems":["file_integrity_tool"],"host":null,"container":null},"code":"control 'SV-204445' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that a file integrity tool verifies the\n    baseline operating system configuration at least weekly.'\n  desc \"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\"\n  desc 'check', 'Verify the operating system routinely checks the baseline configuration for unauthorized changes.\n\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week.\n\nCheck for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence.\n\nCheck the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\n\n     # ls -al /etc/cron.* | grep aide\n     -rwxr-xr-x 1 root root 602 Mar 6 20:02 aide\n\n     # grep aide /etc/crontab /var/spool/cron/root\n     /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check\n     /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check\n\nIf the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.'\n  desc 'fix', 'Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used:  \n\n     # more /etc/cron.daily/aide\n     #!/bin/bash\n\n     /usr/sbin/aide --check | /var/spool/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86597', 'V-71973']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000363-GPOS-00150'\n  tag gid: 'V-204445'\n  tag rid: 'SV-204445r880848_rule'\n  tag stig_id: 'RHEL-07-020030'\n  tag fix_id: 'F-36304r880847_fix'\n  tag cci: ['CCI-001744']\n  tag nist: ['CM-3 (5)']\n  tag subsystems: ['file_integrity_tool']\n  tag 'host'\n  tag 'container'\n\n  file_integrity_tool = input('file_integrity_tool')\n  file_integrity_interval = input('file_integrity_interval')\n\n  describe package(file_integrity_tool) do\n    it { should be_installed }\n  end\n\n  if file_integrity_interval == 'monthly'\n    describe.one do\n      describe file(\"/etc/cron.daily/#{file_integrity_tool}\") do\n        it { should exist }\n      end\n      describe file(\"/etc/cron.weekly/#{file_integrity_tool}\") do\n        it { should exist }\n      end\n      describe file(\"/etc/cron.monthly/#{file_integrity_tool}\") do\n        it { should exist }\n      end\n      if file(\"/etc/cron.d/#{file_integrity_tool}\").exist?\n        describe crontab(path: \"/etc/cron.d/#{file_integrity_tool}\") do\n          its('months') { should cmp '*' }\n          its('weekdays') { should cmp '*' }\n        end\n        describe crontab(path: \"/etc/cron.d/#{file_integrity_tool}\") do\n          its('days') { should cmp '*' }\n          its('months') { should cmp '*' }\n        end\n      end\n      describe crontab('root').where {\n                 command =~ /#{file_integrity_tool}/\n               }                do\n        its('months') { should cmp '*' }\n        its('weekdays') { should cmp '*' }\n      end\n      describe crontab('root').where {\n                 command =~ /#{file_integrity_tool}/\n               }                do\n        its('days') { should cmp '*' }\n        its('months') { should cmp '*' }\n      end\n    end\n  elsif file_integrity_interval == 'weekly'\n    describe.one do\n      describe file(\"/etc/cron.daily/#{file_integrity_tool}\") do\n        it { should exist }\n      end\n      describe file(\"/etc/cron.weekly/#{file_integrity_tool}\") do\n        it { should exist }\n      end\n      if file(\"/etc/cron.d/#{file_integrity_tool}\").exist?\n        describe crontab(path: \"/etc/cron.d/#{file_integrity_tool}\") do\n          its('days') { should cmp '*' }\n          its('months') { should cmp '*' }\n        end\n      end\n      describe crontab('root').where {\n                 command =~ /#{file_integrity_tool}/\n               }                do\n        its('days') { should cmp '*' }\n        its('months') { should cmp '*' }\n      end\n    end\n  elsif file_integrity_interval == 'daily'\n    describe.one do\n      describe file(\"/etc/cron.daily/#{file_integrity_tool}\") do\n        it { should exist }\n      end\n      if file(\"/etc/cron.d/#{file_integrity_tool}\").exist?\n        describe crontab(path: \"/etc/cron.d/#{file_integrity_tool}\") do\n          its('days') { should cmp '*' }\n          its('months') { should cmp '*' }\n          its('weekdays') { should cmp '*' }\n        end\n      end\n      describe crontab('root').where {\n                 command =~ /#{file_integrity_tool}/\n               }                do\n        its('days') { should cmp '*' }\n        its('months') { should cmp '*' }\n        its('weekdays') { should cmp '*' }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204445.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package aide","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package aide","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"aide\"]"},{"status":"failed","code_desc":"File /etc/cron.daily/aide is expected to exist","run_time":0.000169,"start_time":"2023-04-18T13:20:14-04:00","message":"expected File /etc/cron.daily/aide to exist","exception":"RSpec::Core::MultipleExceptionError","resource_class":"file","resource_params":"[\"/etc/cron.daily/aide\"]"},{"status":"failed","code_desc":"File /etc/cron.weekly/aide is expected to exist","run_time":0.000123,"start_time":"2023-04-18T13:20:14-04:00","message":"expected File /etc/cron.weekly/aide to exist","exception":"RSpec::Core::MultipleExceptionError","resource_class":"file","resource_params":"[\"/etc/cron.weekly/aide\"]"},{"status":"failed","code_desc":"crontab for user root with command =~ /aide/ days is expected to cmp == \"*\"","run_time":0.000231,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: *\n     got: []\n\n(compared using `cmp` matcher)\n","exception":"RSpec::Core::MultipleExceptionError","resource_class":"FilterTable::Table","resource_params":"[]"},{"status":"failed","code_desc":"crontab for user root with command =~ /aide/ months is expected to cmp == \"*\"","run_time":0.000191,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: *\n     got: []\n\n(compared using `cmp` matcher)\n","exception":"RSpec::Core::MultipleExceptionError","resource_class":"FilterTable::Table","resource_params":"[]"}]},{"id":"SV-204446","title":"The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified\n    if baseline configurations are changed in an unauthorized manner.","desc":"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.","descriptions":[{"label":"default","data":"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item."},{"label":"check","data":"Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.\n\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.\n\nCheck for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.\n\nCheck the cron directories for a \"crontab\" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\n    \n     # ls -al /etc/cron.* | grep aide\n     -rwxr-xr-x 1 root root 602 Mar 6 20:02 aide\n\n     # grep aide /etc/crontab /var/spool/cron/root\n     /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check\n     /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check\n\nAIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:\n\n     # more /etc/cron.daily/aide\n     #!/bin/bash\n\n     /usr/sbin/aide --check | /var/spool/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil\n\nIf the file integrity application does not notify designated personnel of changes, this is a finding."},{"label":"fix","data":"Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. \n\nThe following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. \n\n     # more /etc/cron.daily/aide\n\n     /usr/sbin/aide --check | /var/spool/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71975","SV-86599"],"severity":"medium","gtitle":"SRG-OS-000363-GPOS-00150","gid":"V-204446","rid":"SV-204446r880851_rule","stig_id":"RHEL-07-020040","fix_id":"F-36305r880850_fix","cci":["CCI-001744"],"nist":["CM-3 (5)"],"subsystems":["file_integrity_tool"],"host":null,"container":null},"code":"control 'SV-204446' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that designated personnel are notified\n    if baseline configurations are changed in an unauthorized manner.'\n  desc \"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information System Security Manager (ISSM)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.\"\n  desc 'check', 'Verify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner.\n\nNote: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert.\n\nCheck for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence.\n\nCheck the cron directories for a \"crontab\" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command:\n    \n     # ls -al /etc/cron.* | grep aide\n     -rwxr-xr-x 1 root root 602 Mar 6 20:02 aide\n\n     # grep aide /etc/crontab /var/spool/cron/root\n     /etc/crontab: 30 04 * * * root /usr/sbin/aide  --check\n     /var/spool/cron/root: 30 04 * * * /usr/sbin/aide  --check\n\nAIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example:\n\n     # more /etc/cron.daily/aide\n     #!/bin/bash\n\n     /usr/sbin/aide --check | /var/spool/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil\n\nIf the file integrity application does not notify designated personnel of changes, this is a finding.'\n  desc 'fix', 'Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. \n\nThe following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. \n\n     # more /etc/cron.daily/aide\n\n     /usr/sbin/aide --check | /var/spool/mail -s \"$HOSTNAME - Daily aide integrity check run\" root@sysname.mil'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71975', 'SV-86599']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000363-GPOS-00150'\n  tag gid: 'V-204446'\n  tag rid: 'SV-204446r880851_rule'\n  tag stig_id: 'RHEL-07-020040'\n  tag fix_id: 'F-36305r880850_fix'\n  tag cci: ['CCI-001744']\n  tag nist: ['CM-3 (5)']\n  tag subsystems: ['file_integrity_tool']\n  tag 'host'\n  tag 'container'\n\n  file_integrity_tool = input('file_integrity_tool')\n\n  describe package(file_integrity_tool) do\n    it { should be_installed }\n  end\n  describe.one do\n    describe file(\"/etc/cron.daily/#{file_integrity_tool}\") do\n      its('content') { should match %r{/bin/mail} }\n    end\n    describe file(\"/etc/cron.weekly/#{file_integrity_tool}\") do\n      its('content') { should match %r{/bin/mail} }\n    end\n    describe crontab('root').where {\n               command =~ /#{file_integrity_tool}/\n             } do\n      its('commands.flatten') { should include(match %r{/bin/mail}) }\n    end\n    if file(\"/etc/cron.d/#{file_integrity_tool}\").exist?\n      describe crontab(path: \"/etc/cron.d/#{file_integrity_tool}\") do\n        its('commands') { should include(match %r{/bin/mail}) }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204446.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package aide","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package aide","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"aide\"]"},{"status":"failed","code_desc":"File /etc/cron.daily/aide content is expected to match /\\/bin\\/mail/","run_time":0.000177,"start_time":"2023-04-18T13:20:14-04:00","message":"expected nil to match /\\/bin\\/mail/","exception":"RSpec::Core::MultipleExceptionError","resource_class":"file","resource_params":"[\"/etc/cron.daily/aide\"]"},{"status":"failed","code_desc":"File /etc/cron.weekly/aide content is expected to match /\\/bin\\/mail/","run_time":0.000136,"start_time":"2023-04-18T13:20:14-04:00","message":"expected nil to match /\\/bin\\/mail/","exception":"RSpec::Core::MultipleExceptionError","resource_class":"file","resource_params":"[\"/etc/cron.weekly/aide\"]"},{"status":"failed","code_desc":"crontab for user root with command =~ /aide/ commands.flatten is expected to include (match /\\/bin\\/mail/)","run_time":0.000428,"start_time":"2023-04-18T13:20:14-04:00","message":"expected [] to include (match /\\/bin\\/mail/)\nDiff:\n@@ -1,2 +1,2 @@\n-[(match /\\/bin\\/mail/)]\n+[]\n","exception":"RSpec::Core::MultipleExceptionError","resource_class":"FilterTable::Table","resource_params":"[]"}]},{"id":"SV-204447","title":"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service\n    packs, device drivers, or operating system components from a repository without verification they have been\n    digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved\n    by the organization.","desc":"Changes to any software components can have significant effects on the overall security of the operating\n    system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted\n    vendor.\n    Accordingly, patches, service packs, device drivers, or operating system components must be signed with a\n    certificate recognized and approved by the organization.\n    Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade\n    received from a vendor. This verifies the software has not been tampered with and that it has been provided by a\n    trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to\n    verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the\n    certificate used to verify the software must be from an approved CA.","descriptions":[{"label":"default","data":"Changes to any software components can have significant effects on the overall security of the operating\n    system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted\n    vendor.\n    Accordingly, patches, service packs, device drivers, or operating system components must be signed with a\n    certificate recognized and approved by the organization.\n    Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade\n    received from a vendor. This verifies the software has not been tampered with and that it has been provided by a\n    trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to\n    verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the\n    certificate used to verify the software must be from an approved CA."},{"label":"check","data":"Verify the operating system prevents the installation of patches, service packs, device drivers, or\n    operating system components from a repository without verification that they have been digitally signed using a\n    certificate that is recognized and approved by the organization.\n    Check that yum verifies the signature of packages from a repository prior to install with the following command:\n    # grep gpgcheck /etc/yum.conf\n    gpgcheck=1\n    If \"gpgcheck\" is not set to \"1\", or if options are missing or commented out, ask the System Administrator how the\n    certificates for patches and other operating system components are verified.\n    If there is no process to validate certificates that is approved by the organization, this is a finding."},{"label":"fix","data":"Configure the operating system to verify the signature of packages from a repository prior to install\n    by setting the following option in the \"/etc/yum.conf\" file:\n    gpgcheck=1"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71977","SV-86601"],"severity":"high","gtitle":"SRG-OS-000366-GPOS-00153","gid":"V-204447","rid":"SV-204447r877463_rule","stig_id":"RHEL-07-020050","fix_id":"F-4571r88534_fix","cci":["CCI-001749"],"nist":["CM-5 (3)"],"subsystems":["yum"],"host":null,"container":null},"code":"control 'SV-204447' do\n  title 'The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service\n    packs, device drivers, or operating system components from a repository without verification they have been\n    digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved\n    by the organization.'\n  desc 'Changes to any software components can have significant effects on the overall security of the operating\n    system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted\n    vendor.\n    Accordingly, patches, service packs, device drivers, or operating system components must be signed with a\n    certificate recognized and approved by the organization.\n    Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade\n    received from a vendor. This verifies the software has not been tampered with and that it has been provided by a\n    trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to\n    verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the\n    certificate used to verify the software must be from an approved CA.'\n  desc 'check', 'Verify the operating system prevents the installation of patches, service packs, device drivers, or\n    operating system components from a repository without verification that they have been digitally signed using a\n    certificate that is recognized and approved by the organization.\n    Check that yum verifies the signature of packages from a repository prior to install with the following command:\n    # grep gpgcheck /etc/yum.conf\n    gpgcheck=1\n    If \"gpgcheck\" is not set to \"1\", or if options are missing or commented out, ask the System Administrator how the\n    certificates for patches and other operating system components are verified.\n    If there is no process to validate certificates that is approved by the organization, this is a finding.'\n  desc 'fix', 'Configure the operating system to verify the signature of packages from a repository prior to install\n    by setting the following option in the \"/etc/yum.conf\" file:\n    gpgcheck=1'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71977', 'SV-86601']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000366-GPOS-00153'\n  tag gid: 'V-204447'\n  tag rid: 'SV-204447r877463_rule'\n  tag stig_id: 'RHEL-07-020050'\n  tag fix_id: 'F-4571r88534_fix'\n  tag cci: ['CCI-001749']\n  tag nist: ['CM-5 (3)']\n  tag subsystems: ['yum']\n  tag 'host'\n  tag 'container'\n\n  yum_conf = '/etc/yum.conf'\n\n  if (f = file(yum_conf)).exist?\n    describe ini(yum_conf) do\n      its('main.gpgcheck') { should cmp 1 }\n    end\n  else\n    describe f do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204447.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"File /etc/yum.conf ","run_time":7.7e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `file` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"file","resource_params":"[\"/etc/yum.conf\"]"}]},{"id":"SV-204448","title":"The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service\n    packs, device drivers, or operating system components of local packages without verification they have been\n    digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved\n    by the organization.","desc":"Changes to any software components can have significant effects on the overall security of the operating\n    system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted\n    vendor.\n    Accordingly, patches, service packs, device drivers, or operating system components must be signed with a\n    certificate recognized and approved by the organization.\n    Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade\n    received from a vendor. This verifies the software has not been tampered with and that it has been provided by a\n    trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to\n    verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the\n    certificate used to verify the software must be from an approved CA.","descriptions":[{"label":"default","data":"Changes to any software components can have significant effects on the overall security of the operating\n    system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted\n    vendor.\n    Accordingly, patches, service packs, device drivers, or operating system components must be signed with a\n    certificate recognized and approved by the organization.\n    Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade\n    received from a vendor. This verifies the software has not been tampered with and that it has been provided by a\n    trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to\n    verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the\n    certificate used to verify the software must be from an approved CA."},{"label":"check","data":"Verify the operating system prevents the installation of patches, service packs, device drivers, or\n    operating system components of local packages without verification that they have been digitally signed using a\n    certificate that is recognized and approved by the organization.\n    Check that yum verifies the signature of local packages prior to install with the following command:\n    # grep localpkg_gpgcheck /etc/yum.conf\n    localpkg_gpgcheck=1\n    If \"localpkg_gpgcheck\" is not set to \"1\", or if options are missing or commented out, ask the System Administrator\n    how the signatures of local packages and other operating system components are verified.\n    If there is no process to validate the signatures of local packages that is approved by the organization, this is a\n    finding."},{"label":"fix","data":"Configure the operating system to verify the signature of local packages prior to install by setting\n    the following option in the \"/etc/yum.conf\" file:\n    localpkg_gpgcheck=1"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71979","SV-86603"],"severity":"high","gtitle":"SRG-OS-000366-GPOS-00153","gid":"V-204448","rid":"SV-204448r877463_rule","stig_id":"RHEL-07-020060","fix_id":"F-4572r88537_fix","cci":["CCI-001749"],"nist":["CM-5 (3)"],"subsystems":["yum"],"host":null,"container":null},"code":"control 'SV-204448' do\n  title 'The Red Hat Enterprise Linux operating system must prevent the installation of software, patches, service\n    packs, device drivers, or operating system components of local packages without verification they have been\n    digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved\n    by the organization.'\n  desc 'Changes to any software components can have significant effects on the overall security of the operating\n    system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted\n    vendor.\n    Accordingly, patches, service packs, device drivers, or operating system components must be signed with a\n    certificate recognized and approved by the organization.\n    Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade\n    received from a vendor. This verifies the software has not been tampered with and that it has been provided by a\n    trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to\n    verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the\n    certificate used to verify the software must be from an approved CA.'\n  desc 'check', 'Verify the operating system prevents the installation of patches, service packs, device drivers, or\n    operating system components of local packages without verification that they have been digitally signed using a\n    certificate that is recognized and approved by the organization.\n    Check that yum verifies the signature of local packages prior to install with the following command:\n    # grep localpkg_gpgcheck /etc/yum.conf\n    localpkg_gpgcheck=1\n    If \"localpkg_gpgcheck\" is not set to \"1\", or if options are missing or commented out, ask the System Administrator\n    how the signatures of local packages and other operating system components are verified.\n    If there is no process to validate the signatures of local packages that is approved by the organization, this is a\n    finding.'\n  desc 'fix', 'Configure the operating system to verify the signature of local packages prior to install by setting\n    the following option in the \"/etc/yum.conf\" file:\n    localpkg_gpgcheck=1'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71979', 'SV-86603']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000366-GPOS-00153'\n  tag gid: 'V-204448'\n  tag rid: 'SV-204448r877463_rule'\n  tag stig_id: 'RHEL-07-020060'\n  tag fix_id: 'F-4572r88537_fix'\n  tag cci: ['CCI-001749']\n  tag nist: ['CM-5 (3)']\n  tag subsystems: ['yum']\n  tag 'host'\n  tag 'container'\n\n  yum_conf = '/etc/yum.conf'\n\n  if (f = file(yum_conf)).exist?\n    describe ini(yum_conf) do\n      its('main.localpkg_gpgcheck') { cmp 1 }\n    end\n  else\n    describe f do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204448.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"File /etc/yum.conf ","run_time":7.3e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `file` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"file","resource_params":"[\"/etc/yum.conf\"]"}]},{"id":"SV-204449","title":"The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.","desc":"USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.","descriptions":[{"label":"default","data":"USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity."},{"label":"check","data":"Verify the operating system disables the ability to load the USB Storage kernel module.\n    # grep -r usb-storage /etc/modprobe.d/* | grep -i \"/bin/true\" | grep -v \"^#\"\n    install usb-storage /bin/true\n    If the command does not return any output, or the line is commented out, and use of USB Storage is not documented\n    with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n    Verify the operating system disables the ability to use USB mass storage devices.\n    Check to see if USB mass storage is disabled with the following command:\n    # grep usb-storage /etc/modprobe.d/* | grep -i \"blacklist\" | grep -v \"^#\"\n    blacklist usb-storage\n    If the command does not return any output or the output is not \"blacklist usb-storage\", and use of USB storage\n    devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is\n    a finding."},{"label":"fix","data":"Configure the operating system to disable the ability to use the USB Storage kernel module.\n    Create a file under \"/etc/modprobe.d\" with the following command:\n    # touch /etc/modprobe.d/usb-storage.conf\n    Add the following line to the created file:\n    install usb-storage /bin/true\n    Configure the operating system to disable the ability to use USB mass storage devices.\n    # vi /etc/modprobe.d/blacklist.conf\n    Add or update the line:\n    blacklist usb-storage"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86607","V-71983"],"severity":"medium","gtitle":"SRG-OS-000114-GPOS-00059","satisfies":["SRG-OS-000114-GPOS-00059","SRG-OS-000378-GPOS-00163","SRG-OS-000480-GPOS-00227"],"gid":"V-204449","rid":"SV-204449r853891_rule","stig_id":"RHEL-07-020100","fix_id":"F-4573r462538_fix","cci":["CCI-000366","CCI-000778","CCI-001958"],"nist":["CM-6 b","IA-3","IA-3"],"subsystems":["usb","kernel_module"],"host":null},"code":"control 'SV-204449' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to disable USB mass storage.'\n  desc 'USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity.'\n  desc 'check', 'Verify the operating system disables the ability to load the USB Storage kernel module.\n    # grep -r usb-storage /etc/modprobe.d/* | grep -i \"/bin/true\" | grep -v \"^#\"\n    install usb-storage /bin/true\n    If the command does not return any output, or the line is commented out, and use of USB Storage is not documented\n    with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n    Verify the operating system disables the ability to use USB mass storage devices.\n    Check to see if USB mass storage is disabled with the following command:\n    # grep usb-storage /etc/modprobe.d/* | grep -i \"blacklist\" | grep -v \"^#\"\n    blacklist usb-storage\n    If the command does not return any output or the output is not \"blacklist usb-storage\", and use of USB storage\n    devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is\n    a finding.'\n  desc 'fix', 'Configure the operating system to disable the ability to use the USB Storage kernel module.\n    Create a file under \"/etc/modprobe.d\" with the following command:\n    # touch /etc/modprobe.d/usb-storage.conf\n    Add the following line to the created file:\n    install usb-storage /bin/true\n    Configure the operating system to disable the ability to use USB mass storage devices.\n    # vi /etc/modprobe.d/blacklist.conf\n    Add or update the line:\n    blacklist usb-storage'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86607', 'V-71983']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000114-GPOS-00059'\n  tag satisfies: ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163', 'SRG-OS-000480-GPOS-00227']\n  tag gid: 'V-204449'\n  tag rid: 'SV-204449r853891_rule'\n  tag stig_id: 'RHEL-07-020100'\n  tag fix_id: 'F-4573r462538_fix'\n  tag cci: ['CCI-000366', 'CCI-000778', 'CCI-001958']\n  tag nist: ['CM-6 b', 'IA-3', 'IA-3']\n  tag subsystems: ['usb', 'kernel_module']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_module('usb_storage') do\n      it { should_not be_loaded }\n      it { should be_blacklisted }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204449.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Module usb_storage","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Module usb_storage","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_module","resource_params":"[\"usb_storage\"]"}]},{"id":"SV-204450","title":"The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control\n    Protocol (DCCP) kernel module is disabled unless required.","desc":"Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.","descriptions":[{"label":"default","data":"Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation."},{"label":"check","data":"Verify the operating system disables the ability to load the DCCP kernel module.\n    # grep -r dccp /etc/modprobe.d/* | grep -i \"/bin/true\" | grep -v \"^#\"\n    install dccp /bin/true\n    If the command does not return any output, or the line is commented out, and use of DCCP is not documented with the\n    Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n    Verify the operating system disables the ability to use the DCCP kernel module.\n    Check to see if the DCCP kernel module is disabled with the following command:\n    # grep -i dccp /etc/modprobe.d/* | grep -i \"blacklist\" | grep -v \"^#\"\n    blacklist dccp\n    If the command does not return any output or the output is not \"blacklist dccp\", and use of the dccp kernel module\n    is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a\n    finding."},{"label":"fix","data":"Configure the operating system to disable the ability to use the DCCP kernel module.\n    Create a file under \"/etc/modprobe.d\" with the following command:\n    # touch /etc/modprobe.d/dccp.conf\n    Add the following line to the created file:\n    install dccp /bin/true\n    Ensure that the DCCP module is blacklisted:\n    # vi /etc/modprobe.d/blacklist.conf\n    Add or update the line:\n    blacklist dccp"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-77821","SV-92517"],"severity":"medium","gtitle":"SRG-OS-000378-GPOS-00163","gid":"V-204450","rid":"SV-204450r853892_rule","stig_id":"RHEL-07-020101","fix_id":"F-4574r88543_fix","cci":["CCI-001958"],"nist":["IA-3"],"subsystems":["dccp","kernel_module"],"host":null},"code":"control 'SV-204450' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the Datagram Congestion Control\n    Protocol (DCCP) kernel module is disabled unless required.'\n  desc 'Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.'\n  desc 'check', 'Verify the operating system disables the ability to load the DCCP kernel module.\n    # grep -r dccp /etc/modprobe.d/* | grep -i \"/bin/true\" | grep -v \"^#\"\n    install dccp /bin/true\n    If the command does not return any output, or the line is commented out, and use of DCCP is not documented with the\n    Information System Security Officer (ISSO) as an operational requirement, this is a finding.\n    Verify the operating system disables the ability to use the DCCP kernel module.\n    Check to see if the DCCP kernel module is disabled with the following command:\n    # grep -i dccp /etc/modprobe.d/* | grep -i \"blacklist\" | grep -v \"^#\"\n    blacklist dccp\n    If the command does not return any output or the output is not \"blacklist dccp\", and use of the dccp kernel module\n    is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a\n    finding.'\n  desc 'fix', 'Configure the operating system to disable the ability to use the DCCP kernel module.\n    Create a file under \"/etc/modprobe.d\" with the following command:\n    # touch /etc/modprobe.d/dccp.conf\n    Add the following line to the created file:\n    install dccp /bin/true\n    Ensure that the DCCP module is blacklisted:\n    # vi /etc/modprobe.d/blacklist.conf\n    Add or update the line:\n    blacklist dccp'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-77821', 'SV-92517']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000378-GPOS-00163'\n  tag gid: 'V-204450'\n  tag rid: 'SV-204450r853892_rule'\n  tag stig_id: 'RHEL-07-020101'\n  tag fix_id: 'F-4574r88543_fix'\n  tag cci: ['CCI-001958']\n  tag nist: ['IA-3']\n  tag subsystems: ['dccp', 'kernel_module']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n\n    describe kernel_module('dccp') do\n      it { should_not be_loaded }\n      it { should be_blacklisted }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204450.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Module dccp","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Module dccp","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_module","resource_params":"[\"dccp\"]"}]},{"id":"SV-204451","title":"The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.","desc":"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating\n    malicious activity.","descriptions":[{"label":"default","data":"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating\n    malicious activity."},{"label":"check","data":"Verify the operating system disables the ability to automount devices.\n    Check to see if automounter service is active with the following command:\n    # systemctl status autofs\n    autofs.service - Automounts filesystems on demand\n    Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)\n    Active: inactive (dead)\n    If the \"autofs\" status is set to \"active\" and is not documented with the Information System Security Officer (ISSO)\n    as an operational requirement, this is a finding."},{"label":"fix","data":"Configure the operating system to disable the ability to automount devices.\n    Turn off the automount service with the following commands:\n    # systemctl stop autofs\n    # systemctl disable autofs\n    If \"autofs\" is required for Network File System (NFS), it must be documented with the ISSO."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71985","SV-86609"],"severity":"medium","gtitle":"SRG-OS-000114-GPOS-00059","satisfies":["SRG-OS-000114-GPOS-00059","SRG-OS-000378-GPOS-00163","SRG-OS-000480-GPOS-00227"],"gid":"V-204451","rid":"SV-204451r853893_rule","stig_id":"RHEL-07-020110","fix_id":"F-4575r88546_fix","cci":["CCI-000366","CCI-000778","CCI-001958"],"nist":["CM-6 b","IA-3","IA-3"],"subsystems":["file_system","nfs","autofs"],"host":null,"container":null},"code":"control 'SV-204451' do\n  title 'The Red Hat Enterprise Linux operating system must disable the file system automounter unless required.'\n  desc 'Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating\n    malicious activity.'\n  desc 'check', 'Verify the operating system disables the ability to automount devices.\n    Check to see if automounter service is active with the following command:\n    # systemctl status autofs\n    autofs.service - Automounts filesystems on demand\n    Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)\n    Active: inactive (dead)\n    If the \"autofs\" status is set to \"active\" and is not documented with the Information System Security Officer (ISSO)\n    as an operational requirement, this is a finding.'\n  desc 'fix', 'Configure the operating system to disable the ability to automount devices.\n    Turn off the automount service with the following commands:\n    # systemctl stop autofs\n    # systemctl disable autofs\n    If \"autofs\" is required for Network File System (NFS), it must be documented with the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71985', 'SV-86609']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000114-GPOS-00059'\n  tag satisfies: ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163', 'SRG-OS-000480-GPOS-00227']\n  tag gid: 'V-204451'\n  tag rid: 'SV-204451r853893_rule'\n  tag stig_id: 'RHEL-07-020110'\n  tag fix_id: 'F-4575r88546_fix'\n  tag cci: ['CCI-000366', 'CCI-000778', 'CCI-001958']\n  tag nist: ['CM-6 b', 'IA-3', 'IA-3']\n  tag subsystems: ['file_system', 'nfs', 'autofs']\n  tag 'host'\n  tag 'container'\n\n  describe systemd_service('autofs.service') do\n    it { should_not be_running }\n    it { should_not be_enabled }\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204451.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service autofs.service ","run_time":7.6e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `systemd_service` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"systemd_service","resource_params":"[\"autofs.service\"]"}]},{"id":"SV-204452","title":"The Red Hat Enterprise Linux operating system must remove all software components after updated versions\n    have been installed.","desc":"Previous versions of software components that are not removed from the information system after updates have\n    been installed may be exploited by adversaries. Some information technology products may remove older versions of\n    software automatically from the information system.","descriptions":[{"label":"default","data":"Previous versions of software components that are not removed from the information system after updates have\n    been installed may be exploited by adversaries. Some information technology products may remove older versions of\n    software automatically from the information system."},{"label":"check","data":"Verify the operating system removes all software components after updated versions have been\n    installed.\n    Check if yum is configured to remove unneeded packages with the following command:\n    # grep -i clean_requirements_on_remove /etc/yum.conf\n    clean_requirements_on_remove=1\n    If \"clean_requirements_on_remove\" is not set to \"1\", \"True\", or \"yes\", or is not set in \"/etc/yum.conf\", this is a\n    finding."},{"label":"fix","data":"Configure the operating system to remove all software components after updated versions have been\n    installed.\n    Set the \"clean_requirements_on_remove\" option to \"1\" in the \"/etc/yum.conf\" file:\n    clean_requirements_on_remove=1"}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71987","SV-86611"],"severity":"low","gtitle":"SRG-OS-000437-GPOS-00194","gid":"V-204452","rid":"SV-204452r853894_rule","stig_id":"RHEL-07-020200","fix_id":"F-4576r88549_fix","cci":["CCI-002617"],"nist":["SI-2 (6)"],"subsystems":["yum"],"host":null,"container":null},"code":"control 'SV-204452' do\n  title 'The Red Hat Enterprise Linux operating system must remove all software components after updated versions\n    have been installed.'\n  desc 'Previous versions of software components that are not removed from the information system after updates have\n    been installed may be exploited by adversaries. Some information technology products may remove older versions of\n    software automatically from the information system.'\n  desc 'check', 'Verify the operating system removes all software components after updated versions have been\n    installed.\n    Check if yum is configured to remove unneeded packages with the following command:\n    # grep -i clean_requirements_on_remove /etc/yum.conf\n    clean_requirements_on_remove=1\n    If \"clean_requirements_on_remove\" is not set to \"1\", \"True\", or \"yes\", or is not set in \"/etc/yum.conf\", this is a\n    finding.'\n  desc 'fix', 'Configure the operating system to remove all software components after updated versions have been\n    installed.\n    Set the \"clean_requirements_on_remove\" option to \"1\" in the \"/etc/yum.conf\" file:\n    clean_requirements_on_remove=1'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71987', 'SV-86611']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000437-GPOS-00194'\n  tag gid: 'V-204452'\n  tag rid: 'SV-204452r853894_rule'\n  tag stig_id: 'RHEL-07-020200'\n  tag fix_id: 'F-4576r88549_fix'\n  tag cci: ['CCI-002617']\n  tag nist: ['SI-2 (6)']\n  tag subsystems: ['yum']\n  tag 'host'\n  tag 'container'\n\n  describe parse_config_file('/etc/yum.conf') do\n    its('main.clean_requirements_on_remove') { should match(/1|True|yes/i) }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204452.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/yum.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/yum.conf","skip_message":"Can't find file: /etc/yum.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/yum.conf\"]"}]},{"id":"SV-204453","title":"The Red Hat Enterprise Linux operating system must enable SELinux.","desc":"Without verification of the security functions, security functions may not operate correctly and the failure\n    may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system\n    responsible for enforcing the system security policy and supporting the isolation of code and data on which the\n    protection is based. Security functionality includes, but is not limited to, establishing system accounts,\n    configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting\n    intrusion detection parameters.\n    This requirement applies to operating systems performing security function verification/testing and/or systems and\n    environments that require this functionality.","descriptions":[{"label":"default","data":"Without verification of the security functions, security functions may not operate correctly and the failure\n    may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system\n    responsible for enforcing the system security policy and supporting the isolation of code and data on which the\n    protection is based. Security functionality includes, but is not limited to, establishing system accounts,\n    configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting\n    intrusion detection parameters.\n    This requirement applies to operating systems performing security function verification/testing and/or systems and\n    environments that require this functionality."},{"label":"check","data":"Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in\n    conjunction with SELinux.\n    Verify the operating system verifies correct operation of all security functions.\n    Check if \"SELinux\" is active and in \"Enforcing\" mode with the following command:\n    # getenforce\n    Enforcing\n    If \"SELinux\" is not active and not in \"Enforcing\" mode, this is a finding."},{"label":"fix","data":"Configure the operating system to verify correct operation of all security functions.\n    Set the \"SELinux\" status and the \"Enforcing\" mode by modifying the \"/etc/selinux/config\" file to have the following\n    line:\n    SELINUX=enforcing\n    A reboot is required for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71989","SV-86613"],"severity":"medium","gtitle":"SRG-OS-000445-GPOS-00199","gid":"V-204453","rid":"SV-204453r853895_rule","stig_id":"RHEL-07-020210","fix_id":"F-36306r602628_fix","cci":["CCI-002165","CCI-002696"],"nist":["AC-3 (4)","SI-6 a"],"subsystems":["selinux"],"host":null},"code":"control 'SV-204453' do\n  title 'The Red Hat Enterprise Linux operating system must enable SELinux.'\n  desc 'Without verification of the security functions, security functions may not operate correctly and the failure\n    may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system\n    responsible for enforcing the system security policy and supporting the isolation of code and data on which the\n    protection is based. Security functionality includes, but is not limited to, establishing system accounts,\n    configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting\n    intrusion detection parameters.\n    This requirement applies to operating systems performing security function verification/testing and/or systems and\n    environments that require this functionality.'\n  desc 'check', 'Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in\n    conjunction with SELinux.\n    Verify the operating system verifies correct operation of all security functions.\n    Check if \"SELinux\" is active and in \"Enforcing\" mode with the following command:\n    # getenforce\n    Enforcing\n    If \"SELinux\" is not active and not in \"Enforcing\" mode, this is a finding.'\n  desc 'fix', 'Configure the operating system to verify correct operation of all security functions.\n    Set the \"SELinux\" status and the \"Enforcing\" mode by modifying the \"/etc/selinux/config\" file to have the following\n    line:\n    SELINUX=enforcing\n    A reboot is required for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71989', 'SV-86613']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000445-GPOS-00199'\n  tag gid: 'V-204453'\n  tag rid: 'SV-204453r853895_rule'\n  tag stig_id: 'RHEL-07-020210'\n  tag fix_id: 'F-36306r602628_fix'\n  tag cci: ['CCI-002165', 'CCI-002696']\n  tag nist: ['AC-3 (4)', 'SI-6 a']\n  tag subsystems: ['selinux']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - SELinux settings must be handled on host' do\n      skip 'Control not applicable - SELinux settings must be handled on host'\n    end\n  else\n    describe command('getenforce') do\n      its('stdout.strip') { should eq 'Enforcing' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204453.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `getenforce` ","run_time":7.5e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"getenforce\"]"}]},{"id":"SV-204454","title":"The Red Hat Enterprise Linux operating system must enable the SELinux targeted policy.","desc":"Without verification of the security functions, security functions may not operate correctly and the failure\n    may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system\n    responsible for enforcing the system security policy and supporting the isolation of code and data on which the\n    protection is based. Security functionality includes, but is not limited to, establishing system accounts,\n    configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting\n    intrusion detection parameters.\n    This requirement applies to operating systems performing security function verification/testing and/or systems and\n    environments that require this functionality.","descriptions":[{"label":"default","data":"Without verification of the security functions, security functions may not operate correctly and the failure\n    may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system\n    responsible for enforcing the system security policy and supporting the isolation of code and data on which the\n    protection is based. Security functionality includes, but is not limited to, establishing system accounts,\n    configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting\n    intrusion detection parameters.\n    This requirement applies to operating systems performing security function verification/testing and/or systems and\n    environments that require this functionality."},{"label":"check","data":"Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in\n    conjunction with SELinux.\n    Verify the operating system verifies correct operation of all security functions.\n    Check if \"SELinux\" is active and is enforcing the targeted policy with the following command:\n    # sestatus\n    SELinux status: enabled\n    SELinuxfs mount: /selinux\n    SELinux root directory: /etc/selinux\n    Loaded policy name: targeted\n    Current mode: enforcing\n    Mode from config file: enforcing\n    Policy MLS status: enabled\n    Policy deny_unknown status: allowed\n    Max kernel policy version: 28\n    If the \"Loaded policy name\" is not set to \"targeted\", this is a finding.\n    Verify that the /etc/selinux/config file is configured to the \"SELINUXTYPE\" to \"targeted\":\n    # grep -i \"selinuxtype\" /etc/selinux/config | grep -v '^#'\n    SELINUXTYPE = targeted\n    If no results are returned or \"SELINUXTYPE\" is not set to \"targeted\", this is a finding."},{"label":"fix","data":"Configure the operating system to verify correct operation of all security functions.\n    Set the \"SELinuxtype\" to the \"targeted\" policy by modifying the \"/etc/selinux/config\" file to have the following\n    line:\n    SELINUXTYPE=targeted\n    A reboot is required for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-71991","SV-86615"],"severity":"medium","gtitle":"SRG-OS-000445-GPOS-00199","gid":"V-204454","rid":"SV-204454r853896_rule","stig_id":"RHEL-07-020220","fix_id":"F-36307r602631_fix","cci":["CCI-002165","CCI-002696"],"nist":["AC-3 (4)","SI-6 a"],"subsystems":["selinux"],"host":null},"code":"control 'SV-204454' do\n  title 'The Red Hat Enterprise Linux operating system must enable the SELinux targeted policy.'\n  desc 'Without verification of the security functions, security functions may not operate correctly and the failure\n    may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system\n    responsible for enforcing the system security policy and supporting the isolation of code and data on which the\n    protection is based. Security functionality includes, but is not limited to, establishing system accounts,\n    configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting\n    intrusion detection parameters.\n    This requirement applies to operating systems performing security function verification/testing and/or systems and\n    environments that require this functionality.'\n  desc 'check', %q(Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in\n    conjunction with SELinux.\n    Verify the operating system verifies correct operation of all security functions.\n    Check if \"SELinux\" is active and is enforcing the targeted policy with the following command:\n    # sestatus\n    SELinux status: enabled\n    SELinuxfs mount: /selinux\n    SELinux root directory: /etc/selinux\n    Loaded policy name: targeted\n    Current mode: enforcing\n    Mode from config file: enforcing\n    Policy MLS status: enabled\n    Policy deny_unknown status: allowed\n    Max kernel policy version: 28\n    If the \"Loaded policy name\" is not set to \"targeted\", this is a finding.\n    Verify that the /etc/selinux/config file is configured to the \"SELINUXTYPE\" to \"targeted\":\n    # grep -i \"selinuxtype\" /etc/selinux/config | grep -v '^#'\n    SELINUXTYPE = targeted\n    If no results are returned or \"SELINUXTYPE\" is not set to \"targeted\", this is a finding.)\n  desc 'fix', 'Configure the operating system to verify correct operation of all security functions.\n    Set the \"SELinuxtype\" to the \"targeted\" policy by modifying the \"/etc/selinux/config\" file to have the following\n    line:\n    SELINUXTYPE=targeted\n    A reboot is required for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-71991', 'SV-86615']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000445-GPOS-00199'\n  tag gid: 'V-204454'\n  tag rid: 'SV-204454r853896_rule'\n  tag stig_id: 'RHEL-07-020220'\n  tag fix_id: 'F-36307r602631_fix'\n  tag cci: ['CCI-002165', 'CCI-002696']\n  tag nist: ['AC-3 (4)', 'SI-6 a']\n  tag subsystems: ['selinux']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - SELinux settings must be handled on host' do\n      skip 'Control not applicable - SELinux settings must be handled on host'\n    end\n  else\n    describe command('sestatus') do\n      its('stdout') { should match(/^Loaded\\spolicy\\sname:\\s+targeted\\n?$/) }\n    end\n    describe parse_config_file('/etc/selinux/config') do\n      its('SELINUXTYPE') { should eq 'targeted' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204454.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `sestatus` ","run_time":7.2e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"sestatus\"]"},{"status":"skipped","code_desc":"Parse Config File /etc/selinux/config","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/selinux/config","skip_message":"Can't find file: /etc/selinux/config","resource_class":"parse_config_file","resource_params":"[\"/etc/selinux/config\"]"}]},{"id":"SV-204455","title":"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key\n    sequence is disabled on the command line.","desc":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If\n    accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term\n    loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of\n    unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any\n    action is taken.","descriptions":[{"label":"default","data":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If\n    accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term\n    loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of\n    unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any\n    action is taken."},{"label":"check","data":"Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\n\nCheck that the ctrl-alt-del.target is masked and not active with the following command:\n\n$ sudo systemctl status ctrl-alt-del.target\n\nctrl-alt-del.target\nLoaded: masked (/dev/null; bad)\nActive: inactive (dead)\n\nIf the ctrl-alt-del.target is not masked, this is a finding.\n\nIf the ctrl-alt-del.target is active, this is a finding."},{"label":"fix","data":"Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following commands:\n\n$ sudo systemctl disable ctrl-alt-del.target\n\n$ sudo systemctl mask ctrl-alt-del.target"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86617","V-71993"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204455","rid":"SV-204455r833106_rule","stig_id":"RHEL-07-020230","fix_id":"F-4579r833105_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["gui","general"],"host":null},"code":"control 'SV-204455' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key\n    sequence is disabled on the command line.'\n  desc 'A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If\n    accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term\n    loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of\n    unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any\n    action is taken.'\n  desc 'check', 'Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\n\nCheck that the ctrl-alt-del.target is masked and not active with the following command:\n\n$ sudo systemctl status ctrl-alt-del.target\n\nctrl-alt-del.target\nLoaded: masked (/dev/null; bad)\nActive: inactive (dead)\n\nIf the ctrl-alt-del.target is not masked, this is a finding.\n\nIf the ctrl-alt-del.target is active, this is a finding.'\n  desc 'fix', 'Configure the system to disable the Ctrl-Alt-Delete sequence for the command line with the following commands:\n\n$ sudo systemctl disable ctrl-alt-del.target\n\n$ sudo systemctl mask ctrl-alt-del.target'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86617', 'V-71993']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204455'\n  tag rid: 'SV-204455r833106_rule'\n  tag stig_id: 'RHEL-07-020230'\n  tag fix_id: 'F-4579r833105_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['gui', 'general']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    describe systemd_service('ctrl-alt-del.target') do\n      it { should_not be_running }\n      it { should_not be_enabled }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204455.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service ctrl-alt-del.target ","run_time":7.3e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `systemd_service` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"systemd_service","resource_params":"[\"ctrl-alt-del.target\"]"}]},{"id":"SV-204456","title":"The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key\n    sequence is disabled in the Graphical User Interface.","desc":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If\n    accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term\n    loss of availability of systems due to unintentional reboot. In the graphical environment, risk of unintentional\n    reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.","descriptions":[{"label":"default","data":"A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If\n    accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term\n    loss of availability of systems due to unintentional reboot. In the graphical environment, risk of unintentional\n    reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken."},{"label":"check","data":"Note: If the operating system does not have a graphical user interface installed, this requirement\n    is Not Applicable.\n    Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\n    Check that the ctrl-alt-del.target is masked and not active in the graphical user interface with the following\n    command:\n    # grep logout /etc/dconf/db/local.d/*\n    logout=''\n    If \"logout\" is not set to use two single quotations, or is missing, this is a finding."},{"label":"fix","data":"Configure the system to disable the Ctrl-Alt-Delete sequence for the graphical user interface with the\n    following command:\n    # touch /etc/dconf/db/local.d/00-disable-CAD\n    Add the setting to disable the Ctrl-Alt-Delete sequence for the graphical user interface:\n    [org/gnome/settings-daemon/plugins/media-keys]\n    logout=''"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-94843","SV-104673"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204456","rid":"SV-204456r603261_rule","stig_id":"RHEL-07-020231","fix_id":"F-4580r590041_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["gui","general"],"host":null},"code":"control 'SV-204456' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key\n    sequence is disabled in the Graphical User Interface.'\n  desc 'A locally logged-on user who presses Ctrl-Alt-Delete, when at the console, can reboot the system. If\n    accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term\n    loss of availability of systems due to unintentional reboot. In the graphical environment, risk of unintentional\n    reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.'\n  desc 'check', %q(Note: If the operating system does not have a graphical user interface installed, this requirement\n    is Not Applicable.\n    Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed.\n    Check that the ctrl-alt-del.target is masked and not active in the graphical user interface with the following\n    command:\n    # grep logout /etc/dconf/db/local.d/*\n    logout=''\n    If \"logout\" is not set to use two single quotations, or is missing, this is a finding.)\n  desc 'fix', \"Configure the system to disable the Ctrl-Alt-Delete sequence for the graphical user interface with the\n    following command:\n    # touch /etc/dconf/db/local.d/00-disable-CAD\n    Add the setting to disable the Ctrl-Alt-Delete sequence for the graphical user interface:\n    [org/gnome/settings-daemon/plugins/media-keys]\n    logout=''\"\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-94843', 'SV-104673']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204456'\n  tag rid: 'SV-204456r603261_rule'\n  tag stig_id: 'RHEL-07-020231'\n  tag fix_id: 'F-4580r590041_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['gui', 'general']\n  tag 'host'\n\n  if package('gnome-settings-daemon').installed?\n    describe command('gsettings get org.gnome.settings-daemon.media-keys logout') do\n      its('stdout.strip') { should cmp \"''\" }\n    end\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n      Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204456.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n      Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204457","title":"The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users\n    in such a way that the user can only read and modify their own files.","desc":"Setting the most restrictive default permissions ensures that when new accounts are created, they do not\n    have unnecessary access.","descriptions":[{"label":"default","data":"Setting the most restrictive default permissions ensures that when new accounts are created, they do not\n    have unnecessary access."},{"label":"check","data":"Verify the operating system defines default permissions for all authenticated users in such a way\n    that the user can only read and modify their own files.\n    Check for the value of the \"UMASK\" parameter in \"/etc/login.defs\" file with the following command:\n    Note: If the value of the \"UMASK\" parameter is set to \"000\" in \"/etc/login.defs\" file, the Severity is raised to a\n    CAT I.\n    # grep -i umask /etc/login.defs\n    UMASK  077\n    If the value for the \"UMASK\" parameter is not \"077\", or the \"UMASK\" parameter is missing or is commented out, this\n    is a finding."},{"label":"fix","data":"Configure the operating system to define default permissions for all authenticated users in such a way\n    that the user can only read and modify their own files.\n    Add or edit the line for the \"UMASK\" parameter in \"/etc/login.defs\" file to \"077\":\n    UMASK  077"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86619","V-71995"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00228","gid":"V-204457","rid":"SV-204457r603261_rule","stig_id":"RHEL-07-020240","fix_id":"F-4581r88564_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["login_defs"],"host":null,"container":null},"code":"control 'SV-204457' do\n  title 'The Red Hat Enterprise Linux operating system must define default permissions for all authenticated users\n    in such a way that the user can only read and modify their own files.'\n  desc 'Setting the most restrictive default permissions ensures that when new accounts are created, they do not\n    have unnecessary access.'\n  desc 'check', 'Verify the operating system defines default permissions for all authenticated users in such a way\n    that the user can only read and modify their own files.\n    Check for the value of the \"UMASK\" parameter in \"/etc/login.defs\" file with the following command:\n    Note: If the value of the \"UMASK\" parameter is set to \"000\" in \"/etc/login.defs\" file, the Severity is raised to a\n    CAT I.\n    # grep -i umask /etc/login.defs\n    UMASK  077\n    If the value for the \"UMASK\" parameter is not \"077\", or the \"UMASK\" parameter is missing or is commented out, this\n    is a finding.'\n  desc 'fix', 'Configure the operating system to define default permissions for all authenticated users in such a way\n    that the user can only read and modify their own files.\n    Add or edit the line for the \"UMASK\" parameter in \"/etc/login.defs\" file to \"077\":\n    UMASK  077'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86619', 'V-71995']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00228'\n  tag gid: 'V-204457'\n  tag rid: 'SV-204457r603261_rule'\n  tag stig_id: 'RHEL-07-020240'\n  tag fix_id: 'F-4581r88564_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['login_defs']\n  tag 'host'\n  tag 'container'\n\n  if login_defs.read_params['UMASK'].eql?('000')\n    impact 0.5\n  else\n    impact 0.5\n  end\n  describe login_defs do\n    its('UMASK') { should eq '077' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204457.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"login.defs","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"login.defs","skip_message":"Can't find file: /etc/login.defs","resource_class":"login_defs","resource_params":"[]"}]},{"id":"SV-204458","title":"The Red Hat Enterprise Linux operating system must be a vendor supported release.","desc":"An operating system release is considered \"supported\" if the vendor continues to provide security patches\n    for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the\n    system software.\n    Red Hat offers the Extended Update Support (EUS) Add-On to a Red Hat Enterprise Linux subscription, for a fee, for\n    those customers who wish to standardize on a specific minor release for an extended period. RHEL 7.7 marks the final\n    minor release that EUS will be available, while 7.9 is the final minor release overall.","descriptions":[{"label":"default","data":"An operating system release is considered \"supported\" if the vendor continues to provide security patches\n    for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the\n    system software.\n    Red Hat offers the Extended Update Support (EUS) Add-On to a Red Hat Enterprise Linux subscription, for a fee, for\n    those customers who wish to standardize on a specific minor release for an extended period. RHEL 7.7 marks the final\n    minor release that EUS will be available, while 7.9 is the final minor release overall."},{"label":"check","data":"Verify the version of the operating system is vendor supported.\n    Check the version of the operating system with the following command:\n    # cat /etc/redhat-release\n    Red Hat Enterprise Linux Server release 7.9 (Maipo)\n    Current End of Extended Update Support for RHEL 7.6 is 31 May 2021.\n    Current End of Extended Update Support for RHEL 7.7 is 30 August 2021.\n    Current End of Maintenance Support for RHEL 7.9 is 30 June 2024.\n    If the release is not supported by the vendor, this is a finding."},{"label":"fix","data":"Upgrade to a supported version of the operating system."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86621","V-71997"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204458","rid":"SV-204458r744100_rule","stig_id":"RHEL-07-020250","fix_id":"F-4582r462547_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["redhat_release"],"host":null,"container":null},"code":"control 'SV-204458' do\n  title 'The Red Hat Enterprise Linux operating system must be a vendor supported release.'\n  desc 'An operating system release is considered \"supported\" if the vendor continues to provide security patches\n    for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the\n    system software.\n    Red Hat offers the Extended Update Support (EUS) Add-On to a Red Hat Enterprise Linux subscription, for a fee, for\n    those customers who wish to standardize on a specific minor release for an extended period. RHEL 7.7 marks the final\n    minor release that EUS will be available, while 7.9 is the final minor release overall.'\n  desc 'check', 'Verify the version of the operating system is vendor supported.\n    Check the version of the operating system with the following command:\n    # cat /etc/redhat-release\n    Red Hat Enterprise Linux Server release 7.9 (Maipo)\n    Current End of Extended Update Support for RHEL 7.6 is 31 May 2021.\n    Current End of Extended Update Support for RHEL 7.7 is 30 August 2021.\n    Current End of Maintenance Support for RHEL 7.9 is 30 June 2024.\n    If the release is not supported by the vendor, this is a finding.'\n  desc 'fix', 'Upgrade to a supported version of the operating system.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86621', 'V-71997']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204458'\n  tag rid: 'SV-204458r744100_rule'\n  tag stig_id: 'RHEL-07-020250'\n  tag fix_id: 'F-4582r462547_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['redhat_release']\n  tag 'host'\n  tag 'container'\n\n  release = os.release\n\n  EOMS_DATE = case release\n              when /^7\\.6/\n                '31 May 2021'\n              when /^7\\.7/\n                '30 August 2021'\n              when /^7\\.9/\n                '30 June 2024'\n              end\n\n  describe \"The release \\\"#{release}\\\" must still be within the support window, ending #{EOMS_DATE}\" do\n    subject { Date.today <= Date.parse(EOMS_DATE) }\n    it { should be true }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204458.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"The release \"unknown\" must still be within the support window, ending  ","run_time":0.0013,"start_time":"2023-04-18T13:20:14-04:00","message":"no implicit conversion of nil into String","exception":"TypeError","backtrace":["./controls/SV-204458.rb:45:in `parse'","./controls/SV-204458.rb:45:in `block (3 levels) in load_with_context'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:343:in `block (2 levels) in let'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:179:in `block (3 levels) in fetch_or_store'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:179:in `fetch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:179:in `block (2 levels) in fetch_or_store'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-support-3.11.0/lib/rspec/support/reentrant_mutex.rb:23:in `synchronize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:178:in `block in fetch_or_store'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:177:in `fetch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:177:in `fetch_or_store'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:343:in `block in let'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/memoized_helpers.rb:82:in `should'","./controls/SV-204458.rb:46:in `block (3 levels) in load_with_context'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204459","title":"The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to\n    date.","desc":"Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of\n    information technology (IT) systems. However, failure to keep operating system and application software patched is a\n    common mistake made by IT professionals. New patches are released daily, and it is often difficult for even\n    experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system\n    exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches\n    and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The\n    lack of prompt attention to patching could result in a system compromise.","descriptions":[{"label":"default","data":"Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of\n    information technology (IT) systems. However, failure to keep operating system and application software patched is a\n    common mistake made by IT professionals. New patches are released daily, and it is often difficult for even\n    experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system\n    exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches\n    and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The\n    lack of prompt attention to patching could result in a system compromise."},{"label":"check","data":"Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). \n\nObtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.\n\nCheck that the available package security updates have been installed on the system with the following command:\n\n# yum history list | more\nLoaded plugins: langpacks, product-id, subscription-manager\nID     | Command line             | Date and time    | Action(s)      | Altered\n-------------------------------------------------------------------------------\n    70 | install aide             | 2016-05-05 10:58 | Install       |     1   \n    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE\n    68 | install vlc                | 2016-04-21 17:12 | Install        |   21   \n    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE\n    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE\n\nIf package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding. \n\nTypical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.\n\nIf the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding."},{"label":"fix","data":"Install the operating system patches or updated packages available from Red Hat within 30 days or\n    sooner as local policy dictates."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86623","V-71999"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204459","rid":"SV-204459r603261_rule","stig_id":"RHEL-07-020260","fix_id":"F-4583r88570_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["packages"],"host":null,"container":null},"code":"control 'SV-204459' do\n  title 'The Red Hat Enterprise Linux operating system security patches and updates must be installed and up to\n    date.'\n  desc 'Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of\n    information technology (IT) systems. However, failure to keep operating system and application software patched is a\n    common mistake made by IT professionals. New patches are released daily, and it is often difficult for even\n    experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system\n    exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches\n    and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The\n    lack of prompt attention to patching could result in a system compromise.'\n  desc 'check', 'Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). \n\nObtain the list of available package security updates from Red Hat. The URL for updates is https://rhn.redhat.com/errata/. It is important to note that updates provided by Red Hat may not be present on the system if the underlying packages are not installed.\n\nCheck that the available package security updates have been installed on the system with the following command:\n\n# yum history list | more\nLoaded plugins: langpacks, product-id, subscription-manager\nID     | Command line             | Date and time    | Action(s)      | Altered\n-------------------------------------------------------------------------------\n    70 | install aide             | 2016-05-05 10:58 | Install       |     1   \n    69 | update -y                | 2016-05-04 14:34 | Update     |   18 EE\n    68 | install vlc                | 2016-04-21 17:12 | Install        |   21   \n    67 | update -y                | 2016-04-21 17:04 | Update     |     7 EE\n    66 | update -y                | 2016-04-15 16:47 | E, I, U         |   84 EE\n\nIf package updates have not been performed on the system within the timeframe that the site/program documentation requires, this is a finding. \n\nTypical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM.\n\nIf the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.'\n  desc 'fix', 'Install the operating system patches or updated packages available from Red Hat within 30 days or\n    sooner as local policy dictates.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86623', 'V-71999']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204459'\n  tag rid: 'SV-204459r603261_rule'\n  tag stig_id: 'RHEL-07-020260'\n  tag fix_id: 'F-4583r88570_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['packages']\n  tag 'host'\n  tag 'container'\n\n  if input('disconnected_system')\n    describe \"The system is set to a `disconnected` state and you must validate\n                the state of the system packages manually\" do\n      skip \"The system is set to a `disconnected` state and you must validate\n        the state of the system packages manually, or through another process, if you\n        have an established update and patch process, please set this control as\n        `Not Applicable` with a `caevat` via an overlay.\"\n    end\n  else\n    updates = linux_update.updates\n    package_names = updates.map { |h| h['name'] }\n\n    describe.one do\n      describe 'List of out-of-date packages' do\n        subject { package_names }\n        it { should be_empty }\n      end\n\n      updates.each do |update|\n        describe package(update['name']) do\n          its('version') { should eq update['version'] }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204459.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"List of out-of-date packages is expected to be empty","run_time":0.000212,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204460","title":"The Red Hat Enterprise Linux operating system must not have unnecessary accounts.","desc":"Accounts providing no operational purpose provide additional opportunities for system compromise.\n    Unnecessary accounts include user accounts for individuals not requiring access to the system and application\n    accounts for applications not installed on the system.","descriptions":[{"label":"default","data":"Accounts providing no operational purpose provide additional opportunities for system compromise.\n    Unnecessary accounts include user accounts for individuals not requiring access to the system and application\n    accounts for applications not installed on the system."},{"label":"check","data":"Verify all accounts on the system are assigned to an active system, application, or user account.\n    Obtain the list of authorized system accounts from the Information System Security Officer (ISSO).\n    Check the system accounts on the system with the following command:\n    # more /etc/passwd\n    root:x:0:0:root:/root:/bin/bash\n    bin:x:1:1:bin:/bin:/sbin/nologin\n    daemon:x:2:2:daemon:/sbin:/sbin/nologin\n    sync:x:5:0:sync:/sbin:/bin/sync\n    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\n    halt:x:7:0:halt:/sbin:/sbin/halt\n    games:x:12:100:games:/usr/games:/sbin/nologin\n    gopher:x:13:30:gopher:/var/gopher:/sbin/nologin\n    Accounts such as \"games\" and \"gopher\" are not authorized accounts as they do not support authorized system\n    functions.\n    If the accounts on the system do not match the provided documentation, or accounts that do not support an authorized\n    system function are present, this is a finding."},{"label":"fix","data":"Configure the system so all accounts on the system are assigned to an active system, application, or\n    user account.\n    Remove accounts that do not support approved system activities or that allow for a normal user to perform\n    administrative-level actions.\n    Document all authorized accounts on the system."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86625","V-72001"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204460","rid":"SV-204460r603261_rule","stig_id":"RHEL-07-020270","fix_id":"F-4584r88573_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["accounts"],"host":null,"container":null},"code":"control 'SV-204460' do\n  title 'The Red Hat Enterprise Linux operating system must not have unnecessary accounts.'\n  desc 'Accounts providing no operational purpose provide additional opportunities for system compromise.\n    Unnecessary accounts include user accounts for individuals not requiring access to the system and application\n    accounts for applications not installed on the system.'\n  desc 'check', 'Verify all accounts on the system are assigned to an active system, application, or user account.\n    Obtain the list of authorized system accounts from the Information System Security Officer (ISSO).\n    Check the system accounts on the system with the following command:\n    # more /etc/passwd\n    root:x:0:0:root:/root:/bin/bash\n    bin:x:1:1:bin:/bin:/sbin/nologin\n    daemon:x:2:2:daemon:/sbin:/sbin/nologin\n    sync:x:5:0:sync:/sbin:/bin/sync\n    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\n    halt:x:7:0:halt:/sbin:/sbin/halt\n    games:x:12:100:games:/usr/games:/sbin/nologin\n    gopher:x:13:30:gopher:/var/gopher:/sbin/nologin\n    Accounts such as \"games\" and \"gopher\" are not authorized accounts as they do not support authorized system\n    functions.\n    If the accounts on the system do not match the provided documentation, or accounts that do not support an authorized\n    system function are present, this is a finding.'\n  desc 'fix', 'Configure the system so all accounts on the system are assigned to an active system, application, or\n    user account.\n    Remove accounts that do not support approved system activities or that allow for a normal user to perform\n    administrative-level actions.\n    Document all authorized accounts on the system.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86625', 'V-72001']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204460'\n  tag rid: 'SV-204460r603261_rule'\n  tag stig_id: 'RHEL-07-020270'\n  tag fix_id: 'F-4584r88573_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['accounts']\n  tag 'host'\n  tag 'container'\n\n  known_system_accounts = input('known_system_accounts')\n  user_accounts = input('user_accounts')\n\n  allowed_accounts = (known_system_accounts + user_accounts).uniq\n  describe 'All user accounts' do\n    it 'are known system accounts or known user accounts' do\n      fail_msg = \"Accounts not part of the known account lists: #{(passwd.users - allowed_accounts).join(', ')}\"\n      expect(passwd.users).to all(be_in allowed_accounts), fail_msg\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204460.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"All user accounts are known system accounts or known user accounts","run_time":0.003884,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204461","title":"The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs)\n    referenced in the /etc/passwd file are defined in the /etc/group file.","desc":"If a user is assigned the GID of a group not existing on the system, and a group with the GID is\n    subsequently created, the user may have unintended rights to any files associated with the group.","descriptions":[{"label":"default","data":"If a user is assigned the GID of a group not existing on the system, and a group with the GID is\n    subsequently created, the user may have unintended rights to any files associated with the group."},{"label":"check","data":"Verify all GIDs referenced in the \"/etc/passwd\" file are defined in the \"/etc/group\" file.\n    Check that all referenced GIDs exist with the following command:\n    # pwck -r\n    If GIDs referenced in \"/etc/passwd\" file are returned as not defined in \"/etc/group\" file, this is a finding."},{"label":"fix","data":"Configure the system to define all GIDs found in the \"/etc/passwd\" file by modifying the \"/etc/group\"\n    file to add any non-existent group referenced in the \"/etc/passwd\" file, or change the GIDs referenced in the\n    \"/etc/passwd\" file to a group that exists in \"/etc/group\"."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72003","SV-86627"],"severity":"low","gtitle":"SRG-OS-000104-GPOS-00051","gid":"V-204461","rid":"SV-204461r603261_rule","stig_id":"RHEL-07-020300","fix_id":"F-4585r88576_fix","cci":["CCI-000764"],"nist":["IA-2"],"subsystems":["accounts"],"host":null,"container":null},"code":"control 'SV-204461' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all Group Identifiers (GIDs)\n    referenced in the /etc/passwd file are defined in the /etc/group file.'\n  desc 'If a user is assigned the GID of a group not existing on the system, and a group with the GID is\n    subsequently created, the user may have unintended rights to any files associated with the group.'\n  desc 'check', 'Verify all GIDs referenced in the \"/etc/passwd\" file are defined in the \"/etc/group\" file.\n    Check that all referenced GIDs exist with the following command:\n    # pwck -r\n    If GIDs referenced in \"/etc/passwd\" file are returned as not defined in \"/etc/group\" file, this is a finding.'\n  desc 'fix', 'Configure the system to define all GIDs found in the \"/etc/passwd\" file by modifying the \"/etc/group\"\n    file to add any non-existent group referenced in the \"/etc/passwd\" file, or change the GIDs referenced in the\n    \"/etc/passwd\" file to a group that exists in \"/etc/group\".'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72003', 'SV-86627']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000104-GPOS-00051'\n  tag gid: 'V-204461'\n  tag rid: 'SV-204461r603261_rule'\n  tag stig_id: 'RHEL-07-020300'\n  tag fix_id: 'F-4585r88576_fix'\n  tag cci: ['CCI-000764']\n  tag nist: ['IA-2']\n  tag subsystems: ['accounts']\n  tag 'host'\n  tag 'container'\n\n  describe 'All group identifiers in /etc/passwd' do\n    it 'should be defined in /etc/groups' do\n      expect(passwd.gids.map { |gid| gid.to_i }).to all(be_in etc_group.gids),\n        \"missing gids: #{passwd.gids.select { |gid| !etc_group.gids.include?(gid.to_i) }}\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204461.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"All group identifiers in /etc/passwd should be defined in /etc/groups","run_time":0.004151,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204462","title":"The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only\n    account having unrestricted access to the system.","desc":"If an account other than root also has a User Identifier (UID) of \"0\", it has root authority, giving that\n    account unrestricted access to the entire operating system. Multiple accounts with a UID of \"0\" afford an\n    opportunity for potential intruders to guess a password for a privileged account.","descriptions":[{"label":"default","data":"If an account other than root also has a User Identifier (UID) of \"0\", it has root authority, giving that\n    account unrestricted access to the entire operating system. Multiple accounts with a UID of \"0\" afford an\n    opportunity for potential intruders to guess a password for a privileged account."},{"label":"check","data":"Check the system for duplicate UID \"0\" assignments with the following command:\n    # awk -F: '$3 == 0 {print $1}' /etc/passwd\n    If any accounts other than root have a UID of \"0\", this is a finding."},{"label":"fix","data":"Change the UID of any account on the system, other than root, that has a UID of \"0\".\n    If the account is associated with system commands or applications, the UID should be changed to one greater than \"0\"\n    but less than \"1000\". Otherwise, assign a UID of greater than \"1000\" that has not already been assigned."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86629","V-72005"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204462","rid":"SV-204462r603261_rule","stig_id":"RHEL-07-020310","fix_id":"F-4586r88579_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["accounts"],"host":null,"container":null},"code":"control 'SV-204462' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the root account must be the only\n    account having unrestricted access to the system.'\n  desc 'If an account other than root also has a User Identifier (UID) of \"0\", it has root authority, giving that\n    account unrestricted access to the entire operating system. Multiple accounts with a UID of \"0\" afford an\n    opportunity for potential intruders to guess a password for a privileged account.'\n  desc 'check', %q(Check the system for duplicate UID \"0\" assignments with the following command:\n    # awk -F: '$3 == 0 {print $1}' /etc/passwd\n    If any accounts other than root have a UID of \"0\", this is a finding.)\n  desc 'fix', 'Change the UID of any account on the system, other than root, that has a UID of \"0\".\n    If the account is associated with system commands or applications, the UID should be changed to one greater than \"0\"\n    but less than \"1000\". Otherwise, assign a UID of greater than \"1000\" that has not already been assigned.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86629', 'V-72005']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204462'\n  tag rid: 'SV-204462r603261_rule'\n  tag stig_id: 'RHEL-07-020310'\n  tag fix_id: 'F-4586r88579_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['accounts']\n  tag 'host'\n  tag 'container'\n\n  describe passwd.uids(0) do\n    its('users') { should cmp 'root' }\n    its('entries.length') { should eq 1 }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204462.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"/etc/passwd with uid == 0","run_time":8.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"/etc/passwd with uid == 0","skip_message":"Can't find file: /etc/passwd","resource_class":"FilterTable::Table","resource_params":"[]"}]},{"id":"SV-204463","title":"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a\n    valid owner.","desc":"Unowned files and directories may be unintentionally inherited if a user is assigned the same User\n    Identifier \"UID\" as the UID of the un-owned files.","descriptions":[{"label":"default","data":"Unowned files and directories may be unintentionally inherited if a user is assigned the same User\n    Identifier \"UID\" as the UID of the un-owned files."},{"label":"check","data":"Verify all files and directories on the system have a valid owner.\n    Check the owner of all files and directories with the following command:\n    Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n    # find / -fstype xfs -nouser\n    If any files on the system do not have an assigned owner, this is a finding."},{"label":"fix","data":"Either remove all files and directories from the system that do not have a valid user, or assign a\n    valid user to all unowned files and directories on the system with the \"chown\" command:\n    # chown <user> <file>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86631","V-72007"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204463","rid":"SV-204463r853897_rule","stig_id":"RHEL-07-020320","fix_id":"F-4587r88582_fix","cci":["CCI-002165"],"nist":["AC-3 (4)"],"subsystems":["file_system","users","files"],"host":null,"container":null},"code":"control 'SV-204463' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a\n    valid owner.'\n  desc 'Unowned files and directories may be unintentionally inherited if a user is assigned the same User\n    Identifier \"UID\" as the UID of the un-owned files.'\n  desc 'check', 'Verify all files and directories on the system have a valid owner.\n    Check the owner of all files and directories with the following command:\n    Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n    # find / -fstype xfs -nouser\n    If any files on the system do not have an assigned owner, this is a finding.'\n  desc 'fix', 'Either remove all files and directories from the system that do not have a valid user, or assign a\n    valid user to all unowned files and directories on the system with the \"chown\" command:\n    # chown <user> <file>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86631', 'V-72007']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204463'\n  tag rid: 'SV-204463r853897_rule'\n  tag stig_id: 'RHEL-07-020320'\n  tag fix_id: 'F-4587r88582_fix'\n  tag cci: ['CCI-002165']\n  tag nist: ['AC-3 (4)']\n  tag subsystems: ['file_system', 'users', 'files']\n  tag 'host'\n  tag 'container'\n\n  command('grep -v \"nodev\" /proc/filesystems | awk \\'NF{ print $NF }\\'')\n    .stdout.strip.split(\"\\n\").each do |fs|\n      describe command(\"find / -xdev -xautofs -fstype #{fs} -nouser\") do\n        its('stdout.strip') { should be_empty }\n      end\n    end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204463.rb"},"waiver_data":{},"results":[]},{"id":"SV-204464","title":"The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a\n    valid group owner.","desc":"Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group\n    Identifier (GID) as the GID of the files without a valid group owner.","descriptions":[{"label":"default","data":"Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group\n    Identifier (GID) as the GID of the files without a valid group owner."},{"label":"check","data":"Verify all files and directories on the system have a valid group.\n    Check the owner of all files and directories with the following command:\n    Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n    # find / -fstype xfs -nogroup\n    If any files on the system do not have an assigned group, this is a finding."},{"label":"fix","data":"Either remove all files and directories from the system that do not have a valid group, or assign a\n    valid group to all files and directories on the system with the \"chgrp\" command:\n    # chgrp <group> <file>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72009","SV-86633"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204464","rid":"SV-204464r853898_rule","stig_id":"RHEL-07-020330","fix_id":"F-4588r88585_fix","cci":["CCI-002165"],"nist":["AC-3 (4)"],"subsystems":["file_system","groups","files"],"host":null,"container":null},"code":"control 'SV-204464' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all files and directories have a\n    valid group owner.'\n  desc 'Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group\n    Identifier (GID) as the GID of the files without a valid group owner.'\n  desc 'check', 'Verify all files and directories on the system have a valid group.\n    Check the owner of all files and directories with the following command:\n    Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example.\n    # find / -fstype xfs -nogroup\n    If any files on the system do not have an assigned group, this is a finding.'\n  desc 'fix', 'Either remove all files and directories from the system that do not have a valid group, or assign a\n    valid group to all files and directories on the system with the \"chgrp\" command:\n    # chgrp <group> <file>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72009', 'SV-86633']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204464'\n  tag rid: 'SV-204464r853898_rule'\n  tag stig_id: 'RHEL-07-020330'\n  tag fix_id: 'F-4588r88585_fix'\n  tag cci: ['CCI-002165']\n  tag nist: ['AC-3 (4)']\n  tag subsystems: ['file_system', 'groups', 'files']\n  tag 'host'\n  tag 'container'\n\n  command('grep -v \"nodev\" /proc/filesystems | awk \\'NF{ print $NF }\\'')\n    .stdout.strip.split(\"\\n\").each do |fs|\n      describe command(\"find / -xdev -xautofs -fstype #{fs} -nogroup\") do\n        its('stdout.strip') { should be_empty }\n      end\n    end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204464.rb"},"waiver_data":{},"results":[]},{"id":"SV-204466","title":"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user\n    accounts, upon creation, are assigned a home directory.","desc":"If local interactive users are not assigned a valid home directory, there is no place for the storage and\n    control of files they should own.","descriptions":[{"label":"default","data":"If local interactive users are not assigned a valid home directory, there is no place for the storage and\n    control of files they should own."},{"label":"check","data":"Verify all local interactive users on the system are assigned a home directory upon creation.\n    Check to see if the system is configured to create home directories for local interactive users with the following\n    command:\n    # grep -i create_home /etc/login.defs\n    CREATE_HOME yes\n    If the value for \"CREATE_HOME\" parameter is not set to \"yes\", the line is missing, or the line is commented out,\n    this is a finding."},{"label":"fix","data":"Configure the operating system to assign home directories to all new local interactive users by\n    setting the \"CREATE_HOME\" parameter in \"/etc/login.defs\" to \"yes\" as follows.\n    CREATE_HOME yes"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72013","SV-86637"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204466","rid":"SV-204466r603261_rule","stig_id":"RHEL-07-020610","fix_id":"F-4590r88591_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["login_defs"],"host":null,"container":null},"code":"control 'SV-204466' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local interactive user\n    accounts, upon creation, are assigned a home directory.'\n  desc 'If local interactive users are not assigned a valid home directory, there is no place for the storage and\n    control of files they should own.'\n  desc 'check', 'Verify all local interactive users on the system are assigned a home directory upon creation.\n    Check to see if the system is configured to create home directories for local interactive users with the following\n    command:\n    # grep -i create_home /etc/login.defs\n    CREATE_HOME yes\n    If the value for \"CREATE_HOME\" parameter is not set to \"yes\", the line is missing, or the line is commented out,\n    this is a finding.'\n  desc 'fix', 'Configure the operating system to assign home directories to all new local interactive users by\n    setting the \"CREATE_HOME\" parameter in \"/etc/login.defs\" to \"yes\" as follows.\n    CREATE_HOME yes'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72013', 'SV-86637']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204466'\n  tag rid: 'SV-204466r603261_rule'\n  tag stig_id: 'RHEL-07-020610'\n  tag fix_id: 'F-4590r88591_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['login_defs']\n  tag 'host'\n  tag 'container'\n\n  describe login_defs do\n    its('CREATE_HOME') { should eq 'yes' }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204466.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"login.defs","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"login.defs","skip_message":"Can't find file: /etc/login.defs","resource_class":"login_defs","resource_params":"[]"}]},{"id":"SV-204467","title":"The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a\n    home directory assigned and defined in the /etc/passwd file.","desc":"If local interactive users are not assigned a valid home directory, there is no place for the storage and\n    control of files they should own.\n    In addition, if a local interactive user has a home directory defined that does not exist, the user may be given\n    access to the / directory as the current working directory upon logon. This could create a Denial of Service because\n    the user would not be able to access their logon configuration files, and it may give them visibility to system\n    files they normally would not be able to access.","descriptions":[{"label":"default","data":"If local interactive users are not assigned a valid home directory, there is no place for the storage and\n    control of files they should own.\n    In addition, if a local interactive user has a home directory defined that does not exist, the user may be given\n    access to the / directory as the current working directory upon logon. This could create a Denial of Service because\n    the user would not be able to access their logon configuration files, and it may give them visibility to system\n    files they normally would not be able to access."},{"label":"check","data":"Verify local interactive users on the system have a home directory assigned and the directory\n    exists.\n    Check the home directory assignment for all local interactive non-privileged users on the system with the following\n    command:\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd\n    smithj 1001 /home/smithj\n    Note: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be\n    obtained from a number of log files containing system logon information.\n    Check that all referenced home directories exist with the following command:\n    # pwck -r\n    user 'smithj': directory '/home/smithj' does not exist\n    If any home directories referenced in \"/etc/passwd\" are returned as not defined, or if any interactive users do not\n    have a home directory assigned, this is a finding."},{"label":"fix","data":"Create home directories to all local interactive users that currently do not have a home directory\n    assigned. Use the following commands to create the user home directory assigned in \"/etc/ passwd\":\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\", a UID of \"smithj\", and a\n    Group Identifier (GID) of \"users\" assigned in \"/etc/passwd\".\n    # mkdir /home/smithj\n    # chown smithj /home/smithj\n    # chgrp users /home/smithj\n    # chmod 0750 /home/smithj"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72015","SV-86639"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204467","rid":"SV-204467r603826_rule","stig_id":"RHEL-07-020620","fix_id":"F-4591r462550_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["accounts"],"host":null},"code":"control 'SV-204467' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local interactive users have a\n    home directory assigned and defined in the /etc/passwd file.'\n  desc 'If local interactive users are not assigned a valid home directory, there is no place for the storage and\n    control of files they should own.\n    In addition, if a local interactive user has a home directory defined that does not exist, the user may be given\n    access to the / directory as the current working directory upon logon. This could create a Denial of Service because\n    the user would not be able to access their logon configuration files, and it may give them visibility to system\n    files they normally would not be able to access.'\n  desc 'check', %q(Verify local interactive users on the system have a home directory assigned and the directory\n    exists.\n    Check the home directory assignment for all local interactive non-privileged users on the system with the following\n    command:\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd\n    smithj 1001 /home/smithj\n    Note: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be\n    obtained from a number of log files containing system logon information.\n    Check that all referenced home directories exist with the following command:\n    # pwck -r\n    user 'smithj': directory '/home/smithj' does not exist\n    If any home directories referenced in \"/etc/passwd\" are returned as not defined, or if any interactive users do not\n    have a home directory assigned, this is a finding.)\n  desc 'fix', 'Create home directories to all local interactive users that currently do not have a home directory\n    assigned. Use the following commands to create the user home directory assigned in \"/etc/ passwd\":\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\", a UID of \"smithj\", and a\n    Group Identifier (GID) of \"users\" assigned in \"/etc/passwd\".\n    # mkdir /home/smithj\n    # chown smithj /home/smithj\n    # chgrp users /home/smithj\n    # chmod 0750 /home/smithj'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72015', 'SV-86639']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204467'\n  tag rid: 'SV-204467r603826_rule'\n  tag stig_id: 'RHEL-07-020620'\n  tag fix_id: 'F-4591r462550_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['accounts']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      describe directory(user_info.home) do\n        it { should exist }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204467.rb"},"waiver_data":{},"results":[]},{"id":"SV-204468","title":"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home\n    directories have mode 0750 or less permissive.","desc":"Excessive permissions on local interactive user home directories may allow unauthorized access to user files\n    by other users.","descriptions":[{"label":"default","data":"Excessive permissions on local interactive user home directories may allow unauthorized access to user files\n    by other users."},{"label":"check","data":"Verify the assigned home directory of all local interactive users has a mode of \"0750\" or less\n    permissive.\n    Check the home directory assignment for all non-privileged users on the system with the following command:\n    Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of\n    interactive use may be obtained from a number of log files containing system logon information.\n    # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)\n    -rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj\n    If home directories referenced in \"/etc/passwd\" do not have a mode of \"0750\" or less permissive, this is a finding."},{"label":"fix","data":"Change the mode of interactive user's home directories to \"0750\". To change the mode of a local\n    interactive user's home directory, use the following command:\n    Note: The example will be for the user \"smithj\".\n    # chmod 0750 /home/smithj"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86641","V-72017"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204468","rid":"SV-204468r603828_rule","stig_id":"RHEL-07-020630","fix_id":"F-4592r88597_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs"],"host":null},"code":"control 'SV-204468' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home\n    directories have mode 0750 or less permissive.'\n  desc 'Excessive permissions on local interactive user home directories may allow unauthorized access to user files\n    by other users.'\n  desc 'check', %q(Verify the assigned home directory of all local interactive users has a mode of \"0750\" or less\n    permissive.\n    Check the home directory assignment for all non-privileged users on the system with the following command:\n    Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of\n    interactive use may be obtained from a number of log files containing system logon information.\n    # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)\n    -rwxr-x--- 1 smithj users  18 Mar  5 17:06 /home/smithj\n    If home directories referenced in \"/etc/passwd\" do not have a mode of \"0750\" or less permissive, this is a finding.)\n  desc 'fix', %q(Change the mode of interactive user's home directories to \"0750\". To change the mode of a local\n    interactive user's home directory, use the following command:\n    Note: The example will be for the user \"smithj\".\n    # chmod 0750 /home/smithj)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86641', 'V-72017']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204468'\n  tag rid: 'SV-204468r603828_rule'\n  tag stig_id: 'RHEL-07-020630'\n  tag fix_id: 'F-4592r88597_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      findings += command(\"find #{user_info.home} -maxdepth 0 -perm -#{input('home_dir_mode')}\").stdout.split(\"\\n\")\n    end\n    describe 'Home directories with excessive permissions' do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204468.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Home directories with excessive permissions is expected to be empty","run_time":0.011638,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204469","title":"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home\n    directories are owned by their respective users.","desc":"If a local interactive user does not own their home directory, unauthorized users could access or modify the\n    user's files, and the users may not be able to access their own files.","descriptions":[{"label":"default","data":"If a local interactive user does not own their home directory, unauthorized users could access or modify the\n    user's files, and the users may not be able to access their own files."},{"label":"check","data":"Verify the assigned home directory of all local interactive users on the system exists.\n    Check the home directory assignment for all local interactive users on the system with the following command:\n    # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)\n    -rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\n    If any home directories referenced in \"/etc/passwd\" are not owned by the interactive user, this is a finding."},{"label":"fix","data":"Change the owner of a local interactive user's home directories to that owner. To change the owner of\n    a local interactive user's home directory, use the following command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\".\n    # chown smithj /home/smithj"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86643","V-72019"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204469","rid":"SV-204469r603830_rule","stig_id":"RHEL-07-020640","fix_id":"F-4593r88600_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs"],"host":null},"code":"control 'SV-204469' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home\n    directories are owned by their respective users.'\n  desc \"If a local interactive user does not own their home directory, unauthorized users could access or modify the\n    user's files, and the users may not be able to access their own files.\"\n  desc 'check', %q(Verify the assigned home directory of all local interactive users on the system exists.\n    Check the home directory assignment for all local interactive users on the system with the following command:\n    # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)\n    -rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj\n    If any home directories referenced in \"/etc/passwd\" are not owned by the interactive user, this is a finding.)\n  desc 'fix', %q(Change the owner of a local interactive user's home directories to that owner. To change the owner of\n    a local interactive user's home directory, use the following command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\".\n    # chown smithj /home/smithj)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86643', 'V-72019']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204469'\n  tag rid: 'SV-204469r603830_rule'\n  tag stig_id: 'RHEL-07-020640'\n  tag fix_id: 'F-4593r88600_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      describe directory(user_info.home) do\n        it { should exist }\n        its('owner') { should eq user_info.username }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204469.rb"},"waiver_data":{},"results":[]},{"id":"SV-204470","title":"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home\n    directories are group-owned by the home directory owners primary group.","desc":"If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary\n    GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may\n    not be able to access files that they legitimately should.","descriptions":[{"label":"default","data":"If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary\n    GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may\n    not be able to access files that they legitimately should."},{"label":"check","data":"Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.\n\nCheck the home directory assignment for all local interactive users on the system with the following command:\n\n     # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)\n     -rwxr-x--- 1 smithj users 13 Apr 1 04:20 /home/smithj\n\nCheck the user's primary group with the following command:\n\n     # grep $(grep smithj /etc/passwd | awk -F: '{print $4}') /etc/group\n     users:x:250:smithj,marinc,chongt\n\nIf the user home directory referenced in \"/etc/passwd\" is not group-owned by that user's primary GID, this is a finding."},{"label":"fix","data":"Change the group owner of a local interactive user's home directory to the group found in\n    \"/etc/passwd\". To change the group owner of a local interactive user's home directory, use the following command:\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\", and has a primary group\n    of users.\n    # chgrp users /home/smithj"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86645","V-72021"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204470","rid":"SV-204470r880764_rule","stig_id":"RHEL-07-020650","fix_id":"F-4594r880763_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs"],"host":null},"code":"control 'SV-204470' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local interactive user home\n    directories are group-owned by the home directory owners primary group.'\n  desc \"If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary\n    GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may\n    not be able to access files that they legitimately should.\"\n  desc 'check', %q(Verify the assigned home directory of all local interactive users is group-owned by that user's primary GID.\n\nCheck the home directory assignment for all local interactive users on the system with the following command:\n\n     # ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)\n     -rwxr-x--- 1 smithj users 13 Apr 1 04:20 /home/smithj\n\nCheck the user's primary group with the following command:\n\n     # grep $(grep smithj /etc/passwd | awk -F: '{print $4}') /etc/group\n     users:x:250:smithj,marinc,chongt\n\nIf the user home directory referenced in \"/etc/passwd\" is not group-owned by that user's primary GID, this is a finding.)\n  desc 'fix', %q(Change the group owner of a local interactive user's home directory to the group found in\n    \"/etc/passwd\". To change the group owner of a local interactive user's home directory, use the following command:\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\", and has a primary group\n    of users.\n    # chgrp users /home/smithj)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86645', 'V-72021']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204470'\n  tag rid: 'SV-204470r880764_rule'\n  tag stig_id: 'RHEL-07-020650'\n  tag fix_id: 'F-4594r880763_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      findings += command(\"find #{user_info.home} -maxdepth 0 -not -gid #{user_info.gid}\").stdout.split(\"\\n\")\n    end\n    describe \"Home directories that are not group-owned by the user's primary GID\" do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204470.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Home directories that are not group-owned by the user's primary GID is expected to be empty","run_time":0.011534,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204471","title":"The Red Hat Enterprise Linux operating system must be configured so that all files and directories\n    contained in local interactive user home directories have a valid owner.","desc":"Unowned files and directories may be unintentionally inherited if a user is assigned the same User\n    Identifier \"UID\" as the UID of the un-owned files.","descriptions":[{"label":"default","data":"Unowned files and directories may be unintentionally inherited if a user is assigned the same User\n    Identifier \"UID\" as the UID of the un-owned files."},{"label":"check","data":"Verify all files and directories in a local interactive user's home directory have a valid owner.\n    Check the owner of all files and directories in a local interactive user's home directory with the following\n    command:\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n    $ sudo ls -lLR /home/smithj\n    -rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\n    -rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\n    -rw-r--r-- 1 smithj smithj 231 Mar  5 17:06 file3\n    If any files or directories are found without an owner, this is a finding."},{"label":"fix","data":"Either remove all files and directories from the system that do not have a valid user, or assign a\n    valid user to all unowned files and directories on RHEL 7 with the \"chown\" command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\".\n    $ sudo chown smithj /home/smithj/<file or directory>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86647","V-72023"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204471","rid":"SV-204471r744105_rule","stig_id":"RHEL-07-020660","fix_id":"F-4595r744104_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs"],"host":null},"code":"control 'SV-204471' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all files and directories\n    contained in local interactive user home directories have a valid owner.'\n  desc 'Unowned files and directories may be unintentionally inherited if a user is assigned the same User\n    Identifier \"UID\" as the UID of the un-owned files.'\n  desc 'check', %q(Verify all files and directories in a local interactive user's home directory have a valid owner.\n    Check the owner of all files and directories in a local interactive user's home directory with the following\n    command:\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n    $ sudo ls -lLR /home/smithj\n    -rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\n    -rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\n    -rw-r--r-- 1 smithj smithj 231 Mar  5 17:06 file3\n    If any files or directories are found without an owner, this is a finding.)\n  desc 'fix', 'Either remove all files and directories from the system that do not have a valid user, or assign a\n    valid user to all unowned files and directories on RHEL 7 with the \"chown\" command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\".\n    $ sudo chown smithj /home/smithj/<file or directory>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86647', 'V-72023']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204471'\n  tag rid: 'SV-204471r744105_rule'\n  tag stig_id: 'RHEL-07-020660'\n  tag fix_id: 'F-4595r744104_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      findings += command(\"find #{user_info.home} -xdev -xautofs -not -user #{user_info.username}\").stdout.split(\"\\n\")\n    end\n    describe 'Files and directories that are not owned by the user' do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204471.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Files and directories that are not owned by the user is expected to be empty","run_time":0.011229,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204472","title":"The Red Hat Enterprise Linux operating system must be configured so that all files and directories\n    contained in local interactive user home directories are group-owned by a group of which the home directory owner is\n    a member.","desc":"If a local interactive user's files are group-owned by a group of which the user is not a member, unintended\n    users may be able to access them.","descriptions":[{"label":"default","data":"If a local interactive user's files are group-owned by a group of which the user is not a member, unintended\n    users may be able to access them."},{"label":"check","data":"Verify all files and directories in a local interactive user home directory are group-owned by a\n    group the user is a member of.\n    Check the group owner of all files and directories in a local interactive user's home directory with the following\n    command:\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n    # ls -lLR /<home directory>/<users home directory>/\n    -rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\n    -rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\n    -rw-r--r-- 1 smithj sa        231 Mar  5 17:06 file3\n    If any files are found with an owner different than the group home directory user, check to see if the user is a\n    member of that group with the following command:\n    # grep smithj /etc/group\n    sa:x:100:juan,shelley,bob,smithj\n    smithj:x:521:smithj\n    If the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is\n    a finding."},{"label":"fix","data":"Change the group of a local interactive user's files and directories to a group that the interactive\n    user is a member of. To change the group owner of a local interactive user's files and directories, use the\n    following command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\" and is a member of the\n    users group.\n    # chgrp users /home/smithj/<file>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72025","SV-86649"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204472","rid":"SV-204472r603261_rule","stig_id":"RHEL-07-020670","fix_id":"F-4596r88609_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs"],"host":null},"code":"control 'SV-204472' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all files and directories\n    contained in local interactive user home directories are group-owned by a group of which the home directory owner is\n    a member.'\n  desc \"If a local interactive user's files are group-owned by a group of which the user is not a member, unintended\n    users may be able to access them.\"\n  desc 'check', %q(Verify all files and directories in a local interactive user home directory are group-owned by a\n    group the user is a member of.\n    Check the group owner of all files and directories in a local interactive user's home directory with the following\n    command:\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n    # ls -lLR /<home directory>/<users home directory>/\n    -rw-r--r-- 1 smithj smithj  18 Mar  5 17:06 file1\n    -rw-r--r-- 1 smithj smithj 193 Mar  5 17:06 file2\n    -rw-r--r-- 1 smithj sa        231 Mar  5 17:06 file3\n    If any files are found with an owner different than the group home directory user, check to see if the user is a\n    member of that group with the following command:\n    # grep smithj /etc/group\n    sa:x:100:juan,shelley,bob,smithj\n    smithj:x:521:smithj\n    If the user is not a member of a group that group owns file(s) in a local interactive user's home directory, this is\n    a finding.)\n  desc 'fix', %q(Change the group of a local interactive user's files and directories to a group that the interactive\n    user is a member of. To change the group owner of a local interactive user's files and directories, use the\n    following command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\" and is a member of the\n    users group.\n    # chgrp users /home/smithj/<file>)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72025', 'SV-86649']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204472'\n  tag rid: 'SV-204472r603261_rule'\n  tag stig_id: 'RHEL-07-020670'\n  tag fix_id: 'F-4596r88609_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      find_args = ''\n      user_info.groups.each do |curr_group|\n        # some key files and secure dirs (like .ssh) are group owned 'root'\n        find_args += \"-not -group #{curr_group} -o root\"\n      end\n      findings += command(\"find #{user_info.home} -xdev -xautofs #{find_args}\").stdout.split(\"\\n\")\n    end\n    describe \"Home directory files with incorrect group ownership or not 'root' owned\" do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204472.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Home directory files with incorrect group ownership or not 'root' owned is expected to be empty","run_time":0.011205,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204473","title":"The Red Hat Enterprise Linux operating system must be configured so that all files and directories\n    contained in local interactive user home directories have a mode of 0750 or less permissive.","desc":"If a local interactive user files have excessive permissions, unintended users may be able to access or\n    modify them.","descriptions":[{"label":"default","data":"If a local interactive user files have excessive permissions, unintended users may be able to access or\n    modify them."},{"label":"check","data":"Verify all files and directories contained in a local interactive user home directory, excluding\n    local initialization files, have a mode of \"0750\".\n    Check the mode of all non-initialization files in a local interactive user home directory with the following\n    command:\n    Files that begin with a \".\" are excluded from this requirement.\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n    # ls -lLR /home/smithj\n    -rwxr-x--- 1 smithj smithj  18 Mar  5 17:06 file1\n    -rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2\n    -rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3\n    If any files are found with a mode more permissive than \"0750\", this is a finding."},{"label":"fix","data":"Set the mode on files and directories in the local interactive user home\ndirectory with the following command:\n\n    Note: The example will be for the user smithj, who has a home directory of\n\"/home/smithj\" and is a member of the users group.\n\n    # chmod 0750 /home/smithj/<file>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72027","SV-86651"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204473","rid":"SV-204473r603261_rule","stig_id":"RHEL-07-020680","fix_id":"F-4597r88612_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs"],"host":null,"container":null},"code":"control 'SV-204473' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all files and directories\n    contained in local interactive user home directories have a mode of 0750 or less permissive.'\n  desc 'If a local interactive user files have excessive permissions, unintended users may be able to access or\n    modify them.'\n  desc 'check', 'Verify all files and directories contained in a local interactive user home directory, excluding\n    local initialization files, have a mode of \"0750\".\n    Check the mode of all non-initialization files in a local interactive user home directory with the following\n    command:\n    Files that begin with a \".\" are excluded from this requirement.\n    Note: The example will be for the user \"smithj\", who has a home directory of \"/home/smithj\".\n    # ls -lLR /home/smithj\n    -rwxr-x--- 1 smithj smithj  18 Mar  5 17:06 file1\n    -rwxr----- 1 smithj smithj 193 Mar  5 17:06 file2\n    -rw-r-x--- 1 smithj smithj 231 Mar  5 17:06 file3\n    If any files are found with a mode more permissive than \"0750\", this is a finding.'\n  desc 'fix', 'Set the mode on files and directories in the local interactive user home\ndirectory with the following command:\n\n    Note: The example will be for the user smithj, who has a home directory of\n\"/home/smithj\" and is a member of the users group.\n\n    # chmod 0750 /home/smithj/<file>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72027', 'SV-86651']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204473'\n  tag rid: 'SV-204473r603261_rule'\n  tag stig_id: 'RHEL-07-020680'\n  tag fix_id: 'F-4597r88612_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs']\n  tag 'host'\n  tag 'container'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      findings += command(\"find #{user_info.home} -xdev ! -name '.*' -perm -#{input('home_dir_files_mode')} ! -type l\").stdout.split(\"\\n\")\n    end\n    describe 'Home directories with excessive permissions' do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204473.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Home directories with excessive permissions is expected to be empty","run_time":0.01168,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204474","title":"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for\n    interactive users are owned by the home directory user or root.","desc":"Local initialization files are used to configure the user's shell environment upon logon. Malicious\n    modification of these files could compromise accounts upon logon.","descriptions":[{"label":"default","data":"Local initialization files are used to configure the user's shell environment upon logon. Malicious\n    modification of these files could compromise accounts upon logon."},{"label":"check","data":"Verify the local initialization files of all local interactive users are owned by that user.\n    Check the home directory assignment for all non-privileged users on the system with the following command:\n    Note: The example will be for the smithj user, who has a home directory of \"/home/smithj\".\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd\n    smithj 1000 /home/smithj\n    Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of\n    interactive use may be obtained from a number of log files containing system logon information.\n    Check the owner of all local interactive user's initialization files with the following command:\n    # ls -al /home/smithj/.[^.]* | more\n    -rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n    -rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n    -rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n    If all local interactive user's initialization files are not owned by that user or root, this is a finding."},{"label":"fix","data":"Set the owner of the local initialization files for interactive users to\neither the directory owner or root with the following command:\n\n    Note: The example will be for the smithj user, who has a home directory of\n\"/home/smithj\".\n\n    # chown smithj /home/smithj/.[^.]*"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72029","SV-86653"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204474","rid":"SV-204474r603834_rule","stig_id":"RHEL-07-020690","fix_id":"F-4598r462464_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["init_files"],"host":null},"code":"control 'SV-204474' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for\n    interactive users are owned by the home directory user or root.'\n  desc \"Local initialization files are used to configure the user's shell environment upon logon. Malicious\n    modification of these files could compromise accounts upon logon.\"\n  desc 'check', %q(Verify the local initialization files of all local interactive users are owned by that user.\n    Check the home directory assignment for all non-privileged users on the system with the following command:\n    Note: The example will be for the smithj user, who has a home directory of \"/home/smithj\".\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd\n    smithj 1000 /home/smithj\n    Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of\n    interactive use may be obtained from a number of log files containing system logon information.\n    Check the owner of all local interactive user's initialization files with the following command:\n    # ls -al /home/smithj/.[^.]* | more\n    -rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n    -rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n    -rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n    If all local interactive user's initialization files are not owned by that user or root, this is a finding.)\n  desc 'fix', 'Set the owner of the local initialization files for interactive users to\neither the directory owner or root with the following command:\n\n    Note: The example will be for the smithj user, who has a home directory of\n\"/home/smithj\".\n\n    # chown smithj /home/smithj/.[^.]*'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72029', 'SV-86653']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204474'\n  tag rid: 'SV-204474r603834_rule'\n  tag stig_id: 'RHEL-07-020690'\n  tag fix_id: 'F-4598r462464_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['init_files']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      findings += command(\"find #{user_info.home} -name '.*' -not -user #{user_info.username} -a -not -user root\").stdout.split(\"\\n\")\n    end\n    describe 'Files and Directories not owned by the user or root of the parent home directory' do\n      subject { findings.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204474.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Files and Directories not owned by the user or root of the parent home directory is expected to be empty","run_time":0.011647,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204475","title":"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for\n    local interactive users are be group-owned by the users primary group or root.","desc":"Local initialization files for interactive users are used to configure the user's shell environment upon\n    logon. Malicious modification of these files could compromise accounts upon logon.","descriptions":[{"label":"default","data":"Local initialization files for interactive users are used to configure the user's shell environment upon\n    logon. Malicious modification of these files could compromise accounts upon logon."},{"label":"check","data":"Verify the local initialization files of all local interactive users are group-owned by that user's\n    primary Group Identifier (GID).\n    Check the home directory assignment for all non-privileged users on the system with the following command:\n    Note: The example will be for the smithj user, who has a home directory of \"/home/smithj\" and a primary group of\n    \"users\".\n    # awk -F: '($4>=1000)&&($7 !~ /nologin/){print $1, $4, $6}' /etc/passwd\n    smithj 1000 /home/smithj\n    # grep 1000 /etc/group\n    users:x:1000:smithj,jonesj,jacksons\n    Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of\n    interactive use may be obtained from a number of log files containing system logon information.\n    Check the group owner of all local interactive user's initialization files with the following command:\n    # ls -al /home/smithj/.[^.]* | more\n    -rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n    -rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n    -rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n    If all local interactive user's initialization files are not group-owned by that user's primary GID, this is a\n    finding."},{"label":"fix","data":"Change the group owner of a local interactive user's files to the group found in \"/etc/passwd\" for the\n    user. To change the group owner of a local interactive user's home directory, use the following command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\", and has a primary group\n    of users.\n    # chgrp users /home/smithj/.[^.]*"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72031","SV-86655"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204475","rid":"SV-204475r603836_rule","stig_id":"RHEL-07-020700","fix_id":"F-4599r88618_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["init_files"],"host":null},"code":"control 'SV-204475' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local initialization files for\n    local interactive users are be group-owned by the users primary group or root.'\n  desc \"Local initialization files for interactive users are used to configure the user's shell environment upon\n    logon. Malicious modification of these files could compromise accounts upon logon.\"\n  desc 'check', %q(Verify the local initialization files of all local interactive users are group-owned by that user's\n    primary Group Identifier (GID).\n    Check the home directory assignment for all non-privileged users on the system with the following command:\n    Note: The example will be for the smithj user, who has a home directory of \"/home/smithj\" and a primary group of\n    \"users\".\n    # awk -F: '($4>=1000)&&($7 !~ /nologin/){print $1, $4, $6}' /etc/passwd\n    smithj 1000 /home/smithj\n    # grep 1000 /etc/group\n    users:x:1000:smithj,jonesj,jacksons\n    Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of\n    interactive use may be obtained from a number of log files containing system logon information.\n    Check the group owner of all local interactive user's initialization files with the following command:\n    # ls -al /home/smithj/.[^.]* | more\n    -rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile\n    -rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login\n    -rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something\n    If all local interactive user's initialization files are not group-owned by that user's primary GID, this is a\n    finding.)\n  desc 'fix', %q(Change the group owner of a local interactive user's files to the group found in \"/etc/passwd\" for the\n    user. To change the group owner of a local interactive user's home directory, use the following command:\n    Note: The example will be for the user smithj, who has a home directory of \"/home/smithj\", and has a primary group\n    of users.\n    # chgrp users /home/smithj/.[^.]*)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72031', 'SV-86655']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204475'\n  tag rid: 'SV-204475r603836_rule'\n  tag stig_id: 'RHEL-07-020700'\n  tag fix_id: 'F-4599r88618_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['init_files']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)\n    end.entries.each do |user_info|\n      findings += command(\"find #{user_info.home} -name '.*' -not -gid #{user_info.gid} -not -group root\").stdout.split(\"\\n\")\n    end\n    describe findings do\n      its('length') { should == 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204475.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"#<Set: {}> length is expected to == 0","run_time":0.009912,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204476","title":"The Red Hat Enterprise Linux operating system must be configured so that all local initialization files\n    have mode 0740 or less permissive.","desc":"Local initialization files are used to configure the user's shell environment upon logon. Malicious\n    modification of these files could compromise accounts upon logon.","descriptions":[{"label":"default","data":"Local initialization files are used to configure the user's shell environment upon logon. Malicious\n    modification of these files could compromise accounts upon logon."},{"label":"check","data":"Verify that all local initialization files have a mode of \"0740\" or less permissive.\n    Check the mode on all local initialization files with the following command:\n    Note: The example will be for the \"smithj\" user, who has a home directory of \"/home/smithj\".\n    # ls -al /home/smithj/.[^.]* | more\n    -rwxr----- 1 smithj users 896 Mar 10 2011 .profile\n    -rwxr----- 1 smithj users 497 Jan 6 2007 .login\n    -rwxr----- 1 smithj users 886 Jan 6 2007 .something\n    If any local initialization files have a mode more permissive than \"0740\", this is a finding."},{"label":"fix","data":"Set the mode of the local initialization files to \"0740\" with the\nfollowing command:\n\n    Note: The example will be for the \"smithj\" user, who has a home directory\nof \"/home/smithj\".\n\n    # chmod 0740 /home/smithj/.[^.]*"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86657","V-72033"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204476","rid":"SV-204476r603261_rule","stig_id":"RHEL-07-020710","fix_id":"F-4600r88621_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["init_files"],"host":null},"code":"control 'SV-204476' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local initialization files\n    have mode 0740 or less permissive.'\n  desc \"Local initialization files are used to configure the user's shell environment upon logon. Malicious\n    modification of these files could compromise accounts upon logon.\"\n  desc 'check', 'Verify that all local initialization files have a mode of \"0740\" or less permissive.\n    Check the mode on all local initialization files with the following command:\n    Note: The example will be for the \"smithj\" user, who has a home directory of \"/home/smithj\".\n    # ls -al /home/smithj/.[^.]* | more\n    -rwxr----- 1 smithj users 896 Mar 10 2011 .profile\n    -rwxr----- 1 smithj users 497 Jan 6 2007 .login\n    -rwxr----- 1 smithj users 886 Jan 6 2007 .something\n    If any local initialization files have a mode more permissive than \"0740\", this is a finding.'\n  desc 'fix', 'Set the mode of the local initialization files to \"0740\" with the\nfollowing command:\n\n    Note: The example will be for the \"smithj\" user, who has a home directory\nof \"/home/smithj\".\n\n    # chmod 0740 /home/smithj/.[^.]*'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86657', 'V-72033']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204476'\n  tag rid: 'SV-204476r603261_rule'\n  tag stig_id: 'RHEL-07-020710'\n  tag fix_id: 'F-4600r88621_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['init_files']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)\n    end.entries.each do |user_info|\n      findings += command(\"find #{user_info.home} -xdev -maxdepth 1 -name '.*' -type f -perm -#{input('init_files_mode')}\").stdout.split(\"\\n\")\n    end\n    describe findings do\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204476.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"#<Set: {}> is expected to be empty","run_time":0.011742,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204477","title":"The Red Hat Enterprise Linux operating system must be configured so that all local interactive user\n    initialization files executable search paths contain only paths that resolve to the users home directory.","desc":"The executable search path (typically the PATH environment variable) contains a list of directories for the\n    shell to search to find executables. If this path includes the current working directory (other than the user's home\n    directory), executables in these directories may be executed instead of system commands. This variable is formatted\n    as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two\n    consecutive colons, this is interpreted as the current working directory. If deviations from the default system\n    search path for the local interactive user are required, they must be documented with the Information System\n    Security Officer (ISSO).","descriptions":[{"label":"default","data":"The executable search path (typically the PATH environment variable) contains a list of directories for the\n    shell to search to find executables. If this path includes the current working directory (other than the user's home\n    directory), executables in these directories may be executed instead of system commands. This variable is formatted\n    as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two\n    consecutive colons, this is interpreted as the current working directory. If deviations from the default system\n    search path for the local interactive user are required, they must be documented with the Information System\n    Security Officer (ISSO)."},{"label":"check","data":"Verify that all local interactive user initialization files' executable search path statements do\n    not contain statements that will reference a working directory other than the user's home directory.\n    Check the executable search path statement for all local interactive user initialization files in the user's home\n    directory with the following commands:\n    Note: The example will be for the smithj user, which has a home directory of \"/home/smithj\".\n    # grep -i path= /home/smithj/.*\n    /home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\n    If any local interactive user initialization files have executable search path statements that include directories\n    outside of their home directory, this is a finding."},{"label":"fix","data":"Edit the local interactive user initialization files to change any PATH variable statements that\n    reference directories other than their home directory.\n    If a local interactive user requires path variables to reference a directory owned by the application, it must be\n    documented with the ISSO."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72035","SV-86659"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204477","rid":"SV-204477r792828_rule","stig_id":"RHEL-07-020720","fix_id":"F-4601r88624_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["init_files"],"host":null},"code":"control 'SV-204477' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all local interactive user\n    initialization files executable search paths contain only paths that resolve to the users home directory.'\n  desc \"The executable search path (typically the PATH environment variable) contains a list of directories for the\n    shell to search to find executables. If this path includes the current working directory (other than the user's home\n    directory), executables in these directories may be executed instead of system commands. This variable is formatted\n    as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two\n    consecutive colons, this is interpreted as the current working directory. If deviations from the default system\n    search path for the local interactive user are required, they must be documented with the Information System\n    Security Officer (ISSO).\"\n  desc 'check', %q(Verify that all local interactive user initialization files' executable search path statements do\n    not contain statements that will reference a working directory other than the user's home directory.\n    Check the executable search path statement for all local interactive user initialization files in the user's home\n    directory with the following commands:\n    Note: The example will be for the smithj user, which has a home directory of \"/home/smithj\".\n    # grep -i path= /home/smithj/.*\n    /home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin\n    If any local interactive user initialization files have executable search path statements that include directories\n    outside of their home directory, this is a finding.)\n  desc 'fix', 'Edit the local interactive user initialization files to change any PATH variable statements that\n    reference directories other than their home directory.\n    If a local interactive user requires path variables to reference a directory owned by the application, it must be\n    documented with the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72035', 'SV-86659']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204477'\n  tag rid: 'SV-204477r792828_rule'\n  tag stig_id: 'RHEL-07-020720'\n  tag fix_id: 'F-4601r88624_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['init_files']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    findings = Set[]\n    users.where do\n      !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      grep_results = command(\"grep -i path --exclude=\\\".bash_history\\\" #{user_info.home}/.*\").stdout.split('\\\\n')\n      grep_results.each do |result|\n        result.slice! 'PATH='\n        # Case when last value in exec search path is :\n        result += ' ' if result[-1] == ':'\n        result.slice! '$PATH:'\n        result.gsub! '$HOME', user_info.home.to_s\n        result.gsub! '~', user_info.home.to_s\n        line_arr = result.split(':')\n        line_arr.delete_at(0)\n        line_arr.each do |line|\n          # Don't run test on line that exports PATH and is not commented out\n          next unless !line.start_with?('export') && !line.start_with?('#')\n\n          # Case when :: found in exec search path or : found at beginning\n          if line.strip.empty?\n            curr_work_dir = command('pwd').stdout.gsub(\"\\n\", '')\n            line = curr_work_dir if curr_work_dir.start_with?(user_info.home.to_s)\n          end\n          # This will fail if non-home directory found in path\n          findings.add(line) unless line.start_with?(user_info.home)\n        end\n      end\n    end\n    describe.one do\n      describe etc_fstab do\n        its('home_mount_options') { should include 'nosuid' }\n      end\n      describe 'Initialization files that include executable search paths that include directories outside their home directories' do\n        subject { findings.to_a }\n        it { should be_empty }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204477.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Initialization files that include executable search paths that include directories outside their home directories is expected to be empty","run_time":0.000138,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204478","title":"The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not\n    execute world-writable programs.","desc":"If user start-up files execute world-writable programs, especially in\n    unprotected directories, they could be maliciously modified to destroy user\n    files or otherwise compromise the system at the user level. If the system is\n    compromised at the user level, it is easier to elevate privileges to eventually\n    compromise the system at the root and network level.","descriptions":[{"label":"default","data":"If user start-up files execute world-writable programs, especially in\n    unprotected directories, they could be maliciously modified to destroy user\n    files or otherwise compromise the system at the user level. If the system is\n    compromised at the user level, it is easier to elevate privileges to eventually\n    compromise the system at the root and network level."},{"label":"check","data":"Verify that local initialization files do not execute world-writable programs.\n    Check the system for world-writable files with the following command:\n    # find / -xdev -perm -002 -type f -exec ls -ld {} \\; | more\n    For all files listed, check for their presence in the local initialization files with the following commands:\n    Note: The example will be for a system that is configured to create users' home directories in the \"/home\"\n    directory.\n    # grep <file> /home/*/.*\n    If any local initialization files are found to reference world-writable files, this is a finding."},{"label":"fix","data":"Set the mode on files being executed by the local initialization files with\nthe following command:\n\n    # chmod 0755 <file>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86661","V-72037"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204478","rid":"SV-204478r603261_rule","stig_id":"RHEL-07-020730","fix_id":"F-4602r88627_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["init_files"],"host":null},"code":"control 'SV-204478' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that local initialization files do not\n    execute world-writable programs.'\n  desc 'If user start-up files execute world-writable programs, especially in\n    unprotected directories, they could be maliciously modified to destroy user\n    files or otherwise compromise the system at the user level. If the system is\n    compromised at the user level, it is easier to elevate privileges to eventually\n    compromise the system at the root and network level.'\n  desc 'check', %q(Verify that local initialization files do not execute world-writable programs.\n    Check the system for world-writable files with the following command:\n    # find / -xdev -perm -002 -type f -exec ls -ld {} \\; | more\n    For all files listed, check for their presence in the local initialization files with the following commands:\n    Note: The example will be for a system that is configured to create users' home directories in the \"/home\"\n    directory.\n    # grep <file> /home/*/.*\n    If any local initialization files are found to reference world-writable files, this is a finding.)\n  desc 'fix', 'Set the mode on files being executed by the local initialization files with\nthe following command:\n\n    # chmod 0755 <file>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86661', 'V-72037']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204478'\n  tag rid: 'SV-204478r603261_rule'\n  tag stig_id: 'RHEL-07-020730'\n  tag fix_id: 'F-4602r88627_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['init_files']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    if input('disable_slow_controls')\n      describe \"This control consistently takes a long to run and has been disabled\n    using the disable_slow_controls attribute.\" do\n        skip \"This control consistently takes a long to run and has been disabled\n    using the disable_slow_controls attribute. You must enable this control for a\n    full accredidation for production.\"\n      end\n    else\n      ignore_shells = non_interactive_shells.join('|')\n\n      # Get home directory for users with UID >= 1000 or UID == 0 and support interactive logins.\n      dotfiles = Set[]\n      u = users.where do\n        !shell.match(ignore_shells) && (uid >= 1000 || uid == 0)\n      end.entries\n      # For each user, build and execute a find command that identifies initialization files\n      # in a user's home directory.\n      u.each do |user|\n        dotfiles += command(\"find #{user.home} -xdev -maxdepth 2 ( -name '.*' ! -name '.bash_history' ) -type f\").stdout.split(\"\\n\")\n      end\n      ww_files = Set[]\n      ww_files = command('find / -xdev -perm -002 -type f -exec ls {} \\;').stdout.lines\n\n      # To reduce the number of commands ran, we use a pattern file in the grep command below\n      # So we don't have too long of a grep command, we chunk the list of ww_files\n      # into strings not longer than PATTERN_FILE_MAX_LENGTH\n      # Based on MAX_ARG_STRLEN, /usr/include/linux/binfmts.h\n      # We cut off 100 to leave room for the rest of the arguments\n      PATTERN_FILE_MAX_LENGTH = command('getconf PAGE_SIZE').stdout.to_i * 32 - 100\n      ww_chunked = ['']\n      ww_files.each do |item|\n        item = item.strip\n        if item.length + \"\\n\".length > PATTERN_FILE_MAX_LENGTH\n          raise 'Single pattern is longer than PATTERN_FILE_MAX_LENGTH'\n        end\n\n        if ww_chunked[-1].length + \"\\n\".length + item.length > PATTERN_FILE_MAX_LENGTH\n          ww_chunked.append('')\n        end\n        ww_chunked[-1] += \"\\n\" + item # This will leave an extra newline at the beginning of chunks\n      end\n      ww_chunked = ww_chunked.map(&:strip) # This gets rid of the beginning newlines\n      if ww_chunked[0] == ''\n        ww_chunked = [] # If we didn't have any ww_files, this will prevent an empty grep pattern\n      end\n\n      # Check each dotfile for existence of each world-writeable file\n      findings = Set[]\n      dotfiles.each do |dotfile|\n        dotfile = dotfile.strip\n        ww_chunked.each do |ww_pattern_file|\n          count = command(\"grep -c -f <(echo \\\"#{ww_pattern_file}\\\") \\\"#{dotfile}\\\"\").stdout.strip.to_i\n          findings << dotfile if count > 0\n        end\n      end\n      describe 'Local initialization files that are found to reference world-writable files' do\n        subject { findings.to_a }\n        it { should be_empty }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204478.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Local initialization files that are found to reference world-writable files is expected to be empty","run_time":0.011002,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204479","title":"The Red Hat Enterprise Linux operating system must be configured so that all system device files are\n    correctly labeled to prevent unauthorized modification.","desc":"If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system\n    may perform unintended or unauthorized operations.","descriptions":[{"label":"default","data":"If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system\n    may perform unintended or unauthorized operations."},{"label":"check","data":"Verify that all system device files are correctly labeled to prevent unauthorized modification.\n\nList all device files on the system that are incorrectly labeled with the following commands:\n\nNote: Device files are normally found under \"/dev\", but applications may place device files in other directories and may necessitate a search of the entire system.\n\n#find /dev -context *:device_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"\n\n#find /dev -context *:unlabeled_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"\n\nNote: There are device files, such as \"/dev/vmci\", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the \"device_t\" label to operate. These device files are not a finding.\n\nIf there is output from either of these commands, other than already noted, this is a finding."},{"label":"fix","data":"Run the following command to determine which package owns the device file:\n\n    # rpm -qf <filename>\n\n    The package can be reinstalled from a yum repository using the command:\n\n    # sudo yum reinstall <packagename>\n\n    Alternatively, the package can be reinstalled from trusted media using the\ncommand:\n\n    # sudo rpm -Uvh <packagename>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86663","V-72039"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204479","rid":"SV-204479r853899_rule","stig_id":"RHEL-07-020900","fix_id":"F-4603r88630_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["system_device","device_files"],"host":null},"code":"control 'SV-204479' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all system device files are\n    correctly labeled to prevent unauthorized modification.'\n  desc 'If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system\n    may perform unintended or unauthorized operations.'\n  desc 'check', 'Verify that all system device files are correctly labeled to prevent unauthorized modification.\n\nList all device files on the system that are incorrectly labeled with the following commands:\n\nNote: Device files are normally found under \"/dev\", but applications may place device files in other directories and may necessitate a search of the entire system.\n\n#find /dev -context *:device_t:* \\\\( -type c -o -type b \\\\) -printf \"%p %Z\\\\n\"\n\n#find /dev -context *:unlabeled_t:* \\\\( -type c -o -type b \\\\) -printf \"%p %Z\\\\n\"\n\nNote: There are device files, such as \"/dev/vmci\", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the \"device_t\" label to operate. These device files are not a finding.\n\nIf there is output from either of these commands, other than already noted, this is a finding.'\n  desc 'fix', 'Run the following command to determine which package owns the device file:\n\n    # rpm -qf <filename>\n\n    The package can be reinstalled from a yum repository using the command:\n\n    # sudo yum reinstall <packagename>\n\n    Alternatively, the package can be reinstalled from trusted media using the\ncommand:\n\n    # sudo rpm -Uvh <packagename>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86663', 'V-72039']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204479'\n  tag rid: 'SV-204479r853899_rule'\n  tag stig_id: 'RHEL-07-020900'\n  tag fix_id: 'F-4603r88630_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['system_device', 'device_files']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    virtual_machine = input('virtual_machine')\n\n    findings = Set[]\n    findings += command('find / -xdev -context *:device_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"').stdout.split(\"\\n\")\n    findings += command('find / -xdev -context *:unlabeled_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"').stdout.split(\"\\n\")\n    findings += command('find / -xdev -context *:vmci_device_t:* \\( -type c -o -type b \\) -printf \"%p %Z\\n\"').stdout.split(\"\\n\")\n\n    describe findings do\n      if virtual_machine\n        its('length') { should cmp 1 }\n        its('first') { should include '/dev/vmci' }\n      else\n        its('length') { should cmp 0 }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204479.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"#<Set: {}> length is expected to cmp == 0","run_time":0.000424,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204480","title":"The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home\n    directories are mounted to prevent files with the setuid and setgid bit set from being executed.","desc":"The \"nosuid\" mount option causes the system to not execute setuid and setgid files with owner privileges.\n    This option must be used for mounting any file system not containing approved setuid and setguid files. Executing\n    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized\n    administrative access.","descriptions":[{"label":"default","data":"The \"nosuid\" mount option causes the system to not execute setuid and setgid files with owner privileges.\n    This option must be used for mounting any file system not containing approved setuid and setguid files. Executing\n    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized\n    administrative access."},{"label":"check","data":"Verify file systems that contain user home directories are mounted with the \"nosuid\" option.\n    Find the file system(s) that contain the user home directories with the following command:\n    Note: If a separate file system has not been created for the user home directories (user home directories are\n    mounted under \"/\"), this is not a finding as the \"nosuid\" option cannot be used on the \"/\" system.\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd\n    smithj 1001 /home/smithj\n    thomasr 1002 /home/thomasr\n    Check the file systems that are mounted at boot time with the following command:\n    # more /etc/fstab\n    UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2\n    If a file system found in \"/etc/fstab\" refers to the user home directory file system and it does not have the\n    \"nosuid\" option set, this is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that contain user home\n    directories."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86665","V-72041"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204480","rid":"SV-204480r603838_rule","stig_id":"RHEL-07-021000","fix_id":"F-4604r88633_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs","file_system"],"host":null},"code":"control 'SV-204480' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that file systems containing user home\n    directories are mounted to prevent files with the setuid and setgid bit set from being executed.'\n  desc 'The \"nosuid\" mount option causes the system to not execute setuid and setgid files with owner privileges.\n    This option must be used for mounting any file system not containing approved setuid and setguid files. Executing\n    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized\n    administrative access.'\n  desc 'check', %q(Verify file systems that contain user home directories are mounted with the \"nosuid\" option.\n    Find the file system(s) that contain the user home directories with the following command:\n    Note: If a separate file system has not been created for the user home directories (user home directories are\n    mounted under \"/\"), this is not a finding as the \"nosuid\" option cannot be used on the \"/\" system.\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6}' /etc/passwd\n    smithj 1001 /home/smithj\n    thomasr 1002 /home/thomasr\n    Check the file systems that are mounted at boot time with the following command:\n    # more /etc/fstab\n    UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home   ext4   rw,relatime,discard,data=ordered,nosuid 0 2\n    If a file system found in \"/etc/fstab\" refers to the user home directory file system and it does not have the\n    \"nosuid\" option set, this is a finding.)\n  desc 'fix', 'Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that contain user home\n    directories.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86665', 'V-72041']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204480'\n  tag rid: 'SV-204480r603838_rule'\n  tag stig_id: 'RHEL-07-021000'\n  tag fix_id: 'F-4604r88633_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs', 'file_system']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    describe mount('/home') do\n      its('options') { should include 'nosuid' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204480.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Mount /home","run_time":7.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Mount /home","skip_message":"The `mount` resource is not supported on your OS yet.","resource_class":"mount","resource_params":"[\"/home\"]"}]},{"id":"SV-204481","title":"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from\n    being executed on file systems that are used with removable media.","desc":"The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner\n    privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\"\n    files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.","descriptions":[{"label":"default","data":"The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner\n    privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\"\n    files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access."},{"label":"check","data":"Verify file systems that are used for removable media are mounted with the \"nosuid\" option.\n    Check the file systems that are mounted at boot time with the following command:\n    # more /etc/fstab\n    UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0\n    If a file system found in \"/etc/fstab\" refers to removable media and it does not have the \"nosuid\" option set, this\n    is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that are associated with\n    removable media."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86667","V-72043"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204481","rid":"SV-204481r603261_rule","stig_id":"RHEL-07-021010","fix_id":"F-4605r88636_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["file_system","removable_media"],"host":null},"code":"control 'SV-204481' do\n  title 'The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from\n    being executed on file systems that are used with removable media.'\n  desc 'The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner\n    privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\"\n    files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.'\n  desc 'check', 'Verify file systems that are used for removable media are mounted with the \"nosuid\" option.\n    Check the file systems that are mounted at boot time with the following command:\n    # more /etc/fstab\n    UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0\n    If a file system found in \"/etc/fstab\" refers to removable media and it does not have the \"nosuid\" option set, this\n    is a finding.'\n  desc 'fix', 'Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that are associated with\n    removable media.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86667', 'V-72043']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204481'\n  tag rid: 'SV-204481r603261_rule'\n  tag stig_id: 'RHEL-07-021010'\n  tag fix_id: 'F-4605r88636_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['file_system', 'removable_media']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    non_removable_media_fs = input('non_removable_media_fs')\n\n    file_systems = etc_fstab.params\n    if !file_systems.nil? and !file_systems.empty?\n      file_systems.each do |file_sys_line|\n        if !non_removable_media_fs.to_s.include?(file_sys_line['file_system_type'])\n          describe file_sys_line['mount_options'] do\n            it { should include 'nosuid' }\n          end\n        else\n          describe \"File system \\\"#{file_sys_line['file_system_type']}\\\" does not correspond to removable media.\" do\n            subject do\n              non_removable_media_fs.to_s.include?(file_sys_line['file_system_type'])\n            end\n            it { should eq true }\n          end\n        end\n      end\n    else\n      describe 'No file systems were found.' do\n        subject { file_systems.nil? }\n        it { should eq true }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204481.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"No file systems were found. is expected to eq true","run_time":0.000362,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: true\n     got: false\n\n(compared using ==)\n\nDiff:\n@@ -1,2 +1,2 @@\n-true\n+false\n","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204482","title":"The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from\n    being executed on file systems that are being imported via Network File System (NFS).","desc":"The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner\n    privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\"\n    files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.","descriptions":[{"label":"default","data":"The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner\n    privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\"\n    files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access."},{"label":"check","data":"Verify file systems that are being NFS imported are configured with the \"nosuid\" option.\n    Find the file system(s) that contain the directories being exported with the following command:\n    # more /etc/fstab | grep nfs\n    UUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0\n    If a file system found in \"/etc/fstab\" refers to NFS and it does not have the \"nosuid\" option set, this is a\n    finding.\n    Verify the NFS is mounted with the \"nosuid\" option:\n    # mount | grep nfs | grep nosuid\n    If no results are returned, this is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that are being imported via\n    NFS."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86669","V-72045"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204482","rid":"SV-204482r603261_rule","stig_id":"RHEL-07-021020","fix_id":"F-4606r88639_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["etc_fstab"],"host":null,"container":null},"code":"control 'SV-204482' do\n  title 'The Red Hat Enterprise Linux operating system must prevent files with the setuid and setgid bit set from\n    being executed on file systems that are being imported via Network File System (NFS).'\n  desc 'The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner\n    privileges. This option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\"\n    files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.'\n  desc 'check', 'Verify file systems that are being NFS imported are configured with the \"nosuid\" option.\n    Find the file system(s) that contain the directories being exported with the following command:\n    # more /etc/fstab | grep nfs\n    UUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0\n    If a file system found in \"/etc/fstab\" refers to NFS and it does not have the \"nosuid\" option set, this is a\n    finding.\n    Verify the NFS is mounted with the \"nosuid\" option:\n    # mount | grep nfs | grep nosuid\n    If no results are returned, this is a finding.'\n  desc 'fix', 'Configure the \"/etc/fstab\" to use the \"nosuid\" option on file systems that are being imported via\n    NFS.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86669', 'V-72045']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204482'\n  tag rid: 'SV-204482r603261_rule'\n  tag stig_id: 'RHEL-07-021020'\n  tag fix_id: 'F-4606r88639_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['etc_fstab']\n  tag 'host'\n  tag 'container'\n\n  nfs_systems = etc_fstab.nfs_file_systems.entries\n\n  if !nfs_systems.nil? && !nfs_systems.empty?\n    nfs_systems.each do |nfs_system|\n      describe \"Network File System mounted on #{nfs_system['mount_point']}\" do\n        subject { nfs_system }\n        its('mount_options') { should include 'nosuid' }\n      end\n    end\n  else\n    describe 'No NFS file systems were found' do\n      subject { nfs_systems.nil? || nfs_systems.empty? }\n      it { should eq true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204482.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"No NFS file systems were found is expected to eq true","run_time":0.000111,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204483","title":"The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems\n    that are being imported via Network File System (NFS).","desc":"The \"noexec\" mount option causes the system to not execute binary files. This option must be used for\n    mounting any file system not containing approved binary files as they may be incompatible. Executing files from\n    untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative\n    access.","descriptions":[{"label":"default","data":"The \"noexec\" mount option causes the system to not execute binary files. This option must be used for\n    mounting any file system not containing approved binary files as they may be incompatible. Executing files from\n    untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative\n    access."},{"label":"check","data":"Verify file systems that are being NFS imported are configured with the \"noexec\" option.\n    Find the file system(s) that contain the directories being imported with the following command:\n    # more /etc/fstab | grep nfs\n    UUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0\n    If a file system found in \"/etc/fstab\" refers to NFS and it does not have the \"noexec\" option set, and use of NFS\n    imported binaries is not documented with the Information System Security Officer (ISSO) as an operational\n    requirement, this is a finding.\n    Verify the NFS is mounted with the \"noexec\"option:\n    # mount | grep nfs | grep noexec\n    If no results are returned and use of NFS imported binaries is not documented with the Information System Security\n    Officer (ISSO) as an operational requirement, this is a finding."},{"label":"fix","data":"Configure the \"/etc/fstab\" to use the \"noexec\" option on file systems that are being imported via\n    NFS."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87813","V-73161"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204483","rid":"SV-204483r603261_rule","stig_id":"RHEL-07-021021","fix_id":"F-4607r88642_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["etc_fstab"],"host":null,"container":null},"code":"control 'SV-204483' do\n  title 'The Red Hat Enterprise Linux operating system must prevent binary files from being executed on file systems\n    that are being imported via Network File System (NFS).'\n  desc 'The \"noexec\" mount option causes the system to not execute binary files. This option must be used for\n    mounting any file system not containing approved binary files as they may be incompatible. Executing files from\n    untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative\n    access.'\n  desc 'check', 'Verify file systems that are being NFS imported are configured with the \"noexec\" option.\n    Find the file system(s) that contain the directories being imported with the following command:\n    # more /etc/fstab | grep nfs\n    UUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0\n    If a file system found in \"/etc/fstab\" refers to NFS and it does not have the \"noexec\" option set, and use of NFS\n    imported binaries is not documented with the Information System Security Officer (ISSO) as an operational\n    requirement, this is a finding.\n    Verify the NFS is mounted with the \"noexec\"option:\n    # mount | grep nfs | grep noexec\n    If no results are returned and use of NFS imported binaries is not documented with the Information System Security\n    Officer (ISSO) as an operational requirement, this is a finding.'\n  desc 'fix', 'Configure the \"/etc/fstab\" to use the \"noexec\" option on file systems that are being imported via\n    NFS.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87813', 'V-73161']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204483'\n  tag rid: 'SV-204483r603261_rule'\n  tag stig_id: 'RHEL-07-021021'\n  tag fix_id: 'F-4607r88642_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['etc_fstab']\n  tag 'host'\n  tag 'container'\n\n  nfs_systems = etc_fstab.nfs_file_systems.entries\n\n  if !nfs_systems.nil? && !nfs_systems.empty?\n    nfs_systems.each do |nfs_system|\n      describe \"Network File System mounted on #{nfs_system['mount_point']}\" do\n        subject { nfs_system }\n        its('mount_options') { should include 'noexec' }\n      end\n    end\n  else\n    describe 'No NFS file systems were found' do\n      subject { nfs_systems.nil? || nfs_systems.empty? }\n      it { should eq true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204483.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"No NFS file systems were found is expected to eq true","run_time":0.000102,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204486","title":"The Red Hat Enterprise Linux operating system must mount /dev/shm with secure options.","desc":"The \"noexec\" mount option causes the system to not execute binary files. This option must be used for\n    mounting any file system not containing approved binary files as they may be incompatible. Executing files from\n    untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative\n    access.\n    The \"nodev\" mount option causes the system to not interpret character or block special devices. Executing character\n    or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.\n    The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner privileges. This\n    option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\" files. Executing\n    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized\n    administrative access.","descriptions":[{"label":"default","data":"The \"noexec\" mount option causes the system to not execute binary files. This option must be used for\n    mounting any file system not containing approved binary files as they may be incompatible. Executing files from\n    untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative\n    access.\n    The \"nodev\" mount option causes the system to not interpret character or block special devices. Executing character\n    or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.\n    The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner privileges. This\n    option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\" files. Executing\n    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized\n    administrative access."},{"label":"check","data":"Verify that the \"nodev\",\"nosuid\", and \"noexec\" options are configured for /dev/shm:\n    # cat /etc/fstab | grep /dev/shm\n    tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\n    If results are returned and the \"nodev\", \"nosuid\", or \"noexec\" options are missing, this is a finding.\n    Verify \"/dev/shm\" is mounted with the \"nodev\", \"nosuid\", and \"noexec\" options:\n    # mount | grep /dev/shm\n    tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel)\n    If /dev/shm is mounted without secure options \"nodev\", \"nosuid\", and \"noexec\", this is a finding."},{"label":"fix","data":"Configure the system so that /dev/shm is mounted with the \"nodev\", \"nosuid\", and \"noexec\" options by\n    adding /modifying the /etc/fstab with the following line:\n    tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0"}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-95725","V-81013"],"severity":"low","gtitle":"SRG-OS-000368-GPOS-00154","gid":"V-204486","rid":"SV-204486r853900_rule","stig_id":"RHEL-07-021024","fix_id":"F-4610r462553_fix","cci":["CCI-001764"],"nist":["CM-7 (2)"],"subsystems":["etc_fstab","mount"],"host":null,"container":null},"code":"control 'SV-204486' do\n  title 'The Red Hat Enterprise Linux operating system must mount /dev/shm with secure options.'\n  desc 'The \"noexec\" mount option causes the system to not execute binary files. This option must be used for\n    mounting any file system not containing approved binary files as they may be incompatible. Executing files from\n    untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative\n    access.\n    The \"nodev\" mount option causes the system to not interpret character or block special devices. Executing character\n    or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain\n    unauthorized administrative access.\n    The \"nosuid\" mount option causes the system to not execute \"setuid\" and \"setgid\" files with owner privileges. This\n    option must be used for mounting any file system not containing approved \"setuid\" and \"setguid\" files. Executing\n    files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized\n    administrative access.'\n  desc 'check', 'Verify that the \"nodev\",\"nosuid\", and \"noexec\" options are configured for /dev/shm:\n    # cat /etc/fstab | grep /dev/shm\n    tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0\n    If results are returned and the \"nodev\", \"nosuid\", or \"noexec\" options are missing, this is a finding.\n    Verify \"/dev/shm\" is mounted with the \"nodev\", \"nosuid\", and \"noexec\" options:\n    # mount | grep /dev/shm\n    tmpfs on /dev/shm type tmpfs (rw,nodev,nosuid,noexec,seclabel)\n    If /dev/shm is mounted without secure options \"nodev\", \"nosuid\", and \"noexec\", this is a finding.'\n  desc 'fix', 'Configure the system so that /dev/shm is mounted with the \"nodev\", \"nosuid\", and \"noexec\" options by\n    adding /modifying the /etc/fstab with the following line:\n    tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-95725', 'V-81013']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000368-GPOS-00154'\n  tag gid: 'V-204486'\n  tag rid: 'SV-204486r853900_rule'\n  tag stig_id: 'RHEL-07-021024'\n  tag fix_id: 'F-4610r462553_fix'\n  tag cci: ['CCI-001764']\n  tag nist: ['CM-7 (2)']\n  tag subsystems: ['etc_fstab', 'mount']\n  tag 'host'\n  tag 'container'\n\n  if mount('/dev/shm').mounted?\n\n    mount_file = etc_fstab.where { mount_point == '/dev/shm' }\n    mount_command = mount('/dev/shm').file.mounted.stdout\n                                     .match(/\\((.*)\\)/)[1].split(',')\n\n    describe.one do\n      describe '/etc/fstab mount options for /dev/shm' do\n        subject { mount_file }\n        its('mount_options.flatten') { should include 'nodev' }\n        its('mount_options.flatten') { should include 'nosuid' }\n        its('mount_options.flatten') { should include 'noexec' }\n      end\n      describe '/etc/fstab mount options for /dev/shm' do\n        subject { mount_file }\n        it { should_not exist }\n      end\n    end\n    describe 'mount command options for /dev/shm' do\n      subject { mount_command }\n      it { should include 'nodev' }\n      it { should include 'nosuid' }\n      it { should include 'noexec' }\n    end\n  else\n    describe mount('/dev/shm') do\n      it { should_not be_mounted }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204486.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204486.rb:1 ","run_time":8.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `mounted?' for nil:NilClass","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204487","title":"The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are\n    group-owned by root, sys, bin, or an application group.","desc":"If a world-writable directory is not group-owned by root, sys, bin, or an application Group Identifier\n    (GID), unauthorized users may be able to modify files created by others.\n    The only authorized public directories are those temporary directories supplied with the system or those designed to\n    be temporary file repositories. The setting is normally reserved for directories used by the system and by users for\n    temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.","descriptions":[{"label":"default","data":"If a world-writable directory is not group-owned by root, sys, bin, or an application Group Identifier\n    (GID), unauthorized users may be able to modify files created by others.\n    The only authorized public directories are those temporary directories supplied with the system or those designed to\n    be temporary file repositories. The setting is normally reserved for directories used by the system and by users for\n    temporary file storage, (e.g., /tmp), and for directories requiring global read/write access."},{"label":"check","data":"The following command will discover and print world-writable directories that are not group-owned by\n    a system account, assuming only system accounts have a GID lower than 1000. Run it once for each local partition\n    [PART]:\n    # find [PART] -xdev -type d -perm -0002 -gid +999 -print\n    If there is output, this is a finding."},{"label":"fix","data":"All directories in local partitions which are world-writable should be group-owned by root or another\n    system account. If any world-writable directories are not group-owned by a system account, this should be\n    investigated. Following this, the directories should be deleted or assigned to an appropriate group."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72047","SV-86671"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204487","rid":"SV-204487r744106_rule","stig_id":"RHEL-07-021030","fix_id":"F-36308r602634_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["world_writable","ww_dirs"],"host":null},"code":"control 'SV-204487' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are\n    group-owned by root, sys, bin, or an application group.'\n  desc 'If a world-writable directory is not group-owned by root, sys, bin, or an application Group Identifier\n    (GID), unauthorized users may be able to modify files created by others.\n    The only authorized public directories are those temporary directories supplied with the system or those designed to\n    be temporary file repositories. The setting is normally reserved for directories used by the system and by users for\n    temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.'\n  desc 'check', 'The following command will discover and print world-writable directories that are not group-owned by\n    a system account, assuming only system accounts have a GID lower than 1000. Run it once for each local partition\n    [PART]:\n    # find [PART] -xdev -type d -perm -0002 -gid +999 -print\n    If there is output, this is a finding.'\n  desc 'fix', 'All directories in local partitions which are world-writable should be group-owned by root or another\n    system account. If any world-writable directories are not group-owned by a system account, this should be\n    investigated. Following this, the directories should be deleted or assigned to an appropriate group.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72047', 'SV-86671']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204487'\n  tag rid: 'SV-204487r744106_rule'\n  tag stig_id: 'RHEL-07-021030'\n  tag fix_id: 'F-36308r602634_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['world_writable', 'ww_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    ww_dirs = Set[]\n    partitions = etc_fstab.params.map do |partition|\n      partition['mount_point']\n    end.uniq\n    partitions.each do |part|\n      cmd = \"find #{part} -xdev -type d -perm -0002 -gid +999 -print\"\n      ww_dirs += command(cmd).stdout.split(\"\\n\")\n    end\n    describe 'List of world-writeable directories not group-owned by a system account' do\n      it 'should be empty' do\n        expect(ww_dirs).to be_empty, \"Found world-writeable dirs not group-owned by system account: #{ww_dirs.to_a.join(', ')}\"\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204487.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"List of world-writeable directories not group-owned by a system account should be empty","run_time":0.010975,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204488","title":"The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive\n    user accounts.","desc":"The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files\n    to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit\n    representing special access modes is typically ignored or required to be \"0\". This requirement applies to the\n    globally configured system defaults and the local interactive user defaults for each account on the system.","descriptions":[{"label":"default","data":"The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files\n    to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit\n    representing special access modes is typically ignored or required to be \"0\". This requirement applies to the\n    globally configured system defaults and the local interactive user defaults for each account on the system."},{"label":"check","data":"Verify that the default umask for all local interactive users is \"077\".\n\nIdentify the locations of all local interactive user home directories by looking at the \"/etc/passwd\" file.\n\nCheck all local interactive user initialization files for interactive users with the following command:\n\nNote: The example is for a system that is configured to create users home directories in the \"/home\" directory.\n\n$ sudo grep -ir ^umask /home | grep -v '.bash_history'\n\nIf any local interactive user initialization files are found to have a umask statement that has a value less restrictive than \"077\", this is a finding."},{"label":"fix","data":"Remove the umask statement from all local interactive user's initialization files.\n    If the account is for an application, the requirement for a umask less restrictive than \"077\" can be documented with\n    the Information System Security Officer, but the user agreement for access to the account must specify that the\n    local interactive user must log on to their account first and then switch the user to the application account with\n    the correct option to gain the account's environment variables."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72049","SV-86673"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204488","rid":"SV-204488r861006_rule","stig_id":"RHEL-07-021040","fix_id":"F-4612r88657_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["init_files","home_dirs"],"host":null},"code":"control 'SV-204488' do\n  title 'The Red Hat Enterprise Linux operating system must set the umask value to 077 for all local interactive\n    user accounts.'\n  desc 'The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files\n    to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit\n    representing special access modes is typically ignored or required to be \"0\". This requirement applies to the\n    globally configured system defaults and the local interactive user defaults for each account on the system.'\n  desc 'check', %q(Verify that the default umask for all local interactive users is \"077\".\n\nIdentify the locations of all local interactive user home directories by looking at the \"/etc/passwd\" file.\n\nCheck all local interactive user initialization files for interactive users with the following command:\n\nNote: The example is for a system that is configured to create users home directories in the \"/home\" directory.\n\n$ sudo grep -ir ^umask /home | grep -v '.bash_history'\n\nIf any local interactive user initialization files are found to have a umask statement that has a value less restrictive than \"077\", this is a finding.)\n  desc 'fix', %q(Remove the umask statement from all local interactive user's initialization files.\n    If the account is for an application, the requirement for a umask less restrictive than \"077\" can be documented with\n    the Information System Security Officer, but the user agreement for access to the account must specify that the\n    local interactive user must log on to their account first and then switch the user to the application account with\n    the correct option to gain the account's environment variables.)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72049', 'SV-86673']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204488'\n  tag rid: 'SV-204488r861006_rule'\n  tag stig_id: 'RHEL-07-021040'\n  tag fix_id: 'F-4612r88657_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['init_files', 'home_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    non_interactive_shells = input('non_interactive_shells')\n\n    # Get all interactive users\n    ignore_shells = non_interactive_shells.join('|')\n\n    # Get home directory for users with UID >= 1000 or UID == 0 and support interactive logins.\n    findings = Set[]\n    dotfiles = Set[]\n    umasks = {}\n    umask_findings = Set[]\n\n    # Get UID_MIN from login.defs\n    uid_min = 1000\n    if file('/etc/login.defs').exist?\n      uid_min_val = command(\"grep '^UID_MIN' /etc/login.defs | grep -Po '[0-9]+'\").stdout.split(\"\\n\")\n      uid_min = uid_min_val[0].to_i unless uid_min_val.empty?\n    end\n\n    interactive_users = users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min || uid == 0)\n    end.entries\n\n    # For each user, build and execute a find command that identifies initialization files\n    # in a user's home directory.\n    interactive_users.each do |u|\n      # Only check if the home directory is local\n      is_local = command(\"df -l #{u.home}\").exit_status\n\n      if is_local == 0\n        # Get user's initialization files\n        dotfiles += command(\"find #{u.home} -xdev -maxdepth 2 ( -name '.*' ! -name '.bash_history' ) -type f\").stdout.split(\"\\n\")\n\n        # Get user's umask\n        umasks.store(u.username,\n                    command(\"su -c 'umask' -l #{u.username}\").stdout.chomp(\"\\n\"))\n\n        # Check all local initialization files to see whether or not they are less restrictive than the input UMASK.\n        dotfiles.each do |df|\n          findings += df if file(df).more_permissive_than?(input('user_umask'))\n        end\n\n        # Check umask for all interactive users\n        umasks.each do |key, value|\n          max_mode = (input('user_umask')).to_i(8)\n          inv_mode = 0777 ^ max_mode\n          umask_findings += key if inv_mode & (value).to_i(8) != 0\n        end\n      else\n        describe 'This control skips non-local filesystems' do\n          skip \"This control has skipped the #{u.home} home directory for #{u.username} because it is not a local filesystem.\"\n        end\n      end\n    end\n\n    # Report on any interactive files that are less restrictive than the input UMASK.\n    describe 'No interactive user initialization files with a less restrictive umask were found.' do\n      subject { findings.empty? }\n      it { should eq true }\n    end\n\n    # Report on any interactive users that have a umask less restrictive than the input UMASK.\n    describe 'No users were found with a less restrictive umask were found.' do\n      subject { umask_findings.empty? }\n      it { should eq true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204488.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"No interactive user initialization files with a less restrictive umask were found. is expected to eq true","run_time":0.000109,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"No users were found with a less restrictive umask were found. is expected to eq true","run_time":0.00011,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204489","title":"The Red Hat Enterprise Linux operating system must have cron logging implemented.","desc":"Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used\n    to spot intrusions into the use of the cron facility by unauthorized and malicious users.","descriptions":[{"label":"default","data":"Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used\n    to spot intrusions into the use of the cron facility by unauthorized and malicious users."},{"label":"check","data":"Verify that \"rsyslog\" is configured to log cron events.\n    Check the configuration of \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files for the cron facility with the\n    following command:\n    Note: If another logging package is used, substitute the utility configuration file for \"/etc/rsyslog.conf\" or\n    \"/etc/rsyslog.d/*.conf\" files.\n    # grep cron /etc/rsyslog.conf  /etc/rsyslog.d/*.conf\n    cron.* /var/log/cron\n    If the command does not return a response, check for cron logging all facilities by inspecting the\n    \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files.\n    Look for the following entry:\n    *.* /var/log/messages\n    If \"rsyslog\" is not logging messages for the cron facility or all facilities, this is a finding."},{"label":"fix","data":"Configure \"rsyslog\" to log all cron messages by adding or updating the following line to\n    \"/etc/rsyslog.conf\" or a configuration file in the /etc/rsyslog.d/ directory:\n    cron.* /var/log/cron\n    The rsyslog daemon must be restarted for the changes to take effect:\n    $ sudo systemctl restart rsyslog.service"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72051","SV-86675"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204489","rid":"SV-204489r744109_rule","stig_id":"RHEL-07-021100","fix_id":"F-4613r744108_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["cron","rsyslog"],"host":null,"container":null},"code":"control 'SV-204489' do\n  title 'The Red Hat Enterprise Linux operating system must have cron logging implemented.'\n  desc 'Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used\n    to spot intrusions into the use of the cron facility by unauthorized and malicious users.'\n  desc 'check', 'Verify that \"rsyslog\" is configured to log cron events.\n    Check the configuration of \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files for the cron facility with the\n    following command:\n    Note: If another logging package is used, substitute the utility configuration file for \"/etc/rsyslog.conf\" or\n    \"/etc/rsyslog.d/*.conf\" files.\n    # grep cron /etc/rsyslog.conf  /etc/rsyslog.d/*.conf\n    cron.* /var/log/cron\n    If the command does not return a response, check for cron logging all facilities by inspecting the\n    \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files.\n    Look for the following entry:\n    *.* /var/log/messages\n    If \"rsyslog\" is not logging messages for the cron facility or all facilities, this is a finding.'\n  desc 'fix', 'Configure \"rsyslog\" to log all cron messages by adding or updating the following line to\n    \"/etc/rsyslog.conf\" or a configuration file in the /etc/rsyslog.d/ directory:\n    cron.* /var/log/cron\n    The rsyslog daemon must be restarted for the changes to take effect:\n    $ sudo systemctl restart rsyslog.service'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72051', 'SV-86675']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204489'\n  tag rid: 'SV-204489r744109_rule'\n  tag stig_id: 'RHEL-07-021100'\n  tag fix_id: 'F-4613r744108_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['cron', 'rsyslog']\n  tag 'host'\n  tag 'container'\n\n  log_pkg_paths = input('log_pkg_paths').join(' ')\n  cron_log = command(\"grep cron #{log_pkg_paths}\").stdout.strip\n  facilities_log = inspec.command(\"grep '/var/log/messages' #{log_pkg_paths}\").stdout.strip\n\n  describe.one do\n    describe 'cron' do\n      it 'should be configured for logging in the logging utility config files' do\n        expect(cron_log).to match(/:cron/), \"cron not found in #{log_pkg_paths}\"\n      end\n    end\n    describe 'All facilities' do\n      it 'should be configured for logging in the logging utility config files' do\n        expect(facilities_log).to match(%r{^.+:\\*\\.\\*\\s+/var/log/messages}), \"cron not found in #{log_pkg_paths}\"\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204489.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"cron should be configured for logging in the logging utility config files","run_time":0.000262,"start_time":"2023-04-18T13:20:14-04:00","message":"cron not found in /etc/rsyslog.conf /etc/rsyslog.d/*\nDiff:\n@@ -1,2 +1,2 @@\n-/:cron/\n+\"\"\n","exception":"RSpec::Core::MultipleExceptionError","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"All facilities should be configured for logging in the logging utility config files","run_time":0.000196,"start_time":"2023-04-18T13:20:14-04:00","message":"cron not found in /etc/rsyslog.conf /etc/rsyslog.d/*\nDiff:\n@@ -1,2 +1,2 @@\n-/^.+:\\*\\.\\*\\s+\\/var\\/log\\/messages/\n+\"\"\n","exception":"RSpec::Core::MultipleExceptionError","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204490","title":"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists,\n    is owned by root.","desc":"If the owner of the \"cron.allow\" file is not set to root, the possibility exists for an unauthorized user to\n    view or to edit sensitive information.","descriptions":[{"label":"default","data":"If the owner of the \"cron.allow\" file is not set to root, the possibility exists for an unauthorized user to\n    view or to edit sensitive information."},{"label":"check","data":"Verify that the \"cron.allow\" file is owned by root.\n    Check the owner of the \"cron.allow\" file with the following command:\n    # ls -al /etc/cron.allow\n    -rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\n    If the \"cron.allow\" file exists and has an owner other than root, this is a finding."},{"label":"fix","data":"Set the owner on the \"/etc/cron.allow\" file to root with the following\ncommand:\n\n    # chown root /etc/cron.allow"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72053","SV-86677"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204490","rid":"SV-204490r603261_rule","stig_id":"RHEL-07-021110","fix_id":"F-4614r88663_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["cron"],"host":null,"container":null},"code":"control 'SV-204490' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists,\n    is owned by root.'\n  desc 'If the owner of the \"cron.allow\" file is not set to root, the possibility exists for an unauthorized user to\n    view or to edit sensitive information.'\n  desc 'check', 'Verify that the \"cron.allow\" file is owned by root.\n    Check the owner of the \"cron.allow\" file with the following command:\n    # ls -al /etc/cron.allow\n    -rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\n    If the \"cron.allow\" file exists and has an owner other than root, this is a finding.'\n  desc 'fix', 'Set the owner on the \"/etc/cron.allow\" file to root with the following\ncommand:\n\n    # chown root /etc/cron.allow'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72053', 'SV-86677']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204490'\n  tag rid: 'SV-204490r603261_rule'\n  tag stig_id: 'RHEL-07-021110'\n  tag fix_id: 'F-4614r88663_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['cron']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    # case where file doesn't exist\n    describe file('/etc/cron.allow') do\n      it { should_not exist }\n    end\n    # case where file exists\n    describe file('/etc/cron.allow') do\n      it { should be_owned_by 'root' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204490.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"File /etc/cron.allow is expected not to exist","run_time":0.000119,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"file","resource_params":"[\"/etc/cron.allow\"]"}]},{"id":"SV-204491","title":"The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists,\n    is group-owned by root.","desc":"If the group owner of the \"cron.allow\" file is not set to root, sensitive information could be viewed or\n    edited by unauthorized users.","descriptions":[{"label":"default","data":"If the group owner of the \"cron.allow\" file is not set to root, sensitive information could be viewed or\n    edited by unauthorized users."},{"label":"check","data":"Verify that the \"cron.allow\" file is group-owned by root.\n    Check the group owner of the \"cron.allow\" file with the following command:\n    # ls -al /etc/cron.allow\n    -rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\n    If the \"cron.allow\" file exists and has a group owner other than root, this is a finding."},{"label":"fix","data":"Set the group owner on the \"/etc/cron.allow\" file to root with the\nfollowing command:\n\n    # chgrp root /etc/cron.allow"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86679","V-72055"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204491","rid":"SV-204491r603261_rule","stig_id":"RHEL-07-021120","fix_id":"F-4615r88666_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["cron"],"host":null,"container":null},"code":"control 'SV-204491' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the cron.allow file, if it exists,\n    is group-owned by root.'\n  desc 'If the group owner of the \"cron.allow\" file is not set to root, sensitive information could be viewed or\n    edited by unauthorized users.'\n  desc 'check', 'Verify that the \"cron.allow\" file is group-owned by root.\n    Check the group owner of the \"cron.allow\" file with the following command:\n    # ls -al /etc/cron.allow\n    -rw------- 1 root root 6 Mar  5  2011 /etc/cron.allow\n    If the \"cron.allow\" file exists and has a group owner other than root, this is a finding.'\n  desc 'fix', 'Set the group owner on the \"/etc/cron.allow\" file to root with the\nfollowing command:\n\n    # chgrp root /etc/cron.allow'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86679', 'V-72055']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204491'\n  tag rid: 'SV-204491r603261_rule'\n  tag stig_id: 'RHEL-07-021120'\n  tag fix_id: 'F-4615r88666_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['cron']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    # case where file doesn't exist\n    describe file('/etc/cron.allow') do\n      it { should_not exist }\n    end\n    # case where file exists\n    describe file('/etc/cron.allow') do\n      its('group') { should eq 'root' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204491.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"File /etc/cron.allow is expected not to exist","run_time":9.0e-05,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"file","resource_params":"[\"/etc/cron.allow\"]"}]},{"id":"SV-204492","title":"The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed.","desc":"Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps\n    may consume a considerable amount of disk space and may result in denial of service by exhausting the available\n    space on the target file system partition.","descriptions":[{"label":"default","data":"Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps\n    may consume a considerable amount of disk space and may result in denial of service by exhausting the available\n    space on the target file system partition."},{"label":"check","data":"Verify that kernel core dumps are disabled unless needed.\n    Check the status of the \"kdump\" service with the following command:\n    # systemctl status kdump.service\n    kdump.service - Crash recovery kernel arming\n    Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled)\n    Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago\n    Main PID: 1130 (code=exited, status=0/SUCCESS)\n    kernel arming.\n    If the \"kdump\" service is active, ask the System Administrator if the use of the service is required and documented\n    with the Information System Security Officer (ISSO).\n    If the service is active and is not documented, this is a finding."},{"label":"fix","data":"If kernel core dumps are not required, disable the \"kdump\" service with the following command:\n    # systemctl disable kdump.service\n    If kernel core dumps are required, document the need with the ISSO."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86681","V-72057"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204492","rid":"SV-204492r603261_rule","stig_id":"RHEL-07-021300","fix_id":"F-4616r88669_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kdump","kernel"],"host":null},"code":"control 'SV-204492' do\n  title 'The Red Hat Enterprise Linux operating system must disable Kernel core dumps unless needed.'\n  desc 'Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps\n    may consume a considerable amount of disk space and may result in denial of service by exhausting the available\n    space on the target file system partition.'\n  desc 'check', 'Verify that kernel core dumps are disabled unless needed.\n    Check the status of the \"kdump\" service with the following command:\n    # systemctl status kdump.service\n    kdump.service - Crash recovery kernel arming\n    Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled)\n    Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago\n    Main PID: 1130 (code=exited, status=0/SUCCESS)\n    kernel arming.\n    If the \"kdump\" service is active, ask the System Administrator if the use of the service is required and documented\n    with the Information System Security Officer (ISSO).\n    If the service is active and is not documented, this is a finding.'\n  desc 'fix', 'If kernel core dumps are not required, disable the \"kdump\" service with the following command:\n    # systemctl disable kdump.service\n    If kernel core dumps are required, document the need with the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86681', 'V-72057']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204492'\n  tag rid: 'SV-204492r603261_rule'\n  tag stig_id: 'RHEL-07-021300'\n  tag fix_id: 'F-4616r88669_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kdump', 'kernel']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe systemd_service('kdump.service') do\n      it { should_not be_running }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204492.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service kdump.service ","run_time":7.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `systemd_service` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"systemd_service","resource_params":"[\"kdump.service\"]"}]},{"id":"SV-204493","title":"The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for\n    user home directories (such as /home or an equivalent).","desc":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing."},{"label":"check","data":"Verify that a separate file system/partition has been created for non-privileged local interactive\n    user home directories.\n    Check the home directory assignment for all non-privileged users (those with a UID of 1000 or greater) on the system\n    with the following command:\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6, $7}' /etc/passwd\n    adamsj 1000 /home/adamsj /bin/bash\n    jacksonm 1001 /home/jacksonm /bin/bash\n    smithj 1002 /home/smithj /bin/bash\n    The output of the command will give the directory/partition that contains the home directories for the\n    non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such\n    as /bin/bash) are considered interactive users.\n    Check that a file system/partition has been created for the non-privileged interactive users with the following\n    command:\n    Note: The partition of /home is used in the example.\n    # grep /home /etc/fstab\n    UUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\n    If a separate entry for the file system/partition that contains the non-privileged interactive users' home\n    directories does not exist, this is a finding."},{"label":"fix","data":"Migrate the \"/home\" directory onto a separate file system/partition."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86683","V-72059"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204493","rid":"SV-204493r603840_rule","stig_id":"RHEL-07-021310","fix_id":"F-4617r88672_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["home_dirs","file_system"],"host":null},"code":"control 'SV-204493' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that a separate file system is used for\n    user home directories (such as /home or an equivalent).'\n  desc 'The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.'\n  desc 'check', \"Verify that a separate file system/partition has been created for non-privileged local interactive\n    user home directories.\n    Check the home directory assignment for all non-privileged users (those with a UID of 1000 or greater) on the system\n    with the following command:\n    # awk -F: '($3>=1000)&&($7 !~ /nologin/){print $1, $3, $6, $7}' /etc/passwd\n    adamsj 1000 /home/adamsj /bin/bash\n    jacksonm 1001 /home/jacksonm /bin/bash\n    smithj 1002 /home/smithj /bin/bash\n    The output of the command will give the directory/partition that contains the home directories for the\n    non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such\n    as /bin/bash) are considered interactive users.\n    Check that a file system/partition has been created for the non-privileged interactive users with the following\n    command:\n    Note: The partition of /home is used in the example.\n    # grep /home /etc/fstab\n    UUID=333ada18    /home                   ext4    noatime,nobarrier,nodev  1 2\n    If a separate entry for the file system/partition that contains the non-privileged interactive users' home\n    directories does not exist, this is a finding.\"\n  desc 'fix', 'Migrate the \"/home\" directory onto a separate file system/partition.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86683', 'V-72059']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204493'\n  tag rid: 'SV-204493r603840_rule'\n  tag stig_id: 'RHEL-07-021310'\n  tag fix_id: 'F-4617r88672_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['home_dirs', 'file_system']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    exempt_home_users = input('exempt_home_users')\n    non_interactive_shells = input('non_interactive_shells')\n\n    ignore_shells = non_interactive_shells.join('|')\n\n    uid_min = login_defs.read_params['UID_MIN'].to_i\n    uid_min = 1000 if uid_min.nil?\n\n    # excluding root because its home directory is usually \"/root\" (mountpoint \"/\")\n    users.where do\n      !shell.match(ignore_shells) && (uid >= uid_min)\n    end.entries.each do |user_info|\n      next if exempt_home_users.include?(user_info.username.to_s)\n\n      home_mount = command(%(df #{user_info.home} --output=target | tail -1)).stdout.strip\n      describe user_info.username do\n        context 'with mountpoint' do\n          context home_mount do\n            it { should_not be_empty }\n            it { should_not match(%r{^/$}) }\n          end\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204493.rb"},"waiver_data":{},"results":[]},{"id":"SV-204494","title":"The Red Hat Enterprise Linux operating system must use a separate file system for /var.","desc":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing."},{"label":"check","data":"Verify that a separate file system/partition has been created for \"/var\".\n    Check that a file system/partition has been created for \"/var\" with the following command:\n    # grep /var /etc/fstab\n    UUID=c274f65f    /var                    ext4    noatime,nobarrier        1 2\n    If a separate entry for \"/var\" is not in use, this is a finding."},{"label":"fix","data":"Migrate the \"/var\" path onto a separate file system."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72061","SV-86685"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204494","rid":"SV-204494r603261_rule","stig_id":"RHEL-07-021320","fix_id":"F-4618r88675_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["/var","file_system"],"host":null},"code":"control 'SV-204494' do\n  title 'The Red Hat Enterprise Linux operating system must use a separate file system for /var.'\n  desc 'The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.'\n  desc 'check', 'Verify that a separate file system/partition has been created for \"/var\".\n    Check that a file system/partition has been created for \"/var\" with the following command:\n    # grep /var /etc/fstab\n    UUID=c274f65f    /var                    ext4    noatime,nobarrier        1 2\n    If a separate entry for \"/var\" is not in use, this is a finding.'\n  desc 'fix', 'Migrate the \"/var\" path onto a separate file system.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72061', 'SV-86685']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204494'\n  tag rid: 'SV-204494r603261_rule'\n  tag stig_id: 'RHEL-07-021320'\n  tag fix_id: 'F-4618r88675_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['/var', 'file_system']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n    describe etc_fstab.where { mount_point == '/var/log' } do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204494.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"File System Table File (fstab) with mount_point == \"/var/log\"","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"File System Table File (fstab) with mount_point == \"/var/log\"","skip_message":"Can't find file: /etc/fstab","resource_class":"FilterTable::Table","resource_params":"[]"}]},{"id":"SV-204495","title":"The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data\n    path.","desc":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing."},{"label":"check","data":"Determine if the operating system is configured to have the \"/var/log/audit\" path is on a separate\n    file system.\n    # grep /var/log/audit /etc/fstab\n    If no result is returned, or the operating system is not configured to have \"/var/log/audit\" on a separate file\n    system, this is a finding.\n    Verify that \"/var/log/audit\" is mounted on a separate file system:\n    # mount | grep \"/var/log/audit\"\n    If no result is returned, or \"/var/log/audit\" is not on a separate file system, this is a finding."},{"label":"fix","data":"Migrate the system audit data path onto a separate file system."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86687","V-72063"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204495","rid":"SV-204495r603261_rule","stig_id":"RHEL-07-021330","fix_id":"F-4619r88678_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["file_system","audit"],"host":null},"code":"control 'SV-204495' do\n  title 'The Red Hat Enterprise Linux operating system must use a separate file system for the system audit data\n    path.'\n  desc 'The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.'\n  desc 'check', 'Determine if the operating system is configured to have the \"/var/log/audit\" path is on a separate\n    file system.\n    # grep /var/log/audit /etc/fstab\n    If no result is returned, or the operating system is not configured to have \"/var/log/audit\" on a separate file\n    system, this is a finding.\n    Verify that \"/var/log/audit\" is mounted on a separate file system:\n    # mount | grep \"/var/log/audit\"\n    If no result is returned, or \"/var/log/audit\" is not on a separate file system, this is a finding.'\n  desc 'fix', 'Migrate the system audit data path onto a separate file system.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86687', 'V-72063']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204495'\n  tag rid: 'SV-204495r603261_rule'\n  tag stig_id: 'RHEL-07-021330'\n  tag fix_id: 'F-4619r88678_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['file_system', 'audit']\n  tag 'host'\n\n  audit_data_path = command(\"dirname #{auditd_conf.log_file}\").stdout.strip\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n    describe etc_fstab.where { mount_point == audit_data_path } do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204495.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"File System Table File (fstab) with mount_point == \"\"","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"File System Table File (fstab) with mount_point == \"\"","skip_message":"Can't find file: /etc/fstab","resource_class":"FilterTable::Table","resource_params":"[]"}]},{"id":"SV-204496","title":"The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).","desc":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.","descriptions":[{"label":"default","data":"The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing."},{"label":"check","data":"Verify that a separate file system/partition has been created for \"/tmp\".\n    Check that a file system/partition has been created for \"/tmp\" with the following command:\n    # systemctl is-enabled tmp.mount\n    enabled\n    If the \"tmp.mount\" service is not enabled, check to see if \"/tmp\" is defined in the fstab with a device and mount\n    point:\n    # grep -i /tmp /etc/fstab\n    UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0\n    If \"tmp.mount\" service is not enabled or the \"/tmp\" directory is not defined in the fstab with a device and mount\n    point, this is a finding."},{"label":"fix","data":"Start the \"tmp.mount\" service with the following command:\n    # systemctl enable tmp.mount\n    OR\n    Edit the \"/etc/fstab\" file and ensure the \"/tmp\" directory is defined in the fstab with a device and mount point."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86689","V-72065"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204496","rid":"SV-204496r603261_rule","stig_id":"RHEL-07-021340","fix_id":"F-36309r602637_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["file_system","tmp"],"host":null},"code":"control 'SV-204496' do\n  title 'The Red Hat Enterprise Linux operating system must use a separate file system for /tmp (or equivalent).'\n  desc 'The use of separate file systems for different paths can protect the system from failures resulting from a\n    file system becoming full or failing.'\n  desc 'check', 'Verify that a separate file system/partition has been created for \"/tmp\".\n    Check that a file system/partition has been created for \"/tmp\" with the following command:\n    # systemctl is-enabled tmp.mount\n    enabled\n    If the \"tmp.mount\" service is not enabled, check to see if \"/tmp\" is defined in the fstab with a device and mount\n    point:\n    # grep -i /tmp /etc/fstab\n    UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp   ext4   rw,relatime,discard,data=ordered,nosuid,noexec, 0 0\n    If \"tmp.mount\" service is not enabled or the \"/tmp\" directory is not defined in the fstab with a device and mount\n    point, this is a finding.'\n  desc 'fix', 'Start the \"tmp.mount\" service with the following command:\n    # systemctl enable tmp.mount\n    OR\n    Edit the \"/etc/fstab\" file and ensure the \"/tmp\" directory is defined in the fstab with a device and mount point.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86689', 'V-72065']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204496'\n  tag rid: 'SV-204496r603261_rule'\n  tag stig_id: 'RHEL-07-021340'\n  tag fix_id: 'F-36309r602637_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['file_system', 'tmp']\n  tag 'host'\n\n  describe.one do\n    describe systemd_service('tmp.mount') do\n      it { should be_enabled }\n    end\n    describe etc_fstab.where { mount_point == '/tmp' } do\n      its('count') { should cmp 1 }\n      it 'Should have a device name specified' do\n        expect(subject.device_name[0]).to_not(be_empty)\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204496.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service tmp.mount is expected to be enabled","run_time":0.00027,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service tmp.mount` is enabled","exception":"RSpec::Core::MultipleExceptionError","resource_class":"systemd_service","resource_params":"[\"tmp.mount\"]"},{"status":"failed","code_desc":"File System Table File (fstab) with mount_point == \"/tmp\" Should have a device name specified","run_time":0.000402,"start_time":"2023-04-18T13:20:14-04:00","message":"expected nil to respond to `empty?`","exception":"RSpec::Core::MultipleExceptionError","resource_class":"FilterTable::Table","resource_params":"[]"},{"status":"failed","code_desc":"File System Table File (fstab) with mount_point == \"/tmp\" count is expected to cmp == 1","run_time":0.000202,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: 1\n     got: 0\n\n(compared using `cmp` matcher)\n","exception":"RSpec::Core::MultipleExceptionError","resource_class":"FilterTable::Table","resource_params":"[]"}]},{"id":"SV-204497","title":"The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the\n    following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring\n    data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies,\n    regulations, and standards.","desc":"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\n    The operating system must implement cryptographic modules adhering to the higher standards approved by the federal\n    government since this provides assurance they have been tested and validated.","descriptions":[{"label":"default","data":"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\n    The operating system must implement cryptographic modules adhering to the higher standards approved by the federal\n    government since this provides assurance they have been tested and validated."},{"label":"check","data":"Verify the operating system implements DoD-approved encryption to protect the confidentiality of\n    remote access sessions.\n    Check to see if the \"dracut-fips\" package is installed with the following command:\n    # yum list installed dracut-fips\n    dracut-fips-033-360.el7_2.x86_64.rpm\n    If a \"dracut-fips\" package is installed, check to see if the kernel command line is configured to use FIPS mode with\n    the following command:\n    Note: GRUB 2 reads its configuration from the \"/boot/grub2/grub.cfg\" file on traditional BIOS-based machines and\n    from the \"/boot/efi/EFI/redhat/grub.cfg\" file on UEFI machines.\n    # grep fips /boot/grub2/grub.cfg\n    /vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto\n    rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet\n    If the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the\n    following command:\n    # cat /proc/sys/crypto/fips_enabled\n    1\n    If a \"dracut-fips\" package is not installed, the kernel command line does not have a fips entry, or the system has a\n    value of \"0\" for \"fips_enabled\" in \"/proc/sys/crypto\", this is a finding.\n    Verify the file /etc/system-fips exists.\n    # ls -l /etc/system-fips\n    If this file does not exist, this is a finding."},{"label":"fix","data":"Configure the operating system to implement DoD-approved encryption by installing the dracut-fips\n    package.\n    To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during\n    system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in\n    place.\n    Configure the operating system to implement DoD-approved encryption by following the steps below:\n    The fips=1 kernel option needs to be added to the kernel command line during system installation so that key\n    generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure\n    that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is\n    available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than\n    256 keystrokes may generate a non-unique key.\n    Install the dracut-fips package with the following command:\n    # yum install dracut-fips\n    Recreate the \"initramfs\" file with the following command:\n    Note: This command will overwrite the existing \"initramfs\" file.\n    # dracut -f\n    Modify the kernel command line of the current kernel in the \"grub.cfg\" file by adding the following option to the\n    GRUB_CMDLINE_LINUX key in the \"/etc/default/grub\" file and then rebuild the \"grub.cfg\" file:\n    fips=1\n    Changes to \"/etc/default/grub\" require rebuilding the \"grub.cfg\" file as follows:\n    On BIOS-based machines, use the following command:\n    # grub2-mkconfig -o /boot/grub2/grub.cfg\n    On UEFI-based machines, use the following command:\n    # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg\n    If /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi>\n    must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi\n    command:\n    # df /boot\n    Filesystem 1K-blocks Used Available Use% Mounted on\n    /dev/sda1 495844 53780 416464 12% /boot\n    To ensure the \"boot=\" configuration option will work even if device naming changes occur between boots, identify the\n    universally unique identifier (UUID) of the partition with the following command:\n    # blkid /dev/sda1\n    /dev/sda1: UUID=\"05c000f1-a213-759e-c7a2-f11b7424c797\" TYPE=\"ext4\"\n    For the example above, append the following string to the kernel command line:\n    boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797\n    If the file /etc/system-fips does not exists, recreate it:\n    # touch /etc/ system-fips\n    Reboot the system for the changes to take effect."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86691","V-72067"],"severity":"high","gtitle":"SRG-OS-000033-GPOS-00014","satisfies":["SRG-OS-000033-GPOS-00014","SRG-OS-000185-GPOS-00079","SRG-OS-000396-GPOS-00176","SRG-OS-000405-GPOS-00184","SRG-OS-000478-GPOS-00223"],"gid":"V-204497","rid":"SV-204497r877398_rule","stig_id":"RHEL-07-021350","fix_id":"F-36310r602640_fix","cci":["CCI-000068","CCI-001199","CCI-002450","CCI-002476"],"nist":["AC-17 (2)","SC-28","SC-13","SC-28 (1)","SC-13 b"],"subsystems":["fips"],"host":null},"code":"control 'SV-204497' do\n  title 'The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the\n    following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring\n    data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies,\n    regulations, and standards.'\n  desc 'Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\n    The operating system must implement cryptographic modules adhering to the higher standards approved by the federal\n    government since this provides assurance they have been tested and validated.'\n  desc 'check', 'Verify the operating system implements DoD-approved encryption to protect the confidentiality of\n    remote access sessions.\n    Check to see if the \"dracut-fips\" package is installed with the following command:\n    # yum list installed dracut-fips\n    dracut-fips-033-360.el7_2.x86_64.rpm\n    If a \"dracut-fips\" package is installed, check to see if the kernel command line is configured to use FIPS mode with\n    the following command:\n    Note: GRUB 2 reads its configuration from the \"/boot/grub2/grub.cfg\" file on traditional BIOS-based machines and\n    from the \"/boot/efi/EFI/redhat/grub.cfg\" file on UEFI machines.\n    # grep fips /boot/grub2/grub.cfg\n    /vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto\n    rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet\n    If the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the\n    following command:\n    # cat /proc/sys/crypto/fips_enabled\n    1\n    If a \"dracut-fips\" package is not installed, the kernel command line does not have a fips entry, or the system has a\n    value of \"0\" for \"fips_enabled\" in \"/proc/sys/crypto\", this is a finding.\n    Verify the file /etc/system-fips exists.\n    # ls -l /etc/system-fips\n    If this file does not exist, this is a finding.'\n  desc 'fix', 'Configure the operating system to implement DoD-approved encryption by installing the dracut-fips\n    package.\n    To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during\n    system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in\n    place.\n    Configure the operating system to implement DoD-approved encryption by following the steps below:\n    The fips=1 kernel option needs to be added to the kernel command line during system installation so that key\n    generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure\n    that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is\n    available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than\n    256 keystrokes may generate a non-unique key.\n    Install the dracut-fips package with the following command:\n    # yum install dracut-fips\n    Recreate the \"initramfs\" file with the following command:\n    Note: This command will overwrite the existing \"initramfs\" file.\n    # dracut -f\n    Modify the kernel command line of the current kernel in the \"grub.cfg\" file by adding the following option to the\n    GRUB_CMDLINE_LINUX key in the \"/etc/default/grub\" file and then rebuild the \"grub.cfg\" file:\n    fips=1\n    Changes to \"/etc/default/grub\" require rebuilding the \"grub.cfg\" file as follows:\n    On BIOS-based machines, use the following command:\n    # grub2-mkconfig -o /boot/grub2/grub.cfg\n    On UEFI-based machines, use the following command:\n    # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg\n    If /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi>\n    must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi\n    command:\n    # df /boot\n    Filesystem 1K-blocks Used Available Use% Mounted on\n    /dev/sda1 495844 53780 416464 12% /boot\n    To ensure the \"boot=\" configuration option will work even if device naming changes occur between boots, identify the\n    universally unique identifier (UUID) of the partition with the following command:\n    # blkid /dev/sda1\n    /dev/sda1: UUID=\"05c000f1-a213-759e-c7a2-f11b7424c797\" TYPE=\"ext4\"\n    For the example above, append the following string to the kernel command line:\n    boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797\n    If the file /etc/system-fips does not exists, recreate it:\n    # touch /etc/ system-fips\n    Reboot the system for the changes to take effect.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86691', 'V-72067']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000033-GPOS-00014'\n  tag satisfies: ['SRG-OS-000033-GPOS-00014', 'SRG-OS-000185-GPOS-00079', 'SRG-OS-000396-GPOS-00176', 'SRG-OS-000405-GPOS-00184', 'SRG-OS-000478-GPOS-00223']\n  tag gid: 'V-204497'\n  tag rid: 'SV-204497r877398_rule'\n  tag stig_id: 'RHEL-07-021350'\n  tag fix_id: 'F-36310r602640_fix'\n  tag cci: ['CCI-000068', 'CCI-001199', 'CCI-002450', 'CCI-002476']\n  tag nist: ['AC-17 (2)', 'SC-28', 'SC-13', 'SC-28 (1)', 'SC-13 b']\n  tag subsystems: ['fips']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config for FIPS capability must be done on the host' do\n      skip 'Control not applicable - Kernel config for FIPS capability must be done on the host'\n    end\n  else\n    describe package('dracut-fips') do\n      it { should be_installed }\n    end\n\n    all_args = # strip outer quotes if they exist\n      command('grubby --info=ALL | grep \"^args=\" | sed \"s/^args=//g\"')\n      .stdout.strip.split(\"\\n\")\n      .map do |s|\n        s.sub(/^\"(.*)\"$/, '\\1')\n      end\n    all_args.each do |args|\n      describe args do\n        it { should match(/\\bfips=1\\b/) }\n      end\n    end\n\n    describe file('/proc/sys/crypto/fips_enabled') do\n      its('content.strip') { should cmp 1 }\n    end\n\n    describe file('/etc/system-fips') do\n      it { should exist }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204497.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package dracut-fips","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package dracut-fips","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"dracut-fips\"]"},{"status":"failed","code_desc":"File /proc/sys/crypto/fips_enabled ","run_time":7.6e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `file` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"file","resource_params":"[\"/proc/sys/crypto/fips_enabled\"]"},{"status":"failed","code_desc":"File /etc/system-fips ","run_time":7.4e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `file` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"file","resource_params":"[\"/etc/system-fips\"]"}]},{"id":"SV-204498","title":"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is\n    configured to verify Access Control Lists (ACLs).","desc":"ACLs can provide permissions beyond those permitted through the file mode and must be verified by file\n    integrity tools.","descriptions":[{"label":"default","data":"ACLs can provide permissions beyond those permitted through the file mode and must be verified by file\n    integrity tools."},{"label":"check","data":"Verify the file integrity tool is configured to verify ACLs.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory. \n\nUse the following command to determine if the file is in another location:\n\n     # find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"acl\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"acl\" rule is below:\n\n     All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n     /bin All # apply the custom rule to the files in bin \n     /sbin All # apply the same custom rule to the files in sbin \n\nIf the \"acl\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or ACLs are not being checked by another file integrity tool, this is a finding."},{"label":"fix","data":"Configure the file integrity tool to check file and directory ACLs.\n    If AIDE is installed, ensure the \"acl\" rule is present on all uncommented file and directory selection lists."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86693","V-72069"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204498","rid":"SV-204498r880856_rule","stig_id":"RHEL-07-021600","fix_id":"F-4622r88687_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["file_integrity_tool"],"host":null,"container":null},"code":"control 'SV-204498' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is\n    configured to verify Access Control Lists (ACLs).'\n  desc 'ACLs can provide permissions beyond those permitted through the file mode and must be verified by file\n    integrity tools.'\n  desc 'check', 'Verify the file integrity tool is configured to verify ACLs.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory. \n\nUse the following command to determine if the file is in another location:\n\n     # find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"acl\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"acl\" rule is below:\n\n     All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n     /bin All # apply the custom rule to the files in bin \n     /sbin All # apply the same custom rule to the files in sbin \n\nIf the \"acl\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or ACLs are not being checked by another file integrity tool, this is a finding.'\n  desc 'fix', 'Configure the file integrity tool to check file and directory ACLs.\n    If AIDE is installed, ensure the \"acl\" rule is present on all uncommented file and directory selection lists.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86693', 'V-72069']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204498'\n  tag rid: 'SV-204498r880856_rule'\n  tag stig_id: 'RHEL-07-021600'\n  tag fix_id: 'F-4622r88687_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['file_integrity_tool']\n  tag 'host'\n  tag 'container'\n\n  file_integrity_tool = input('file_integrity_tool')\n\n  if file_integrity_tool == 'aide'\n\n    describe package('aide') do\n      it { should be_installed }\n    end\n\n    findings = []\n    aide_conf.where do\n      !selection_line.start_with? '!'\n    end.entries.each do |selection|\n      unless selection.rules.include? 'acl'\n        findings.append(selection.selection_line)\n      end\n    end\n\n    describe \"List of monitored files/directories without 'acl' rule\" do\n      subject { findings }\n      it { should be_empty }\n    end\n  else\n    describe 'Need manual review of file integrity tool' do\n      skip 'A manual review of the file integrity tool is required to ensure that it verifies ACLs.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204498.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package aide","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package aide","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"aide\"]"},{"status":"passed","code_desc":"List of monitored files/directories without 'acl' rule is expected to be empty","run_time":0.01163,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204499","title":"The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is\n    configured to verify extended attributes.","desc":"Extended attributes in file systems are used to contain arbitrary data and file metadata with security\n    implications.","descriptions":[{"label":"default","data":"Extended attributes in file systems are used to contain arbitrary data and file metadata with security\n    implications."},{"label":"check","data":"Verify the file integrity tool is configured to verify extended attributes.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory.\n\nUse the following command to determine if the file is in another location:\n     # find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"xattrs\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"xattrs\" rule follows:\n\n     All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n     /bin All # apply the custom rule to the files in bin \n     /sbin All # apply the same custom rule to the files in sbin \n\nIf the \"xattrs\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or extended attributes are not being checked by another file integrity tool, this is a finding."},{"label":"fix","data":"Configure the file integrity tool to check file and directory extended attributes.\n    If AIDE is installed, ensure the \"xattrs\" rule is present on all uncommented file and directory selection lists."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86695","V-72071"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204499","rid":"SV-204499r880858_rule","stig_id":"RHEL-07-021610","fix_id":"F-4623r88690_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["file_integrity_tool"],"host":null,"container":null},"code":"control 'SV-204499' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the file integrity tool is\n    configured to verify extended attributes.'\n  desc 'Extended attributes in file systems are used to contain arbitrary data and file metadata with security\n    implications.'\n  desc 'check', 'Verify the file integrity tool is configured to verify extended attributes.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory.\n\nUse the following command to determine if the file is in another location:\n     # find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"xattrs\" rule has been added to the rule list being applied to the files and directories selection lists.\n\nAn example rule that includes the \"xattrs\" rule follows:\n\n     All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n     /bin All # apply the custom rule to the files in bin \n     /sbin All # apply the same custom rule to the files in sbin \n\nIf the \"xattrs\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or extended attributes are not being checked by another file integrity tool, this is a finding.'\n  desc 'fix', 'Configure the file integrity tool to check file and directory extended attributes.\n    If AIDE is installed, ensure the \"xattrs\" rule is present on all uncommented file and directory selection lists.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86695', 'V-72071']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204499'\n  tag rid: 'SV-204499r880858_rule'\n  tag stig_id: 'RHEL-07-021610'\n  tag fix_id: 'F-4623r88690_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['file_integrity_tool']\n  tag 'host'\n  tag 'container'\n\n  file_integrity_tool = input('file_integrity_tool')\n\n  if file_integrity_tool == 'aide'\n\n    describe package('aide') do\n      it { should be_installed }\n    end\n\n    findings = []\n    aide_conf.where do\n      !selection_line.start_with? '!'\n    end.entries.each do |selection|\n      unless selection.rules.include? 'xattrs'\n        findings.append(selection.selection_line)\n      end\n    end\n\n    describe \"List of monitored files/directories without 'xattrs' rule\" do\n      subject { findings }\n      it { should be_empty }\n    end\n  else\n    describe 'Need manual review of file integrity tool' do\n      skip 'A manual review of the file integrity tool is required to ensure that it verifies ACLs.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204499.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package aide","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package aide","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"aide\"]"},{"status":"passed","code_desc":"List of monitored files/directories without 'xattrs' rule is expected to be empty","run_time":0.010994,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204500","title":"The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS\n    140-2 approved cryptographic hashes for validating file contents and directories.","desc":"File integrity tools use cryptographic hashes for verifying file contents and directories have not been\n    altered. These hashes must be FIPS 140-2 approved cryptographic hashes.\n    Red Hat Enterprise Linux operating system installation media ships with an optional file integrity tool called\n    Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement\n    assumes the \"aide.conf\" file is under the \"/etc\" directory.","descriptions":[{"label":"default","data":"File integrity tools use cryptographic hashes for verifying file contents and directories have not been\n    altered. These hashes must be FIPS 140-2 approved cryptographic hashes.\n    Red Hat Enterprise Linux operating system installation media ships with an optional file integrity tool called\n    Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement\n    assumes the \"aide.conf\" file is under the \"/etc\" directory."},{"label":"check","data":"Verify the file integrity tool is configured to use FIPS 140-2-approved cryptographic hashes for validating file contents and directories.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory. \n\nUse the following command to determine if the file is in another location:\n\n     # find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"sha512\" rule has been added to the rule list being applied to the files and directories selection lists. Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications.\n\nAn example rule that includes the \"sha512\" rule follows:\n \n     All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n     /bin All # apply the custom rule to the files in bin \n     /sbin All # apply the same custom rule to the files in sbin \n\nIf the \"sha512\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or another file integrity tool is not using FIPS 140-2-approved cryptographic hashes for validating file contents and directories, this is a finding."},{"label":"fix","data":"Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and\n    directory contents.\n    If AIDE is installed, ensure the \"sha512\" rule is present on all uncommented file and directory selection lists.\n    Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86697","V-72073"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204500","rid":"SV-204500r880860_rule","stig_id":"RHEL-07-021620","fix_id":"F-4624r792830_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["file_integrity_tool"],"host":null,"container":null},"code":"control 'SV-204500' do\n  title 'The Red Hat Enterprise Linux operating system must use a file integrity tool that is configured to use FIPS\n    140-2 approved cryptographic hashes for validating file contents and directories.'\n  desc 'File integrity tools use cryptographic hashes for verifying file contents and directories have not been\n    altered. These hashes must be FIPS 140-2 approved cryptographic hashes.\n    Red Hat Enterprise Linux operating system installation media ships with an optional file integrity tool called\n    Advanced Intrusion Detection Environment (AIDE). AIDE is highly configurable at install time. This requirement\n    assumes the \"aide.conf\" file is under the \"/etc\" directory.'\n  desc 'check', 'Verify the file integrity tool is configured to use FIPS 140-2-approved cryptographic hashes for validating file contents and directories.\n\nNote: AIDE is highly configurable at install time. These commands assume the \"aide.conf\" file is under the \"/etc\" directory. \n\nUse the following command to determine if the file is in another location:\n\n     # find / -name aide.conf\n\nCheck the \"aide.conf\" file to determine if the \"sha512\" rule has been added to the rule list being applied to the files and directories selection lists. Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications.\n\nAn example rule that includes the \"sha512\" rule follows:\n \n     All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux\n     /bin All # apply the custom rule to the files in bin \n     /sbin All # apply the same custom rule to the files in sbin \n\nIf the \"sha512\" rule is not being used on all uncommented selection lines in the \"/etc/aide.conf\" file, or another file integrity tool is not using FIPS 140-2-approved cryptographic hashes for validating file contents and directories, this is a finding.'\n  desc 'fix', 'Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and\n    directory contents.\n    If AIDE is installed, ensure the \"sha512\" rule is present on all uncommented file and directory selection lists.\n    Exclude any log files, or files expected to change frequently, to reduce unnecessary notifications.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86697', 'V-72073']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204500'\n  tag rid: 'SV-204500r880860_rule'\n  tag stig_id: 'RHEL-07-021620'\n  tag fix_id: 'F-4624r792830_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['file_integrity_tool']\n  tag 'host'\n  tag 'container'\n\n  file_integrity_tool = input('file_integrity_tool')\n\n  if file_integrity_tool == 'aide'\n\n    describe package('aide') do\n      it { should be_installed }\n    end\n\n    exclude_patterns = input('aide_exclude_patterns')\n\n    findings = aide_conf.where do\n      !selection_line.start_with?('!') && !exclude_patterns.include?(selection_line) && !rules.include?('sha512')\n    end\n\n    describe \"List of monitored files/directories without 'sha512' rule\" do\n      subject { findings.selection_lines }\n      it { should be_empty }\n    end\n  else\n    describe 'Need manual review of file integrity tool' do\n      skip 'A manual review of the file integrity tool is required to ensure that it verifies ACLs.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204500.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package aide","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package aide","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"aide\"]"},{"status":"passed","code_desc":"List of monitored files/directories without 'sha512' rule is expected to be empty","run_time":0.010925,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204501","title":"The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader\n    unless approved.","desc":"Malicious users with removable boot media can gain access to a system configured to use removable media as\n    the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented\n    with the Information System Security Officer (ISSO).","descriptions":[{"label":"default","data":"Malicious users with removable boot media can gain access to a system configured to use removable media as\n    the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented\n    with the Information System Security Officer (ISSO)."},{"label":"check","data":"Verify the system is not configured to use a boot loader on removable media.\n\nNote: GRUB 2 reads its configuration from the \"/boot/grub2/grub.cfg\" file on traditional BIOS-based machines and from the \"/boot/efi/EFI/redhat/grub.cfg\" file on UEFI machines.\n\nCheck for the existence of alternate boot loader configuration files with the following command:\n\n# find / -name grub.cfg\n/boot/grub2/grub.cfg\n\nIf a \"grub.cfg\" is found in any subdirectories other than \"/boot/grub2\" and \"/boot/efi/EFI/redhat\", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. \n\nCheck that the grub configuration file has the set root command in each menu entry with the following commands:\n\n# grep -cw menuentry /boot/grub2/grub.cfg\n1\n# grep 'set root' /boot/grub2/grub.cfg\nset root=(hd0,1)\n\nIf the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding."},{"label":"fix","data":"Remove alternate methods of booting the system from removable media or document the configuration to\n    boot from removable media with the ISSO."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86699","V-72075"],"severity":"medium","gtitle":"SRG-OS-000364-GPOS-00151","gid":"V-204501","rid":"SV-204501r861008_rule","stig_id":"RHEL-07-021700","fix_id":"F-4625r88696_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["grub","removable_media"],"host":null},"code":"control 'SV-204501' do\n  title 'The Red Hat Enterprise Linux operating system must not allow removable media to be used as the boot loader\n    unless approved.'\n  desc 'Malicious users with removable boot media can gain access to a system configured to use removable media as\n    the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented\n    with the Information System Security Officer (ISSO).'\n  desc 'check', %q(Verify the system is not configured to use a boot loader on removable media.\n\nNote: GRUB 2 reads its configuration from the \"/boot/grub2/grub.cfg\" file on traditional BIOS-based machines and from the \"/boot/efi/EFI/redhat/grub.cfg\" file on UEFI machines.\n\nCheck for the existence of alternate boot loader configuration files with the following command:\n\n# find / -name grub.cfg\n/boot/grub2/grub.cfg\n\nIf a \"grub.cfg\" is found in any subdirectories other than \"/boot/grub2\" and \"/boot/efi/EFI/redhat\", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. \n\nCheck that the grub configuration file has the set root command in each menu entry with the following commands:\n\n# grep -cw menuentry /boot/grub2/grub.cfg\n1\n# grep 'set root' /boot/grub2/grub.cfg\nset root=(hd0,1)\n\nIf the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.)\n  desc 'fix', 'Remove alternate methods of booting the system from removable media or document the configuration to\n    boot from removable media with the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86699', 'V-72075']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000364-GPOS-00151'\n  tag gid: 'V-204501'\n  tag rid: 'SV-204501r861008_rule'\n  tag stig_id: 'RHEL-07-021700'\n  tag fix_id: 'F-4625r88696_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['grub', 'removable_media']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    roots = command('grubby --info=ALL | grep \"^root=\" | sed \"s/^root=//g\"')\n            .stdout.strip.split(\"\\n\")\n\n    blocks = roots.map do |root|\n      root_file = file(root)\n      root_file.symlink? ? root_file.link_path : root_file.path\n    end\n\n    blocks.each do |block|\n      block_file = file(block)\n      describe block_file do\n        it { should exist }\n        its('path') { should match %r{^/dev/} }\n      end\n\n      next unless block_file.exist? and block_file.path.match? %r{^/dev/}\n\n      removable = ['/sys/block', block.sub(%r{^/dev/}, ''),\n                  'removable'].join('/')\n      describe file(removable) do\n        it { should exist }\n        its('content.strip') { should eq '0' }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204501.rb"},"waiver_data":{},"results":[]},{"id":"SV-204502","title":"The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.","desc":"It is detrimental for operating systems to provide, or install by default, functionality exceeding\n    requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore\n    may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services, provided by default, may not be necessary to support essential organizational operations (e.g., key\n    missions, functions).\n    Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and\n    demonstration software not related to requirements or providing a wide array of functionality not required for every\n    mission, but which cannot be disabled.","descriptions":[{"label":"default","data":"It is detrimental for operating systems to provide, or install by default, functionality exceeding\n    requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore\n    may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services, provided by default, may not be necessary to support essential organizational operations (e.g., key\n    missions, functions).\n    Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and\n    demonstration software not related to requirements or providing a wide array of functionality not required for every\n    mission, but which cannot be disabled."},{"label":"check","data":"Verify the operating system is configured to disable non-essential capabilities. The most secure way\n    of ensuring a non-essential capability is disabled is to not have the capability installed.\n    The telnet service provides an unencrypted remote access service that does not provide for the confidentiality and\n    integrity of user passwords or the remote session.\n    If a privileged user were to log on using this service, the privileged user password could be compromised.\n    Check to see if the telnet-server package is installed with the following command:\n    # yum list installed telnet-server\n    If the telnet-server package is installed, this is a finding."},{"label":"fix","data":"Configure the operating system to disable non-essential capabilities by removing the telnet-server\n    package from the system with the following command:\n    # yum remove telnet-server"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72077","SV-86701"],"severity":"high","gtitle":"SRG-OS-000095-GPOS-00049","gid":"V-204502","rid":"SV-204502r603261_rule","stig_id":"RHEL-07-021710","fix_id":"F-4626r88699_fix","cci":["CCI-000381"],"nist":["CM-7 a"],"subsystems":["packages"],"host":null,"container":null},"code":"control 'SV-204502' do\n  title 'The Red Hat Enterprise Linux operating system must not have the telnet-server package installed.'\n  desc 'It is detrimental for operating systems to provide, or install by default, functionality exceeding\n    requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore\n    may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services, provided by default, may not be necessary to support essential organizational operations (e.g., key\n    missions, functions).\n    Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and\n    demonstration software not related to requirements or providing a wide array of functionality not required for every\n    mission, but which cannot be disabled.'\n  desc 'check', 'Verify the operating system is configured to disable non-essential capabilities. The most secure way\n    of ensuring a non-essential capability is disabled is to not have the capability installed.\n    The telnet service provides an unencrypted remote access service that does not provide for the confidentiality and\n    integrity of user passwords or the remote session.\n    If a privileged user were to log on using this service, the privileged user password could be compromised.\n    Check to see if the telnet-server package is installed with the following command:\n    # yum list installed telnet-server\n    If the telnet-server package is installed, this is a finding.'\n  desc 'fix', 'Configure the operating system to disable non-essential capabilities by removing the telnet-server\n    package from the system with the following command:\n    # yum remove telnet-server'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72077', 'SV-86701']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000095-GPOS-00049'\n  tag gid: 'V-204502'\n  tag rid: 'SV-204502r603261_rule'\n  tag stig_id: 'RHEL-07-021710'\n  tag fix_id: 'F-4626r88699_fix'\n  tag cci: ['CCI-000381']\n  tag nist: ['CM-7 a']\n  tag subsystems: ['packages']\n  tag 'host'\n  tag 'container'\n\n  describe package('telnet-server') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204502.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package telnet-server","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package telnet-server","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"telnet-server\"]"}]},{"id":"SV-204503","title":"The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce\n    records containing information to establish what type of events occurred, where the events occurred, the source of\n    the events, and the outcome of the events. These audit records must also identify individual identities of group\n    account users.","desc":"Without establishing what type of events occurred, it would be difficult to establish, correlate, and\n    investigate the events leading up to an outage or attack.\n    Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source\n    and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames\n    involved, and access control or flow control rules invoked.\n    Associating event types with detected events in the operating system audit logs provides a means of investigating an\n    attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating\n    system.","descriptions":[{"label":"default","data":"Without establishing what type of events occurred, it would be difficult to establish, correlate, and\n    investigate the events leading up to an outage or attack.\n    Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source\n    and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames\n    involved, and access control or flow control rules invoked.\n    Associating event types with detected events in the operating system audit logs provides a means of investigating an\n    attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating\n    system."},{"label":"check","data":"Verify the operating system produces audit records containing information to establish when (date\n    and time) the events occurred.\n    Check to see if auditing is active by issuing the following command:\n    # systemctl is-active auditd.service\n    active\n    If the \"auditd\" status is not active, this is a finding."},{"label":"fix","data":"Configure the operating system to produce audit records containing information to establish when (date\n    and time) the events occurred.\n    Enable the auditd service with the following command:\n    # systemctl start auditd.service"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86703","V-72079"],"severity":"medium","gtitle":"SRG-OS-000038-GPOS-00016","satisfies":["SRG-OS-000038-GPOS-00016","SRG-OS-000039-GPOS-00017","SRG-OS-000042-GPOS-00021","SRG-OS-000254-GPOS-00095","SRG-OS-000255-GPOS-00096"],"gid":"V-204503","rid":"SV-204503r603261_rule","stig_id":"RHEL-07-030000","fix_id":"F-36311r602643_fix","cci":["CCI-000126","CCI-000131"],"nist":["AU-2 d","AU-3","AU-2 c","AU-3 b"],"subsystems":["audit","auditd"],"host":null},"code":"control 'SV-204503' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that auditing is configured to produce\n    records containing information to establish what type of events occurred, where the events occurred, the source of\n    the events, and the outcome of the events. These audit records must also identify individual identities of group\n    account users.'\n  desc 'Without establishing what type of events occurred, it would be difficult to establish, correlate, and\n    investigate the events leading up to an outage or attack.\n    Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source\n    and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames\n    involved, and access control or flow control rules invoked.\n    Associating event types with detected events in the operating system audit logs provides a means of investigating an\n    attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating\n    system.'\n  desc 'check', 'Verify the operating system produces audit records containing information to establish when (date\n    and time) the events occurred.\n    Check to see if auditing is active by issuing the following command:\n    # systemctl is-active auditd.service\n    active\n    If the \"auditd\" status is not active, this is a finding.'\n  desc 'fix', 'Configure the operating system to produce audit records containing information to establish when (date\n    and time) the events occurred.\n    Enable the auditd service with the following command:\n    # systemctl start auditd.service'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86703', 'V-72079']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000038-GPOS-00016'\n  tag satisfies: ['SRG-OS-000038-GPOS-00016', 'SRG-OS-000039-GPOS-00017', 'SRG-OS-000042-GPOS-00021', 'SRG-OS-000254-GPOS-00095', 'SRG-OS-000255-GPOS-00096']\n  tag gid: 'V-204503'\n  tag rid: 'SV-204503r603261_rule'\n  tag stig_id: 'RHEL-07-030000'\n  tag fix_id: 'F-36311r602643_fix'\n  tag cci: ['CCI-000126', 'CCI-000131']\n  tag nist: ['AU-2 d', 'AU-3', 'AU-2 c', 'AU-3 b']\n  tag subsystems: ['audit', 'auditd']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe service('auditd') do\n      it { should be_running }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204503.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Service auditd","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Service auditd","skip_message":"The `service` resource is not supported on your OS yet.","resource_class":"service","resource_params":"[\"auditd\"]"}]},{"id":"SV-204504","title":"The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless\n    availability is an overriding concern. If availability is a concern, the system must alert the designated staff\n    (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit\n    processing failure.","desc":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit\n    logs as required. Without this notification, the security personnel may be unaware of an impending failure of the\n    audit capability, and system operation may be adversely affected.\n    Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit\n    storage capacity being reached or exceeded.\n    This requirement applies to each audit data storage repository (i.e., distinct information system component where\n    audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage\n    repositories combined), or both.","descriptions":[{"label":"default","data":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit\n    logs as required. Without this notification, the security personnel may be unaware of an impending failure of the\n    audit capability, and system operation may be adversely affected.\n    Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit\n    storage capacity being reached or exceeded.\n    This requirement applies to each audit data storage repository (i.e., distinct information system component where\n    audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage\n    repositories combined), or both."},{"label":"check","data":"Confirm the audit configuration regarding how auditing processing failures are handled.\n\nCheck to see what level \"auditctl\" is set to with following command: \n\n     # auditctl -s | grep -i \"fail\"\n     failure 2\n\nNote: If the value of \"failure\" is set to \"2\", the system is configured to panic (shut down) in the event of an auditing failure. If the value of \"failure\" is set to \"1\", the system will not shut down and instead will record the audit failure in the kernel log. If the system is configured as per requirement RHEL-07-031000, the kernel log will be sent to a log aggregation server and generate an alert.\n\nIf the \"failure\" setting is set to any value other than \"1\" or \"2\", this is a finding.\n\nIf the \"failure\" setting is not set, this should be upgraded to a CAT I finding.\n\nIf the \"failure\" setting is set to \"1\" but the availability concern is not documented or there is no monitoring of the kernel log, this should be downgraded to a CAT III finding."},{"label":"fix","data":"Configure the operating system to shut down in the event of an audit processing failure.\n    Add or correct the option to shut down the operating system with the following command:\n    # auditctl -f 2\n    Edit the \"/etc/audit/rules.d/audit.rules\" file and add the following line:\n    -f 2\n    If availability has been determined to be more important, and this decision is documented with the ISSO, configure\n    the operating system to notify system administration staff and ISSO staff in the event of an audit processing\n    failure with the following command:\n    # auditctl -f 1\n    Edit the \"/etc/audit/rules.d/audit.rules\" file and add the following line:\n    -f 1\n    Kernel log monitoring must also be configured to properly alert designated staff.\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72081","SV-86705"],"severity":"medium","gtitle":"SRG-OS-000046-GPOS-00022","satisfies":["SRG-OS-000046-GPOS-00022","SRG-OS-000047-GPOS-00023"],"gid":"V-204504","rid":"SV-204504r880761_rule","stig_id":"RHEL-07-030010","fix_id":"F-4628r880760_fix","cci":["CCI-000139"],"nist":["AU-5 a"],"subsystems":["audit","auditd"],"host":null},"code":"control 'SV-204504' do\n  title 'The Red Hat Enterprise Linux operating system must shut down upon audit processing failure, unless\n    availability is an overriding concern. If availability is a concern, the system must alert the designated staff\n    (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit\n    processing failure.'\n  desc 'It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit\n    logs as required. Without this notification, the security personnel may be unaware of an impending failure of the\n    audit capability, and system operation may be adversely affected.\n    Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit\n    storage capacity being reached or exceeded.\n    This requirement applies to each audit data storage repository (i.e., distinct information system component where\n    audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage\n    repositories combined), or both.'\n  desc 'check', 'Confirm the audit configuration regarding how auditing processing failures are handled.\n\nCheck to see what level \"auditctl\" is set to with following command: \n\n     # auditctl -s | grep -i \"fail\"\n     failure 2\n\nNote: If the value of \"failure\" is set to \"2\", the system is configured to panic (shut down) in the event of an auditing failure. If the value of \"failure\" is set to \"1\", the system will not shut down and instead will record the audit failure in the kernel log. If the system is configured as per requirement RHEL-07-031000, the kernel log will be sent to a log aggregation server and generate an alert.\n\nIf the \"failure\" setting is set to any value other than \"1\" or \"2\", this is a finding.\n\nIf the \"failure\" setting is not set, this should be upgraded to a CAT I finding.\n\nIf the \"failure\" setting is set to \"1\" but the availability concern is not documented or there is no monitoring of the kernel log, this should be downgraded to a CAT III finding.'\n  desc 'fix', 'Configure the operating system to shut down in the event of an audit processing failure.\n    Add or correct the option to shut down the operating system with the following command:\n    # auditctl -f 2\n    Edit the \"/etc/audit/rules.d/audit.rules\" file and add the following line:\n    -f 2\n    If availability has been determined to be more important, and this decision is documented with the ISSO, configure\n    the operating system to notify system administration staff and ISSO staff in the event of an audit processing\n    failure with the following command:\n    # auditctl -f 1\n    Edit the \"/etc/audit/rules.d/audit.rules\" file and add the following line:\n    -f 1\n    Kernel log monitoring must also be configured to properly alert designated staff.\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72081', 'SV-86705']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000046-GPOS-00022'\n  tag satisfies: ['SRG-OS-000046-GPOS-00022', 'SRG-OS-000047-GPOS-00023']\n  tag gid: 'V-204504'\n  tag rid: 'SV-204504r880761_rule'\n  tag stig_id: 'RHEL-07-030010'\n  tag fix_id: 'F-4628r880760_fix'\n  tag cci: ['CCI-000139']\n  tag nist: ['AU-5 a']\n  tag subsystems: ['audit', 'auditd']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    monitor_kernel_log = input('monitor_kernel_log')\n\n    if auditd.status['failure'].nil?\n      impact 0.5\n    elsif auditd.status['failure'].match?(/^1$/) && !monitor_kernel_log\n      impact 0.3\n    else\n      impact 0.5\n    end\n\n    if !monitor_kernel_log\n      describe auditd.status['failure'] do\n        it { should match(/^2$/) }\n      end\n    else\n      describe auditd.status['failure'] do\n        it { should match(/^(1|2)$/) }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204504.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"is expected to match /^(1|2)$/","run_time":0.000202,"start_time":"2023-04-18T13:20:14-04:00","message":"expected nil to match /^(1|2)$/","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204506","title":"The Red Hat Enterprise Linux operating system must be configured to off-load audit logs onto a different\n    system or storage media from the system being audited.","desc":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.\n    Without the configuration of the \"au-remote\" plugin, the audisp-remote daemon will not off load the logs from the\n    system being audited.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.\n    Without the configuration of the \"au-remote\" plugin, the audisp-remote daemon will not off load the logs from the\n    system being audited."},{"label":"check","data":"Verify the \"au-remote\" plugin is configured to always off-load audit logs using the audisp-remote\n    daemon:\n    # cat /etc/audisp/plugins.d/au-remote.conf | grep -v \"^#\"\n    active = yes\n    direction = out\n    path = /sbin/audisp-remote\n    type = always\n    format = string\n    If \"active\" is not set to \"yes\", \"direction\" is not set to \"out\", \"path\" is not set to \"/sbin/audisp-remote\", \"type\"\n    is not set to \"always\", or any of the lines are commented out, ask the System Administrator to indicate how the\n    audit logs are off-loaded to a different system or storage media.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    this is a finding."},{"label":"fix","data":"Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:\n\nactive = yes\ndirection = out\npath = /sbin/audisp-remote\ntype = always\n\nThe audit daemon must be restarted for changes to take effect:\n\n# service auditd restart"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-95729","V-81017"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","satisfies":["SRG-OS-000342-GPOS-00133","SRG-OS-000479-GPOS-00224"],"gid":"V-204506","rid":"SV-204506r877390_rule","stig_id":"RHEL-07-030201","fix_id":"F-4630r858479_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204506' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to off-load audit logs onto a different\n    system or storage media from the system being audited.'\n  desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.\n    Without the configuration of the \"au-remote\" plugin, the audisp-remote daemon will not off load the logs from the\n    system being audited.'\n  desc 'check', 'Verify the \"au-remote\" plugin is configured to always off-load audit logs using the audisp-remote\n    daemon:\n    # cat /etc/audisp/plugins.d/au-remote.conf | grep -v \"^#\"\n    active = yes\n    direction = out\n    path = /sbin/audisp-remote\n    type = always\n    format = string\n    If \"active\" is not set to \"yes\", \"direction\" is not set to \"out\", \"path\" is not set to \"/sbin/audisp-remote\", \"type\"\n    is not set to \"always\", or any of the lines are commented out, ask the System Administrator to indicate how the\n    audit logs are off-loaded to a different system or storage media.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    this is a finding.'\n  desc 'fix', 'Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:\n\nactive = yes\ndirection = out\npath = /sbin/audisp-remote\ntype = always\n\nThe audit daemon must be restarted for changes to take effect:\n\n# service auditd restart'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-95729', 'V-81017']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']\n  tag gid: 'V-204506'\n  tag rid: 'SV-204506r877390_rule'\n  tag stig_id: 'RHEL-07-030201'\n  tag fix_id: 'F-4630r858479_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    test_file = '/etc/audisp/plugins.d/au-remote.conf'\n\n    if file(test_file).exist?\n      describe parse_config_file(test_file) do\n        its('active') { should match(/yes$/) }\n        its('direction') { should match(/out$/) }\n        its('path') { should match %r{/sbin/audisp-remote$} }\n        its('type') { should match(/always$/) }\n      end\n    else\n      describe \"File '#{test_file}' cannot be found. This test cannot be checked in a automated fashion and you must check it manually\" do\n        skip \"File '#{test_file}' cannot be found. This check must be performed manually\"\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204506.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"File '/etc/audisp/plugins.d/au-remote.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"File '/etc/audisp/plugins.d/au-remote.conf' cannot be found. This check must be performed manually","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204507","title":"The Red Hat Enterprise Linux operating system must take appropriate action when the remote logging buffer\n    is full.","desc":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When\n    the remote buffer is full, audit logs will not be collected and sent to the central log server.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When\n    the remote buffer is full, audit logs will not be collected and sent to the central log server."},{"label":"check","data":"Verify the audisp daemon is configured to take an appropriate action when the internal queue is\n    full:\n    # grep \"overflow_action\" /etc/audisp/audispd.conf\n    overflow_action = syslog\n    If the \"overflow_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out, ask the System\n    Administrator to indicate how the audit logs are off-loaded to a different system or storage media, and to indicate\n    what action that system takes when the internal queue is full.\n    If there is no evidence the system is configured to off-load audit logs to a different system or storage media or,\n    if the configuration does not take appropriate action when the internal queue is full, this is a finding."},{"label":"fix","data":"Edit the /etc/audisp/audispd.conf file and add or update the \"overflow_action\" option:\n    overflow_action = syslog\n    The audit daemon must be restarted for changes to take effect:\n    # service auditd restart"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-81019","SV-95731"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","satisfies":["SRG-OS-000342-GPOS-00133","SRG-OS-000479-GPOS-00224"],"gid":"V-204507","rid":"SV-204507r877390_rule","stig_id":"RHEL-07-030210","fix_id":"F-36312r602646_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204507' do\n  title 'The Red Hat Enterprise Linux operating system must take appropriate action when the remote logging buffer\n    is full.'\n  desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When\n    the remote buffer is full, audit logs will not be collected and sent to the central log server.'\n  desc 'check', 'Verify the audisp daemon is configured to take an appropriate action when the internal queue is\n    full:\n    # grep \"overflow_action\" /etc/audisp/audispd.conf\n    overflow_action = syslog\n    If the \"overflow_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out, ask the System\n    Administrator to indicate how the audit logs are off-loaded to a different system or storage media, and to indicate\n    what action that system takes when the internal queue is full.\n    If there is no evidence the system is configured to off-load audit logs to a different system or storage media or,\n    if the configuration does not take appropriate action when the internal queue is full, this is a finding.'\n  desc 'fix', 'Edit the /etc/audisp/audispd.conf file and add or update the \"overflow_action\" option:\n    overflow_action = syslog\n    The audit daemon must be restarted for changes to take effect:\n    # service auditd restart'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-81019', 'SV-95731']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']\n  tag gid: 'V-204507'\n  tag rid: 'SV-204507r877390_rule'\n  tag stig_id: 'RHEL-07-030210'\n  tag fix_id: 'F-36312r602646_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  elsif file('/etc/audisp/audispd.conf').exist?\n    describe parse_config_file('/etc/audisp/audispd.conf') do\n      its('overflow_action') { should match(/syslog$|single$|halt$/i) }\n    end\n  else\n    describe \"File '/etc/audisp/audispd.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually\" do\n      skip \"File '/etc/audisp/audispd.conf' cannot be found. This check must be performed manually\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204507.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"File '/etc/audisp/audispd.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"File '/etc/audisp/audispd.conf' cannot be found. This check must be performed manually","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204508","title":"The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to\n    the central log server.","desc":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When\n    audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be\n    analyzed and tied back to the correct system.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When\n    audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be\n    analyzed and tied back to the correct system."},{"label":"check","data":"Verify the audisp daemon is configured to label all off-loaded audit logs:\n    # grep \"name_format\" /etc/audisp/audispd.conf\n    name_format = hostname\n    If the \"name_format\" option is not \"hostname\", \"fqd\", or \"numeric\", or the line is commented out, ask the System\n    Administrator to indicate how the audit logs are off-loaded to a different system or storage media, and to indicate\n    if the logs are labeled appropriately.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    or if the configuration does not appropriately label logs before they are off-loaded, this is a finding."},{"label":"fix","data":"Edit the /etc/audisp/audispd.conf file and add or update the \"name_format\" option:\n    name_format = hostname\n    The audit daemon must be restarted for changes to take effect:\n    # service auditd restart"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-95733","V-81021"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","satisfies":["SRG-OS-000342-GPOS-00133","SRG-OS-000479-GPOS-00224"],"gid":"V-204508","rid":"SV-204508r877390_rule","stig_id":"RHEL-07-030211","fix_id":"F-36313r602649_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204508' do\n  title 'The Red Hat Enterprise Linux operating system must label all off-loaded audit logs before sending them to\n    the central log server.'\n  desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.  When\n    audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be\n    analyzed and tied back to the correct system.'\n  desc 'check', 'Verify the audisp daemon is configured to label all off-loaded audit logs:\n    # grep \"name_format\" /etc/audisp/audispd.conf\n    name_format = hostname\n    If the \"name_format\" option is not \"hostname\", \"fqd\", or \"numeric\", or the line is commented out, ask the System\n    Administrator to indicate how the audit logs are off-loaded to a different system or storage media, and to indicate\n    if the logs are labeled appropriately.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    or if the configuration does not appropriately label logs before they are off-loaded, this is a finding.'\n  desc 'fix', 'Edit the /etc/audisp/audispd.conf file and add or update the \"name_format\" option:\n    name_format = hostname\n    The audit daemon must be restarted for changes to take effect:\n    # service auditd restart'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-95733', 'V-81021']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']\n  tag gid: 'V-204508'\n  tag rid: 'SV-204508r877390_rule'\n  tag stig_id: 'RHEL-07-030211'\n  tag fix_id: 'F-36313r602649_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  elsif file('/etc/audisp/audispd.conf').exist?\n\n    describe parse_config_file('/etc/audisp/audispd.conf') do\n      its('name_format') { should match(/^hostname$|^fqd$|^numeric$/i) }\n    end\n  else\n    describe \"File '/etc/audisp/audispd.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually\" do\n      skip \"File '/etc/audisp/audispd.conf' cannot be found. This check must be performed manually\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204508.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"File '/etc/audisp/audispd.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"File '/etc/audisp/audispd.conf' cannot be found. This check must be performed manually","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204509","title":"The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media\n    from the system being audited.","desc":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity."},{"label":"check","data":"Verify the operating system off-loads audit records onto a different system or media from the system\n    being audited.\n    To determine the remote server that the records are being sent to, use the following command:\n    # grep -i remote_server /etc/audisp/audisp-remote.conf\n    remote_server = 10.0.21.1\n    If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the\n    audit logs are off-loaded to a different system or media.\n    If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding."},{"label":"fix","data":"Configure the operating system to off-load audit records onto a different system or media from the\n    system being audited.\n    Set the remote server option in \"/etc/audisp/audisp-remote.conf\" with the IP address of the log aggregation server."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72083","SV-86707"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","satisfies":["SRG-OS-000342-GPOS-00133","SRG-OS-000479-GPOS-00224"],"gid":"V-204509","rid":"SV-204509r877390_rule","stig_id":"RHEL-07-030300","fix_id":"F-4633r88720_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204509' do\n  title 'The Red Hat Enterprise Linux operating system must off-load audit records onto a different system or media\n    from the system being audited.'\n  desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.'\n  desc 'check', 'Verify the operating system off-loads audit records onto a different system or media from the system\n    being audited.\n    To determine the remote server that the records are being sent to, use the following command:\n    # grep -i remote_server /etc/audisp/audisp-remote.conf\n    remote_server = 10.0.21.1\n    If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the\n    audit logs are off-loaded to a different system or media.\n    If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.'\n  desc 'fix', 'Configure the operating system to off-load audit records onto a different system or media from the\n    system being audited.\n    Set the remote server option in \"/etc/audisp/audisp-remote.conf\" with the IP address of the log aggregation server.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72083', 'SV-86707']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']\n  tag gid: 'V-204509'\n  tag rid: 'SV-204509r877390_rule'\n  tag stig_id: 'RHEL-07-030300'\n  tag fix_id: 'F-4633r88720_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  elsif file('/etc/audisp/audisp-remote.conf').exist?\n    if input('audit_remote_server')\n      describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n        its('remote_server'.to_s) { should cmp input('audit_remote_server') }\n      end\n    else\n      describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n        its('remote_server'.to_s) { should match(/^\\S+$/) }\n        its('remote_server'.to_s) do\n          should_not be_in ['localhost', '127.0.0.1']\n        end\n      end\n    end\n  else\n    describe \"File '/etc/audisp/audisp-remote.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually\" do\n      skip \"File '/etc/audisp/audisp-remote.conf' cannot be found. This check must be performed manually\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204509.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"File '/etc/audisp/audisp-remote.conf' cannot be found. This test cannot be checked in a automated fashion and you must check it manually","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"File '/etc/audisp/audisp-remote.conf' cannot be found. This check must be performed manually","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204510","title":"The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a\n    different system or media from the system being audited.","desc":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.","descriptions":[{"label":"default","data":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity."},{"label":"check","data":"Verify the operating system encrypts audit records off-loaded onto a different system or media from\n    the system being audited.\n    To determine if the transfer is encrypted, use the following command:\n    # grep -i enable_krb5 /etc/audisp/audisp-remote.conf\n    enable_krb5 = yes\n    If the value of the \"enable_krb5\" option is not set to \"yes\" or the line is commented out, ask the System\n    Administrator to indicate how the audit logs are off-loaded to a different system or media.\n    If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is\n    encrypted, this is a finding."},{"label":"fix","data":"Configure the operating system to encrypt the transfer of off-loaded audit records onto a different\n    system or media from the system being audited.\n    Uncomment the \"enable_krb5\" option in \"/etc/audisp/audisp-remote.conf\" and set it with the following line:\n    enable_krb5 = yes"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72085","SV-86709"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","satisfies":["SRG-OS-000342-GPOS-00133","SRG-OS-000479-GPOS-00224"],"gid":"V-204510","rid":"SV-204510r877390_rule","stig_id":"RHEL-07-030310","fix_id":"F-4634r88723_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204510' do\n  title 'The Red Hat Enterprise Linux operating system must encrypt the transfer of audit records off-loaded onto a\n    different system or media from the system being audited.'\n  desc 'Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n    Off-loading is a common process in information systems with limited audit storage capacity.'\n  desc 'check', 'Verify the operating system encrypts audit records off-loaded onto a different system or media from\n    the system being audited.\n    To determine if the transfer is encrypted, use the following command:\n    # grep -i enable_krb5 /etc/audisp/audisp-remote.conf\n    enable_krb5 = yes\n    If the value of the \"enable_krb5\" option is not set to \"yes\" or the line is commented out, ask the System\n    Administrator to indicate how the audit logs are off-loaded to a different system or media.\n    If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is\n    encrypted, this is a finding.'\n  desc 'fix', 'Configure the operating system to encrypt the transfer of off-loaded audit records onto a different\n    system or media from the system being audited.\n    Uncomment the \"enable_krb5\" option in \"/etc/audisp/audisp-remote.conf\" and set it with the following line:\n    enable_krb5 = yes'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72085', 'SV-86709']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag satisfies: ['SRG-OS-000342-GPOS-00133', 'SRG-OS-000479-GPOS-00224']\n  tag gid: 'V-204510'\n  tag rid: 'SV-204510r877390_rule'\n  tag stig_id: 'RHEL-07-030310'\n  tag fix_id: 'F-4634r88723_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n      its('enable_krb5'.to_s) { should cmp 'yes' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204510.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/audisp/audisp-remote.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/audisp/audisp-remote.conf","skip_message":"Can't find file: /etc/audisp/audisp-remote.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/audisp/audisp-remote.conf\"]"}]},{"id":"SV-204511","title":"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate\n    action when the audit storage volume is full.","desc":"Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing\n    audit records.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.","descriptions":[{"label":"default","data":"Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing\n    audit records.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon."},{"label":"check","data":"Verify the action the operating system takes if the disk the audit records are written to becomes\n    full.\n    To determine the action that takes place if the disk is full on the remote server, use the following command:\n    # grep -i disk_full_action /etc/audisp/audisp-remote.conf\n    disk_full_action = single\n    If the value of the \"disk_full_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out,\n    ask the System Administrator to indicate how the audit logs are off-loaded to a different system or storage media,\n    and to indicate the action taken when the disk is full on the remote server.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    or if the configuration does not take appropriate action when the disk is full on the remote server, this is a\n    finding."},{"label":"fix","data":"Configure the action the operating system takes if the disk the audit records are written to becomes\n    full.\n    Uncomment or edit the \"disk_full_action\" option in \"/etc/audisp/audisp-remote.conf\" and set it to \"syslog\",\n    \"single\", or \"halt\", such as the following line:\n    disk_full_action = single"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72087","SV-86711"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","gid":"V-204511","rid":"SV-204511r877390_rule","stig_id":"RHEL-07-030320","fix_id":"F-36314r602652_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204511' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate\n    action when the audit storage volume is full.'\n  desc 'Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing\n    audit records.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.'\n  desc 'check', 'Verify the action the operating system takes if the disk the audit records are written to becomes\n    full.\n    To determine the action that takes place if the disk is full on the remote server, use the following command:\n    # grep -i disk_full_action /etc/audisp/audisp-remote.conf\n    disk_full_action = single\n    If the value of the \"disk_full_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented out,\n    ask the System Administrator to indicate how the audit logs are off-loaded to a different system or storage media,\n    and to indicate the action taken when the disk is full on the remote server.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    or if the configuration does not take appropriate action when the disk is full on the remote server, this is a\n    finding.'\n  desc 'fix', 'Configure the action the operating system takes if the disk the audit records are written to becomes\n    full.\n    Uncomment or edit the \"disk_full_action\" option in \"/etc/audisp/audisp-remote.conf\" and set it to \"syslog\",\n    \"single\", or \"halt\", such as the following line:\n    disk_full_action = single'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72087', 'SV-86711']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag gid: 'V-204511'\n  tag rid: 'SV-204511r877390_rule'\n  tag stig_id: 'RHEL-07-030320'\n  tag fix_id: 'F-36314r602652_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n      its('disk_full_action'.to_s) { should cmp input('expected_disk_full_action') }\n      its('disk_full_action'.to_s) { should be_in ['syslog', 'single', 'halt'] }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204511.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/audisp/audisp-remote.conf","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/audisp/audisp-remote.conf","skip_message":"Can't find file: /etc/audisp/audisp-remote.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/audisp/audisp-remote.conf\"]"}]},{"id":"SV-204512","title":"The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate\n    action when there is an error sending audit records to a remote system.","desc":"Taking appropriate action when there is an error sending audit records to a remote system will minimize the\n    possibility of losing audit records.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.","descriptions":[{"label":"default","data":"Taking appropriate action when there is an error sending audit records to a remote system will minimize the\n    possibility of losing audit records.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon."},{"label":"check","data":"Verify the action the operating system takes if there is an error sending audit records to a remote\n    system.\n    Check the action that takes place if there is an error sending audit records to a remote system with the following\n    command:\n    # grep -i network_failure_action /etc/audisp/audisp-remote.conf\n    network_failure_action = syslog\n    If the value of the \"network_failure_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented\n    out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or storage\n    media, and to indicate the action taken if there is an error sending audit records to the remote system.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    or if the configuration does not take appropriate action if there is an error sending audit records to the remote\n    system, this is a finding."},{"label":"fix","data":"Configure the action the operating system takes if there is an error sending audit records to a remote\n    system.\n    Uncomment the \"network_failure_action\" option in \"/etc/audisp/audisp-remote.conf\" and set it to \"syslog\", \"single\",\n    or \"halt\".\n    network_failure_action = syslog"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-73163","SV-87815"],"severity":"medium","gtitle":"SRG-OS-000342-GPOS-00133","gid":"V-204512","rid":"SV-204512r877390_rule","stig_id":"RHEL-07-030321","fix_id":"F-36315r602655_fix","cci":["CCI-001851"],"nist":["AU-4 (1)"],"subsystems":["audit","audisp"],"host":null},"code":"control 'SV-204512' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the audit system takes appropriate\n    action when there is an error sending audit records to a remote system.'\n  desc 'Taking appropriate action when there is an error sending audit records to a remote system will minimize the\n    possibility of losing audit records.\n    One method of off-loading audit logs in Red Hat Enterprise Linux is with the use of the audisp-remote dameon.'\n  desc 'check', 'Verify the action the operating system takes if there is an error sending audit records to a remote\n    system.\n    Check the action that takes place if there is an error sending audit records to a remote system with the following\n    command:\n    # grep -i network_failure_action /etc/audisp/audisp-remote.conf\n    network_failure_action = syslog\n    If the value of the \"network_failure_action\" option is not \"syslog\", \"single\", or \"halt\", or the line is commented\n    out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or storage\n    media, and to indicate the action taken if there is an error sending audit records to the remote system.\n    If there is no evidence that the system is configured to off-load audit logs to a different system or storage media,\n    or if the configuration does not take appropriate action if there is an error sending audit records to the remote\n    system, this is a finding.'\n  desc 'fix', 'Configure the action the operating system takes if there is an error sending audit records to a remote\n    system.\n    Uncomment the \"network_failure_action\" option in \"/etc/audisp/audisp-remote.conf\" and set it to \"syslog\", \"single\",\n    or \"halt\".\n    network_failure_action = syslog'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-73163', 'SV-87815']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000342-GPOS-00133'\n  tag gid: 'V-204512'\n  tag rid: 'SV-204512r877390_rule'\n  tag stig_id: 'RHEL-07-030321'\n  tag fix_id: 'F-36315r602655_fix'\n  tag cci: ['CCI-001851']\n  tag nist: ['AU-4 (1)']\n  tag subsystems: ['audit', 'audisp']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe parse_config_file('/etc/audisp/audisp-remote.conf') do\n      its('network_failure_action'.to_s) { should cmp input('expected_network_failure_action') }\n      its('network_failure_action'.to_s) { should be_in ['syslog', 'single', 'halt'] }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204512.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/audisp/audisp-remote.conf","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/audisp/audisp-remote.conf","skip_message":"Can't find file: /etc/audisp/audisp-remote.conf","resource_class":"parse_config_file","resource_params":"[\"/etc/audisp/audisp-remote.conf\"]"}]},{"id":"SV-204513","title":"The Red Hat Enterprise Linux operating system must initiate an action to notify the System Administrator\n    (SA) and Information System Security Officer ISSO, at a minimum, when allocated audit record storage volume reaches\n    75% of the repository maximum audit record storage capacity.","desc":"If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they\n    are unable to plan for audit record storage capacity expansion.","descriptions":[{"label":"default","data":"If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they\n    are unable to plan for audit record storage capacity expansion."},{"label":"check","data":"Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when\n    allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n    Check the system configuration to determine the partition the audit records are being written to with the following\n    command:\n    $ sudo grep -iw log_file /etc/audit/auditd.conf\n    log_file = /var/log/audit/audit.log\n    Determine what the threshold is for the system to take action when 75 percent of the repository maximum audit record\n    storage capacity is reached:\n    $ sudo grep -iw space_left /etc/audit/auditd.conf\n    space_left = 25%\n    If the value of the \"space_left\" keyword is not set to 25 percent of the total partition size, this is a finding."},{"label":"fix","data":"Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when\n    allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n    Set the value of the \"space_left\" keyword in \"/etc/audit/auditd.conf\" to 25 percent of the partition size.\n    space_left = 25%\n    Reload the auditd daemon to apply changes made to the \"/etc/audit/auditd.conf\" file."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72089","SV-86713"],"severity":"medium","gtitle":"SRG-OS-000343-GPOS-00134","gid":"V-204513","rid":"SV-204513r877389_rule","stig_id":"RHEL-07-030330","fix_id":"F-4637r744111_fix","cci":["CCI-001855"],"nist":["AU-5 (1)"],"subsystems":["audit","auditd"],"host":null},"code":"control 'SV-204513' do\n  title 'The Red Hat Enterprise Linux operating system must initiate an action to notify the System Administrator\n    (SA) and Information System Security Officer ISSO, at a minimum, when allocated audit record storage volume reaches\n    75% of the repository maximum audit record storage capacity.'\n  desc 'If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they\n    are unable to plan for audit record storage capacity expansion.'\n  desc 'check', 'Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when\n    allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n    Check the system configuration to determine the partition the audit records are being written to with the following\n    command:\n    $ sudo grep -iw log_file /etc/audit/auditd.conf\n    log_file = /var/log/audit/audit.log\n    Determine what the threshold is for the system to take action when 75 percent of the repository maximum audit record\n    storage capacity is reached:\n    $ sudo grep -iw space_left /etc/audit/auditd.conf\n    space_left = 25%\n    If the value of the \"space_left\" keyword is not set to 25 percent of the total partition size, this is a finding.'\n  desc 'fix', 'Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when\n    allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n    Set the value of the \"space_left\" keyword in \"/etc/audit/auditd.conf\" to 25 percent of the partition size.\n    space_left = 25%\n    Reload the auditd daemon to apply changes made to the \"/etc/audit/auditd.conf\" file.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72089', 'SV-86713']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000343-GPOS-00134'\n  tag gid: 'V-204513'\n  tag rid: 'SV-204513r877389_rule'\n  tag stig_id: 'RHEL-07-030330'\n  tag fix_id: 'F-4637r744111_fix'\n  tag cci: ['CCI-001855']\n  tag nist: ['AU-5 (1)']\n  tag subsystems: ['audit', 'auditd']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe auditd_conf do\n      its('space_left') { should cmp >= input('min_space_left') }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204513.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Audit Daemon Config","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Audit Daemon Config","skip_message":"Can't find file: /etc/audit/auditd.conf","resource_class":"auditd_conf","resource_params":"[]"}]},{"id":"SV-204514","title":"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and\n    Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum\n    audit record storage capacity is reached.","desc":"If security personnel are not notified immediately when the threshold for the repository maximum audit\n    record storage capacity is reached, they are unable to expand the audit record storage capacity before records are\n    lost.","descriptions":[{"label":"default","data":"If security personnel are not notified immediately when the threshold for the repository maximum audit\n    record storage capacity is reached, they are unable to expand the audit record storage capacity before records are\n    lost."},{"label":"check","data":"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the\n    allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n    Check what action the operating system takes when the threshold for the repository maximum audit record storage\n    capacity is reached with the following command:\n    # grep -i space_left_action  /etc/audit/auditd.conf\n    space_left_action = email\n    If the value of the \"space_left_action\" keyword is not set to \"email\", this is a finding."},{"label":"fix","data":"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold\n    for the repository maximum audit record storage capacity is reached.\n    Uncomment or edit the \"space_left_action\" keyword in \"/etc/audit/auditd.conf\" and set it to \"email\".\n    space_left_action = email"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72091","SV-86715"],"severity":"medium","gtitle":"SRG-OS-000343-GPOS-00134","gid":"V-204514","rid":"SV-204514r877389_rule","stig_id":"RHEL-07-030340","fix_id":"F-4638r88735_fix","cci":["CCI-001855"],"nist":["AU-5 (1)"],"subsystems":["audit","auditd"],"host":null},"code":"control 'SV-204514' do\n  title 'The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and\n    Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum\n    audit record storage capacity is reached.'\n  desc 'If security personnel are not notified immediately when the threshold for the repository maximum audit\n    record storage capacity is reached, they are unable to expand the audit record storage capacity before records are\n    lost.'\n  desc 'check', 'Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the\n    allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.\n    Check what action the operating system takes when the threshold for the repository maximum audit record storage\n    capacity is reached with the following command:\n    # grep -i space_left_action  /etc/audit/auditd.conf\n    space_left_action = email\n    If the value of the \"space_left_action\" keyword is not set to \"email\", this is a finding.'\n  desc 'fix', 'Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold\n    for the repository maximum audit record storage capacity is reached.\n    Uncomment or edit the \"space_left_action\" keyword in \"/etc/audit/auditd.conf\" and set it to \"email\".\n    space_left_action = email'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72091', 'SV-86715']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000343-GPOS-00134'\n  tag gid: 'V-204514'\n  tag rid: 'SV-204514r877389_rule'\n  tag stig_id: 'RHEL-07-030340'\n  tag fix_id: 'F-4638r88735_fix'\n  tag cci: ['CCI-001855']\n  tag nist: ['AU-5 (1)']\n  tag subsystems: ['audit', 'auditd']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe auditd_conf do\n      its('space_left_action.downcase') { should cmp 'email' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204514.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Audit Daemon Config","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Audit Daemon Config","skip_message":"Can't find file: /etc/audit/auditd.conf","resource_class":"auditd_conf","resource_params":"[]"}]},{"id":"SV-204515","title":"The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and\n    Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record\n    storage capacity is reached.","desc":"If security personnel are not notified immediately when the threshold for the repository maximum audit\n    record storage capacity is reached, they are unable to expand the audit record storage capacity before records are\n    lost.","descriptions":[{"label":"default","data":"If security personnel are not notified immediately when the threshold for the repository maximum audit\n    record storage capacity is reached, they are unable to expand the audit record storage capacity before records are\n    lost."},{"label":"check","data":"Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the\n    threshold for the repository maximum audit record storage capacity is reached.\n    Check what account the operating system emails when the threshold for the repository maximum audit record storage\n    capacity is reached with the following command:\n    # grep -i action_mail_acct  /etc/audit/auditd.conf\n    action_mail_acct = root\n    If the value of the \"action_mail_acct\" keyword is not set to \"root\" and other accounts for security personnel, this\n    is a finding."},{"label":"fix","data":"Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold\n    for the repository maximum audit record storage capacity is reached.\n    Uncomment or edit the \"action_mail_acct\" keyword in \"/etc/audit/auditd.conf\" and set it to root and any other\n    accounts associated with security personnel.\n    action_mail_acct = root"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72093","SV-86717"],"severity":"medium","gtitle":"SRG-OS-000343-GPOS-00134","gid":"V-204515","rid":"SV-204515r877389_rule","stig_id":"RHEL-07-030350","fix_id":"F-4639r88738_fix","cci":["CCI-001855"],"nist":["AU-5 (1)"],"subsystems":["audit","auditd"],"host":null},"code":"control 'SV-204515' do\n  title 'The Red Hat Enterprise Linux operating system must immediately notify the System Administrator (SA) and\n    Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record\n    storage capacity is reached.'\n  desc 'If security personnel are not notified immediately when the threshold for the repository maximum audit\n    record storage capacity is reached, they are unable to expand the audit record storage capacity before records are\n    lost.'\n  desc 'check', 'Verify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the\n    threshold for the repository maximum audit record storage capacity is reached.\n    Check what account the operating system emails when the threshold for the repository maximum audit record storage\n    capacity is reached with the following command:\n    # grep -i action_mail_acct  /etc/audit/auditd.conf\n    action_mail_acct = root\n    If the value of the \"action_mail_acct\" keyword is not set to \"root\" and other accounts for security personnel, this\n    is a finding.'\n  desc 'fix', 'Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold\n    for the repository maximum audit record storage capacity is reached.\n    Uncomment or edit the \"action_mail_acct\" keyword in \"/etc/audit/auditd.conf\" and set it to root and any other\n    accounts associated with security personnel.\n    action_mail_acct = root'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72093', 'SV-86717']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000343-GPOS-00134'\n  tag gid: 'V-204515'\n  tag rid: 'SV-204515r877389_rule'\n  tag stig_id: 'RHEL-07-030350'\n  tag fix_id: 'F-4639r88738_fix'\n  tag cci: ['CCI-001855']\n  tag nist: ['AU-5 (1)']\n  tag subsystems: ['audit', 'auditd']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe auditd_conf do\n      its('action_mail_acct') { should cmp 'root' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204515.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Audit Daemon Config","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Audit Daemon Config","skip_message":"Can't find file: /etc/audit/auditd.conf","resource_class":"auditd_conf","resource_params":"[]"}]},{"id":"SV-204516","title":"The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.","desc":"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by\n    unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern\n    and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to\n    detect such misuse and identify the risk from insider threats and the advanced persistent threat.","descriptions":[{"label":"default","data":"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by\n    unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern\n    and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to\n    detect such misuse and identify the risk from insider threats and the advanced persistent threat."},{"label":"check","data":"Verify the operating system audits the execution of privileged functions using the following\n    command:\n    # grep -iw execve /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\n    -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\n    If both the \"b32\" and \"b64\" audit rules for \"SUID\" files are not defined, this is a finding.\n    If both the \"b32\" and \"b64\" audit rules for \"SGID\" files are not defined, this is a finding."},{"label":"fix","data":"Configure the operating system to audit the execution of privileged functions.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\n    -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72095","SV-86719"],"severity":"medium","gtitle":"SRG-OS-000327-GPOS-00127","gid":"V-204516","rid":"SV-204516r853914_rule","stig_id":"RHEL-07-030360","fix_id":"F-4640r88741_fix","cci":["CCI-002234"],"nist":["AC-6 (9)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204516' do\n  title 'The Red Hat Enterprise Linux operating system must audit all executions of privileged functions.'\n  desc 'Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by\n    unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern\n    and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to\n    detect such misuse and identify the risk from insider threats and the advanced persistent threat.'\n  desc 'check', 'Verify the operating system audits the execution of privileged functions using the following\n    command:\n    # grep -iw execve /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\n    -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\n    If both the \"b32\" and \"b64\" audit rules for \"SUID\" files are not defined, this is a finding.\n    If both the \"b32\" and \"b64\" audit rules for \"SGID\" files are not defined, this is a finding.'\n  desc 'fix', 'Configure the operating system to audit the execution of privileged functions.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid\n    -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid\n    -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72095', 'SV-86719']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000327-GPOS-00127'\n  tag gid: 'V-204516'\n  tag rid: 'SV-204516r853914_rule'\n  tag stig_id: 'RHEL-07-030360'\n  tag fix_id: 'F-4640r88741_fix'\n  tag cci: ['CCI-002234']\n  tag nist: ['AC-6 (9)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['execve']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.fields.flatten).to include('uid!=euid', 'gid!=egid', 'euid=0', 'egid=0')\n          expect(audit_rule.key.uniq).to include('setuid', 'setgid')\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204516.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall execve is audited properly","run_time":0.00058,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"execve\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204517","title":"The Red Hat Enterprise Linux operating system must audit all uses of the chown, fchown, fchownat, and\n    lchown syscalls.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible."},{"label":"check","data":"Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"chown\", \"fchown\", \"fchownat\", and \"lchown\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep chown /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"chown\", \"fchown\", \"fchownat\", and \"lchown\"\n    syscalls, this is a finding."},{"label":"fix","data":"Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n\n-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86721","V-72097"],"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000392-GPOS-00172","SRG-OS-000458-GPOS-00203","SRG-OS-000474-GPOS-00219"],"gid":"V-204517","rid":"SV-204517r809570_rule","stig_id":"RHEL-07-030370","fix_id":"F-4641r809192_fix","cci":["CCI-000126","CCI-000172"],"nist":["AU-2 d","AU-12 c","AU-2 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204517' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the chown, fchown, fchownat, and\n    lchown syscalls.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.'\n  desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"chown\", \"fchown\", \"fchownat\", and \"lchown\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep chown /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"chown\", \"fchown\", \"fchownat\", and \"lchown\"\n    syscalls, this is a finding.'\n  desc 'fix', 'Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n\n-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86721', 'V-72097']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000064-GPOS-00033'\n  tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000458-GPOS-00203', 'SRG-OS-000474-GPOS-00219']\n  tag gid: 'V-204517'\n  tag rid: 'SV-204517r809570_rule'\n  tag stig_id: 'RHEL-07-030370'\n  tag fix_id: 'F-4641r809192_fix'\n  tag cci: ['CCI-000126', 'CCI-000172']\n  tag nist: ['AU-2 d', 'AU-12 c', 'AU-2 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['chown', 'fchown', 'fchownat', 'lchown']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n          expect(audit_rule.key.uniq).to cmp 'perm_mod'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204517.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall chown is audited properly","run_time":0.000297,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"chown\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall fchown is audited properly","run_time":0.000278,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"fchown\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall fchownat is audited properly","run_time":0.000274,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"fchownat\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall lchown is audited properly","run_time":0.000269,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"lchown\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204521","title":"The Red Hat Enterprise Linux operating system must audit all uses of the chmod, fchmod, and fchmodat\n    syscalls.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible."},{"label":"check","data":"Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"chmod\", \"fchmod\", and \"fchmodat\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep chmod /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"chmod\", \"fchmod\", and \"fchmodat\" syscalls, this is\n    a finding."},{"label":"fix","data":"Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"chmod\", \"fchmod\", and \"fchmodat\" syscalls.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86729","V-72105"],"severity":"medium","gtitle":"SRG-OS-000458-GPOS-00203","satisfies":["SRG-OS-000458-GPOS-00203","SRG-OS-000392-GPOS-00172","SRG-OS-000064-GPOS-00033"],"gid":"V-204521","rid":"SV-204521r809772_rule","stig_id":"RHEL-07-030410","fix_id":"F-4645r809771_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204521' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the chmod, fchmod, and fchmodat\n    syscalls.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.'\n  desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"chmod\", \"fchmod\", and \"fchmodat\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep chmod /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"chmod\", \"fchmod\", and \"fchmodat\" syscalls, this is\n    a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"chmod\", \"fchmod\", and \"fchmodat\" syscalls.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86729', 'V-72105']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000458-GPOS-00203'\n  tag satisfies: ['SRG-OS-000458-GPOS-00203', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000064-GPOS-00033']\n  tag gid: 'V-204521'\n  tag rid: 'SV-204521r809772_rule'\n  tag stig_id: 'RHEL-07-030410'\n  tag fix_id: 'F-4645r809771_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['chmod', 'fchmod', 'fchmodat']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n          expect(audit_rule.key.uniq).to cmp 'perm_mod'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204521.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall chmod is audited properly","run_time":0.000433,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"chmod\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall fchmod is audited properly","run_time":0.000285,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"fchmod\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall fchmodat is audited properly","run_time":0.000269,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"fchmodat\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204524","title":"The Red Hat Enterprise Linux operating system must audit all uses of the setxattr, fsetxattr, lsetxattr,\n    removexattr, fremovexattr, and lremovexattr syscalls.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible."},{"label":"check","data":"Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"setxattr\", \"fsetxattr\", \"lsetxattr\", \"removexattr\", \"fremovexattr\", and \"lremovexattr\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep xattr /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"setxattr\", \"fsetxattr\", \"lsetxattr\", \"removexattr\",\n    \"fremovexattr\", and \"lremovexattr\" syscalls, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"setxattr\", \"fsetxattr\", \"lsetxattr\", \"removexattr\", \"fremovexattr\", and \"lremovexattr\" syscalls.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86735","V-72111"],"severity":"medium","gtitle":"SRG-OS-000458-GPOS-00203","satisfies":["SRG-OS-000458-GPOS-00203","SRG-OS-000392-GPOS-00172","SRG-OS-000064-GPOS-00033"],"gid":"V-204524","rid":"SV-204524r809775_rule","stig_id":"RHEL-07-030440","fix_id":"F-4648r809774_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204524' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the setxattr, fsetxattr, lsetxattr,\n    removexattr, fremovexattr, and lremovexattr syscalls.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.'\n  desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"setxattr\", \"fsetxattr\", \"lsetxattr\", \"removexattr\", \"fremovexattr\", and \"lremovexattr\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep xattr /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"setxattr\", \"fsetxattr\", \"lsetxattr\", \"removexattr\",\n    \"fremovexattr\", and \"lremovexattr\" syscalls, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"setxattr\", \"fsetxattr\", \"lsetxattr\", \"removexattr\", \"fremovexattr\", and \"lremovexattr\" syscalls.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    -a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F\n    auid!=unset -k perm_mod\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86735', 'V-72111']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000458-GPOS-00203'\n  tag satisfies: ['SRG-OS-000458-GPOS-00203', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000064-GPOS-00033']\n  tag gid: 'V-204524'\n  tag rid: 'SV-204524r809775_rule'\n  tag stig_id: 'RHEL-07-030440'\n  tag fix_id: 'F-4648r809774_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['setxattr', 'fsetxattr', 'lsetxattr', 'removexattr', 'fremovexattr', 'lremovexattr']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n          expect(audit_rule.key.uniq).to cmp 'perm_mod'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204524.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall setxattr is audited properly","run_time":0.000303,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"setxattr\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall fsetxattr is audited properly","run_time":0.000284,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"fsetxattr\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall lsetxattr is audited properly","run_time":0.000276,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"lsetxattr\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall removexattr is audited properly","run_time":0.000446,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"removexattr\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall fremovexattr is audited properly","run_time":0.000276,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"fremovexattr\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall lremovexattr is audited properly","run_time":0.000268,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"lremovexattr\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204531","title":"The Red Hat Enterprise Linux operating system must audit all uses of the creat, open, openat,\n    open_by_handle_at, truncate, and ftruncate syscalls.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible."},{"label":"check","data":"Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"creat\", \"open\", \"openat\", \"open_by_handle_at\", \"truncate\", and \"ftruncate\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep 'open\\|truncate\\|creat' /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"creat\", \"open\", \"openat\", \"open_by_handle_at\",\n    \"truncate\", and \"ftruncate\" syscalls, this is a finding.\n    If the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n    If the output does not produce rules containing \"-F exit=-EACCES\", this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"creat\", \"open\", \"openat\", \"open_by_handle_at\", \"truncate\", and \"ftruncate\" syscalls.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86749","V-72125"],"severity":"medium","gtitle":"SRG-OS-000064-GPOS-00033","satisfies":["SRG-OS-000064-GPOS-00033","SRG-OS-000458-GPOS-00203","SRG-OS-000461-GPOS-00205","SRG-OS-000392-GPOS-00172"],"gid":"V-204531","rid":"SV-204531r853917_rule","stig_id":"RHEL-07-030510","fix_id":"F-4655r853916_fix","cci":["CCI-000172","CCI-002884"],"nist":["AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204531' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the creat, open, openat,\n    open_by_handle_at, truncate, and ftruncate syscalls.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.'\n  desc 'check', %q(Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"creat\", \"open\", \"openat\", \"open_by_handle_at\", \"truncate\", and \"ftruncate\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep 'open\\|truncate\\|creat' /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"creat\", \"open\", \"openat\", \"open_by_handle_at\",\n    \"truncate\", and \"ftruncate\" syscalls, this is a finding.\n    If the output does not produce rules containing \"-F exit=-EPERM\", this is a finding.\n    If the output does not produce rules containing \"-F exit=-EACCES\", this is a finding.)\n  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"creat\", \"open\", \"openat\", \"open_by_handle_at\", \"truncate\", and \"ftruncate\" syscalls.\n    Add or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F\n    auid!=unset -k access\n    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000\n    -F auid!=unset -k access\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86749', 'V-72125']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000064-GPOS-00033'\n  tag satisfies: ['SRG-OS-000064-GPOS-00033', 'SRG-OS-000458-GPOS-00203', 'SRG-OS-000461-GPOS-00205', 'SRG-OS-000392-GPOS-00172']\n  tag gid: 'V-204531'\n  tag rid: 'SV-204531r853917_rule'\n  tag stig_id: 'RHEL-07-030510'\n  tag fix_id: 'F-4655r853916_fix'\n  tag cci: ['CCI-000172', 'CCI-002884']\n  tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['creat', 'open', 'openat', 'open_by_handle_at', 'truncate', 'ftruncate']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1', 'exit=-EACCES', 'exit=-EPERM')\n          expect(audit_rule.key.uniq).to cmp 'access'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204531.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall creat is audited properly","run_time":0.000282,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"creat\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall open is audited properly","run_time":0.000277,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"open\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall openat is audited properly","run_time":0.000275,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"openat\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall open_by_handle_at is audited properly","run_time":0.000453,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"open_by_handle_at\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall truncate is audited properly","run_time":0.000273,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"truncate\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall ftruncate is audited properly","run_time":0.000277,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"ftruncate\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204536","title":"The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"semanage\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/semanage\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"semanage\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86759","V-72135"],"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000463-GPOS-00207","SRG-OS-000465-GPOS-00209"],"gid":"V-204536","rid":"SV-204536r861014_rule","stig_id":"RHEL-07-030560","fix_id":"F-4660r861013_fix","cci":["CCI-000172","CCI-002884"],"nist":["AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204536' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the semanage command.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"semanage\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/semanage\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"semanage\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86759', 'V-72135']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000392-GPOS-00172'\n  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']\n  tag gid: 'V-204536'\n  tag rid: 'SV-204536r861014_rule'\n  tag stig_id: 'RHEL-07-030560'\n  tag fix_id: 'F-4660r861013_fix'\n  tag cci: ['CCI-000172', 'CCI-002884']\n  tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/semanage'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204536.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/semanage is audited properly","run_time":0.000287,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/semanage\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204537","title":"The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setsebool\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/setsebool\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setsebool\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72137","SV-86761"],"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000463-GPOS-00207","SRG-OS-000465-GPOS-00209"],"gid":"V-204537","rid":"SV-204537r861017_rule","stig_id":"RHEL-07-030570","fix_id":"F-4661r861016_fix","cci":["CCI-000172","CCI-002884"],"nist":["AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204537' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the setsebool command.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setsebool\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/setsebool\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setsebool\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72137', 'SV-86761']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000392-GPOS-00172'\n  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']\n  tag gid: 'V-204537'\n  tag rid: 'SV-204537r861017_rule'\n  tag stig_id: 'RHEL-07-030570'\n  tag fix_id: 'F-4661r861016_fix'\n  tag cci: ['CCI-000172', 'CCI-002884']\n  tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/setsebool'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204537.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/setsebool is audited properly","run_time":0.000287,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/setsebool\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204538","title":"The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/chcon\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72139","SV-86763"],"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000463-GPOS-00207","SRG-OS-000465-GPOS-00209"],"gid":"V-204538","rid":"SV-204538r861020_rule","stig_id":"RHEL-07-030580","fix_id":"F-4662r861019_fix","cci":["CCI-000172","CCI-002884"],"nist":["AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204538' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the chcon command.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/chcon\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chcon\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72139', 'SV-86763']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000392-GPOS-00172'\n  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']\n  tag gid: 'V-204538'\n  tag rid: 'SV-204538r861020_rule'\n  tag stig_id: 'RHEL-07-030580'\n  tag fix_id: 'F-4662r861019_fix'\n  tag cci: ['CCI-000172', 'CCI-002884']\n  tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/chcon'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204538.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/chcon is audited properly","run_time":0.000431,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/chcon\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204539","title":"The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setfiles\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/setfiles\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setfiles\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72141","SV-86765"],"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000463-GPOS-00207","SRG-OS-000465-GPOS-00209"],"gid":"V-204539","rid":"SV-204539r861023_rule","stig_id":"RHEL-07-030590","fix_id":"F-4663r861022_fix","cci":["CCI-000172","CCI-002884"],"nist":["AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204539' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the setfiles command.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"setfiles\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/setfiles\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"setfiles\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72141', 'SV-86765']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000392-GPOS-00172'\n  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000463-GPOS-00207', 'SRG-OS-000465-GPOS-00209']\n  tag gid: 'V-204539'\n  tag rid: 'SV-204539r861023_rule'\n  tag stig_id: 'RHEL-07-030590'\n  tag fix_id: 'F-4663r861022_fix'\n  tag cci: ['CCI-000172', 'CCI-002884']\n  tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/setfiles'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204539.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/setfiles is audited properly","run_time":0.000286,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/setfiles\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204540","title":"The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account\n    access events.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system generates audit records when unsuccessful account access events occur.\n    Check the file system rule in \"/etc/audit/audit.rules\" with the following commands:\n    # grep -i /var/run/faillock /etc/audit/audit.rules\n    -w /var/run/faillock -p wa -k logins\n    If the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when unsuccessful account access events\n    occur.\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /var/run/faillock -p wa -k logins\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72145","SV-86769"],"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000470-GPOS-00214","SRG-OS-000473-GPOS-00218"],"gid":"V-204540","rid":"SV-204540r853930_rule","stig_id":"RHEL-07-030610","fix_id":"F-4664r88813_fix","cci":["CCI-000126","CCI-000172","CCI-002884"],"nist":["AU-2 d","AU-12 c","MA-4 (1) (a)","AU-2 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204540' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all unsuccessful account\n    access events.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system generates audit records when unsuccessful account access events occur.\n    Check the file system rule in \"/etc/audit/audit.rules\" with the following commands:\n    # grep -i /var/run/faillock /etc/audit/audit.rules\n    -w /var/run/faillock -p wa -k logins\n    If the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when unsuccessful account access events\n    occur.\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /var/run/faillock -p wa -k logins\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72145', 'SV-86769']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000392-GPOS-00172'\n  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000470-GPOS-00214', 'SRG-OS-000473-GPOS-00218']\n  tag gid: 'V-204540'\n  tag rid: 'SV-204540r853930_rule'\n  tag stig_id: 'RHEL-07-030610'\n  tag fix_id: 'F-4664r88813_fix'\n  tag cci: ['CCI-000126', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-2 d', 'AU-12 c', 'MA-4 (1) (a)', 'AU-2 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/var/run/faillock'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'logins'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204540.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /var/run/faillock is audited properly","run_time":0.00028,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/var/run/faillock\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204541","title":"The Red Hat Enterprise Linux operating system must generate audit records for all successful account access\n    events.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system generates audit records when successful account access events occur.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep -i /var/log/lastlog /etc/audit/audit.rules\n    -w /var/log/lastlog -p wa -k logins\n    If the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful account access events occur.\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /var/log/lastlog -p wa -k logins\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72147","SV-86771"],"severity":"medium","gtitle":"SRG-OS-000392-GPOS-00172","satisfies":["SRG-OS-000392-GPOS-00172","SRG-OS-000470-GPOS-00214","SRG-OS-000473-GPOS-00218"],"gid":"V-204541","rid":"SV-204541r853931_rule","stig_id":"RHEL-07-030620","fix_id":"F-4665r88816_fix","cci":["CCI-000126","CCI-000172","CCI-002884"],"nist":["AU-2 d","AU-12 c","MA-4 (1) (a)","AU-2 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204541' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all successful account access\n    events.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system generates audit records when successful account access events occur.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep -i /var/log/lastlog /etc/audit/audit.rules\n    -w /var/log/lastlog -p wa -k logins\n    If the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful account access events occur.\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /var/log/lastlog -p wa -k logins\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72147', 'SV-86771']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000392-GPOS-00172'\n  tag satisfies: ['SRG-OS-000392-GPOS-00172', 'SRG-OS-000470-GPOS-00214', 'SRG-OS-000473-GPOS-00218']\n  tag gid: 'V-204541'\n  tag rid: 'SV-204541r853931_rule'\n  tag stig_id: 'RHEL-07-030620'\n  tag fix_id: 'F-4665r88816_fix'\n  tag cci: ['CCI-000126', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-2 d', 'AU-12 c', 'MA-4 (1) (a)', 'AU-2 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/var/log/lastlog'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'logins'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204541.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /var/log/lastlog is audited properly","run_time":0.000276,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/var/log/lastlog\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204542","title":"The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated.  Daemons are not user\n    sessions and have the loginuid set to -1.  The auid representation is an unsigned 32-bit integer, which equals\n    4294967295.  The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated.  Daemons are not user\n    sessions and have the loginuid set to -1.  The auid representation is an unsigned 32-bit integer, which equals\n    4294967295.  The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"passwd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/passwd\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"passwd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86773","V-72149"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204542","rid":"SV-204542r861026_rule","stig_id":"RHEL-07-030630","fix_id":"F-4666r861025_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204542' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the passwd command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated.  Daemons are not user\n    sessions and have the loginuid set to -1.  The auid representation is an unsigned 32-bit integer, which equals\n    4294967295.  The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"passwd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/passwd\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"passwd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86773', 'V-72149']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204542'\n  tag rid: 'SV-204542r861026_rule'\n  tag stig_id: 'RHEL-07-030630'\n  tag fix_id: 'F-4666r861025_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/passwd'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204542.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/passwd is audited properly","run_time":0.00029,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/passwd\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204543","title":"The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"unix_chkpwd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/unix_chkpwd\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"unix_chkpwd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86775","V-72151"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204543","rid":"SV-204543r861029_rule","stig_id":"RHEL-07-030640","fix_id":"F-4667r861028_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204543' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the unix_chkpwd command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"unix_chkpwd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/unix_chkpwd\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"unix_chkpwd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86775', 'V-72151']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204543'\n  tag rid: 'SV-204543r861029_rule'\n  tag stig_id: 'RHEL-07-030640'\n  tag fix_id: 'F-4667r861028_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/unix_chkpwd'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204543.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/unix_chkpwd is audited properly","run_time":0.000274,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/unix_chkpwd\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204544","title":"The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"gpasswd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/gpasswd\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"gpasswd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86777","V-72153"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204544","rid":"SV-204544r861032_rule","stig_id":"RHEL-07-030650","fix_id":"F-4668r861031_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204544' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the gpasswd command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"gpasswd\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/gpasswd\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"gpasswd\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86777', 'V-72153']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204544'\n  tag rid: 'SV-204544r861032_rule'\n  tag stig_id: 'RHEL-07-030650'\n  tag fix_id: 'F-4668r861031_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/gpasswd'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204544.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/gpasswd is audited properly","run_time":0.000282,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/gpasswd\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204545","title":"The Red Hat Enterprise Linux operating system must audit all uses of the chage command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chage\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/chage\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chage\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86779","V-72155"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204545","rid":"SV-204545r861035_rule","stig_id":"RHEL-07-030660","fix_id":"F-4669r861034_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204545' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the chage command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chage\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/bin/chage\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chage\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86779', 'V-72155']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204545'\n  tag rid: 'SV-204545r861035_rule'\n  tag stig_id: 'RHEL-07-030660'\n  tag fix_id: 'F-4669r861034_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/chage'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204545.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/chage is audited properly","run_time":0.00028,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/chage\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204546","title":"The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"userhelper\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/userhelper\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"userhelper\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86781","V-72157"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204546","rid":"SV-204546r861038_rule","stig_id":"RHEL-07-030670","fix_id":"F-4670r861037_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204546' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the userhelper command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged password commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"userhelper\" command occur.\n\nCheck the file system rule in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/userhelper\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"userhelper\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86781', 'V-72157']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204546'\n  tag rid: 'SV-204546r861038_rule'\n  tag stig_id: 'RHEL-07-030670'\n  tag fix_id: 'F-4670r861037_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/userhelper'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-passwd'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204546.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/userhelper is audited properly","run_time":0.000277,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/userhelper\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204547","title":"The Red Hat Enterprise Linux operating system must audit all uses of the su command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"su\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/su\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"su\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change \n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86783","V-72159"],"severity":"medium","gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-204547","rid":"SV-204547r861041_rule","stig_id":"RHEL-07-030680","fix_id":"F-4671r861040_fix","cci":["CCI-000130","CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 c","MA-4 (1) (a)","AU-3 a"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204547' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the su command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"su\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/su\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"su\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change \n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86783', 'V-72159']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000037-GPOS-00015'\n  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204547'\n  tag rid: 'SV-204547r861041_rule'\n  tag stig_id: 'RHEL-07-030680'\n  tag fix_id: 'F-4671r861040_fix'\n  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/su'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204547.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/su is audited properly","run_time":0.00027,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/su\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204548","title":"The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"sudo\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/sudo\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"sudo\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change \n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72161","SV-86785"],"severity":"medium","gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-204548","rid":"SV-204548r861044_rule","stig_id":"RHEL-07-030690","fix_id":"F-4672r861043_fix","cci":["CCI-000130","CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 c","MA-4 (1) (a)","AU-3 a"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204548' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the sudo command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"sudo\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/sudo\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"sudo\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change \n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72161', 'SV-86785']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000037-GPOS-00015'\n  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204548'\n  tag rid: 'SV-204548r861044_rule'\n  tag stig_id: 'RHEL-07-030690'\n  tag fix_id: 'F-4672r861043_fix'\n  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/sudo'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204548.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/sudo is audited properly","run_time":0.000276,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/sudo\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204549","title":"The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the\n    /etc/sudoers.d/ directory.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to access\n    the \"/etc/sudoers\" file and files in the \"/etc/sudoers.d/\" directory.\n    Check for modification of the following files being audited by performing the following commands to check the file\n    system rules in \"/etc/audit/audit.rules\":\n    # grep -i \"/etc/sudoers\" /etc/audit/audit.rules\n    -w /etc/sudoers -p wa -k privileged-actions\n    # grep -i \"/etc/sudoers.d/\" /etc/audit/audit.rules\n    -w /etc/sudoers.d/ -p wa -k privileged-actions\n    If the commands do not return output that match the examples, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to\n    access the \"/etc/sudoers\" file and files in the \"/etc/sudoers.d/\" directory.\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/sudoers -p wa -k privileged-actions\n    -w /etc/sudoers.d/ -p wa -k privileged-actions\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72163","SV-86787"],"severity":"medium","gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-204549","rid":"SV-204549r853953_rule","stig_id":"RHEL-07-030700","fix_id":"F-4673r88840_fix","cci":["CCI-000130","CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 c","MA-4 (1) (a)","AU-3 a"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204549' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the sudoers file and all files in the\n    /etc/sudoers.d/ directory.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to access\n    the \"/etc/sudoers\" file and files in the \"/etc/sudoers.d/\" directory.\n    Check for modification of the following files being audited by performing the following commands to check the file\n    system rules in \"/etc/audit/audit.rules\":\n    # grep -i \"/etc/sudoers\" /etc/audit/audit.rules\n    -w /etc/sudoers -p wa -k privileged-actions\n    # grep -i \"/etc/sudoers.d/\" /etc/audit/audit.rules\n    -w /etc/sudoers.d/ -p wa -k privileged-actions\n    If the commands do not return output that match the examples, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to\n    access the \"/etc/sudoers\" file and files in the \"/etc/sudoers.d/\" directory.\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/sudoers -p wa -k privileged-actions\n    -w /etc/sudoers.d/ -p wa -k privileged-actions\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72163', 'SV-86787']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000037-GPOS-00015'\n  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204549'\n  tag rid: 'SV-204549r853953_rule'\n  tag stig_id: 'RHEL-07-030700'\n  tag fix_id: 'F-4673r88840_fix'\n  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_commands = ['/etc/sudoers', '/etc/sudoers.d/']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      audit_commands.each do |audit_command|\n        it \"#{audit_command} is audited properly\" do\n          audit_rule = auditd.file(audit_command)\n          expect(audit_rule).to exist\n          expect(audit_rule.key).to cmp 'privileged-actions'\n          expect(audit_rule.permissions.flatten).to include('w', 'a')\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204549.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /etc/sudoers is audited properly","run_time":0.000412,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/sudoers\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Command /etc/sudoers.d/ is audited properly","run_time":0.000275,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/sudoers.d/\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204550","title":"The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/newgrp\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72165","SV-86789"],"severity":"medium","gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-204550","rid":"SV-204550r861047_rule","stig_id":"RHEL-07-030710","fix_id":"F-4674r861046_fix","cci":["CCI-000130","CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 c","MA-4 (1) (a)","AU-3 a"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204550' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the newgrp command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/newgrp\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"newgrp\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72165', 'SV-86789']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000037-GPOS-00015'\n  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204550'\n  tag rid: 'SV-204550r861047_rule'\n  tag stig_id: 'RHEL-07-030710'\n  tag fix_id: 'F-4674r861046_fix'\n  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/newgrp'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204550.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/newgrp is audited properly","run_time":0.000273,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/newgrp\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204551","title":"The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/chsh\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86791","V-72167"],"severity":"medium","gtitle":"SRG-OS-000037-GPOS-00015","satisfies":["SRG-OS-000037-GPOS-00015","SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000462-GPOS-00206","SRG-OS-000471-GPOS-00215"],"gid":"V-204551","rid":"SV-204551r861050_rule","stig_id":"RHEL-07-030720","fix_id":"F-4675r861049_fix","cci":["CCI-000130","CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3","AU-3 (1)","AU-12 c","MA-4 (1) (a)","AU-3 a"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204551' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the chsh command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged access commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/chsh\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"chsh\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86791', 'V-72167']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000037-GPOS-00015'\n  tag satisfies: ['SRG-OS-000037-GPOS-00015', 'SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000462-GPOS-00206', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204551'\n  tag rid: 'SV-204551r861050_rule'\n  tag stig_id: 'RHEL-07-030720'\n  tag fix_id: 'F-4675r861049_fix'\n  tag cci: ['CCI-000130', 'CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3', 'AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)', 'AU-3 a']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/chsh'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-priv_change'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204551.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/chsh is audited properly","run_time":0.000279,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/chsh\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204552","title":"The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"mount\" command and syscall occur.\n\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"mount\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"mount\" syscall, this is a finding.\n\nIf all uses of the \"mount\" command are not being audited, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"mount\" command and syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72171","SV-86795"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172"],"gid":"V-204552","rid":"SV-204552r861053_rule","stig_id":"RHEL-07-030740","fix_id":"F-4676r861052_fix","cci":["CCI-000135","CCI-002884"],"nist":["AU-3 (1)","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204552' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the mount command and syscall.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"mount\" command and syscall occur.\n\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"mount\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"mount\" syscall, this is a finding.\n\nIf all uses of the \"mount\" command are not being audited, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"mount\" command and syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount\n-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72171', 'SV-86795']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']\n  tag gid: 'V-204552'\n  tag rid: 'SV-204552r861053_rule'\n  tag stig_id: 'RHEL-07-030740'\n  tag fix_id: 'F-4676r861052_fix'\n  tag cci: ['CCI-000135', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscall = 'mount'\n  audit_command = '/usr/bin/mount'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      it \"#{audit_syscall} is audited properly\" do\n        audit_rule = auditd.syscall(audit_syscall)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        if os.arch.match(/64/)\n          expect(audit_rule.arch.uniq).to include('b32', 'b64')\n        else\n          expect(audit_rule.arch.uniq).to cmp 'b32'\n        end\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-mount'\n      end\n    end\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-mount'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204552.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall mount is audited properly","run_time":0.000278,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"mount\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Command /usr/bin/mount is audited properly","run_time":0.000268,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/mount\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204553","title":"The Red Hat Enterprise Linux operating system must audit all uses of the umount command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"umount\" command occur.\n\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/umount\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount \n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"umount\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72173","SV-86797"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172"],"gid":"V-204553","rid":"SV-204553r861056_rule","stig_id":"RHEL-07-030750","fix_id":"F-4677r861055_fix","cci":["CCI-000135","CCI-002884"],"nist":["AU-3 (1)","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204553' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the umount command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"umount\" command occur.\n\nCheck that the following system call is being audited by performing the following series of commands to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/umount\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount \n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"umount\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72173', 'SV-86797']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']\n  tag gid: 'V-204553'\n  tag rid: 'SV-204553r861056_rule'\n  tag stig_id: 'RHEL-07-030750'\n  tag fix_id: 'F-4677r861055_fix'\n  tag cci: ['CCI-000135', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/umount'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-mount'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204553.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/umount is audited properly","run_time":0.000288,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/umount\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204554","title":"The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"postdrop\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/sbin/postdrop\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"postdrop\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72175","SV-86799"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172"],"gid":"V-204554","rid":"SV-204554r861059_rule","stig_id":"RHEL-07-030760","fix_id":"F-4678r861058_fix","cci":["CCI-000135","CCI-002884"],"nist":["AU-3 (1)","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204554' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the postdrop command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"postdrop\" command occur.\n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/sbin/postdrop\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"postdrop\" command occur.\n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72175', 'SV-86799']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']\n  tag gid: 'V-204554'\n  tag rid: 'SV-204554r861059_rule'\n  tag stig_id: 'RHEL-07-030760'\n  tag fix_id: 'F-4678r861058_fix'\n  tag cci: ['CCI-000135', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/postdrop'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-postfix'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204554.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/postdrop is audited properly","run_time":0.000279,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/postdrop\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204555","title":"The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"postqueue\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/sbin/postqueue\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"postqueue\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86801","V-72177"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172"],"gid":"V-204555","rid":"SV-204555r861062_rule","stig_id":"RHEL-07-030770","fix_id":"F-4679r861061_fix","cci":["CCI-000135","CCI-002884"],"nist":["AU-3 (1)","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204555' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the postqueue command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization\n    must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of\n    compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"postqueue\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/sbin/postqueue\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"postqueue\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-postfix\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86801', 'V-72177']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172']\n  tag gid: 'V-204555'\n  tag rid: 'SV-204555r861062_rule'\n  tag stig_id: 'RHEL-07-030770'\n  tag fix_id: 'F-4679r861061_fix'\n  tag cci: ['CCI-000135', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/postqueue'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-postfix'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204555.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/postqueue is audited properly","run_time":0.000274,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/postqueue\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204556","title":"The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must\n    maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must\n    maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"ssh-keysign\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/libexec/openssh/ssh-keysign\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"ssh-keysign\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86803","V-72179"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204556","rid":"SV-204556r861065_rule","stig_id":"RHEL-07-030780","fix_id":"F-4680r861064_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204556' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the ssh-keysign command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must\n    maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"ssh-keysign\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/libexec/openssh/ssh-keysign\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"ssh-keysign\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86803', 'V-72179']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204556'\n  tag rid: 'SV-204556r861065_rule'\n  tag stig_id: 'RHEL-07-030780'\n  tag fix_id: 'F-4680r861064_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/libexec/openssh/ssh-keysign'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-ssh'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204556.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/libexec/openssh/ssh-keysign is audited properly","run_time":0.000276,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/libexec/openssh/ssh-keysign\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204557","title":"The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.","desc":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged commands. The organization must\n    maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged commands. The organization must\n    maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"crontab\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/crontab\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-cron\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"crontab\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-cron\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86807","V-72183"],"severity":"medium","gtitle":"SRG-OS-000042-GPOS-00020","satisfies":["SRG-OS-000042-GPOS-00020","SRG-OS-000392-GPOS-00172","SRG-OS-000471-GPOS-00215"],"gid":"V-204557","rid":"SV-204557r861068_rule","stig_id":"RHEL-07-030800","fix_id":"F-4681r861067_fix","cci":["CCI-000135","CCI-000172","CCI-002884"],"nist":["AU-3 (1)","AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204557' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the crontab command.'\n  desc 'Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough\n    information.\n    At a minimum, the organization must audit the full-text recording of privileged commands. The organization must\n    maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"crontab\" command occur. \n\nCheck that the following system call is being audited by performing the following command to check the file system rules in \"/etc/audit/audit.rules\": \n\n$ sudo grep -w \"/usr/bin/crontab\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-cron\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"crontab\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-cron\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86807', 'V-72183']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000042-GPOS-00020'\n  tag satisfies: ['SRG-OS-000042-GPOS-00020', 'SRG-OS-000392-GPOS-00172', 'SRG-OS-000471-GPOS-00215']\n  tag gid: 'V-204557'\n  tag rid: 'SV-204557r861068_rule'\n  tag stig_id: 'RHEL-07-030800'\n  tag fix_id: 'F-4681r861067_fix'\n  tag cci: ['CCI-000135', 'CCI-000172', 'CCI-002884']\n  tag nist: ['AU-3 (1)', 'AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/crontab'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-cron'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204557.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/crontab is audited properly","run_time":0.000281,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/crontab\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204558","title":"The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"pam_timestamp_check\" command occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/pam_timestamp_check\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam \n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"pam_timestamp_check\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72185","SV-86809"],"severity":"medium","gtitle":"SRG-OS-000471-GPOS-00215","gid":"V-204558","rid":"SV-204558r833166_rule","stig_id":"RHEL-07-030810","fix_id":"F-4682r833165_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204558' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the pam_timestamp_check command.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"pam_timestamp_check\" command occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"/usr/sbin/pam_timestamp_check\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam \n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"pam_timestamp_check\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72185', 'SV-86809']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000471-GPOS-00215'\n  tag gid: 'V-204558'\n  tag rid: 'SV-204558r833166_rule'\n  tag stig_id: 'RHEL-07-030810'\n  tag fix_id: 'F-4682r833165_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/sbin/pam_timestamp_check'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.action.uniq).to cmp 'always'\n        expect(audit_rule.list.uniq).to cmp 'exit'\n        expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n        expect(audit_rule.key.uniq).to cmp 'privileged-pam'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204558.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/sbin/pam_timestamp_check is audited properly","run_time":0.000281,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/sbin/pam_timestamp_check\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204559","title":"The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"create_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"create_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"create_module\" syscall, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"create_module\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-78999","SV-93705"],"severity":"medium","gtitle":"SRG-OS-000471-GPOS-00216","satisfies":["SRG-OS-000471-GPOS-00216","SRG-OS-000477-GPOS-00222"],"gid":"V-204559","rid":"SV-204559r833169_rule","stig_id":"RHEL-07-030819","fix_id":"F-4683r833168_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204559' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the create_module syscall.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"create_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"create_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"create_module\" syscall, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"create_module\" syscall occur.\n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S create_module -F auid>=1000 -F auid!=unset -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-78999', 'SV-93705']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000471-GPOS-00216'\n  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']\n  tag gid: 'V-204559'\n  tag rid: 'SV-204559r833169_rule'\n  tag stig_id: 'RHEL-07-030819'\n  tag fix_id: 'F-4683r833168_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['create_module']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.key.uniq).to cmp 'module-change'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204559.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall create_module is audited properly","run_time":0.000287,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"create_module\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204560","title":"The Red Hat Enterprise Linux operating system must audit all uses of the init_module and finit_module\n    syscalls.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible."},{"label":"check","data":"Verify the operating system generates audit records upon successful/unsuccessful attempts to use the \"init_module\" and \"finit_module\" syscalls. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep init_module /etc/audit/audit.rules \n\n-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\n-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"init_module\" and \"finit_module\" syscalls, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records upon successful/unsuccessful attempts to use the \"init_module\" and \"finit_module\" syscalls. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\n-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72187","SV-86811"],"severity":"medium","gtitle":"SRG-OS-000471-GPOS-00216","satisfies":["SRG-OS-000471-GPOS-00216","SRG-OS-000477-GPOS-00222"],"gid":"V-204560","rid":"SV-204560r833172_rule","stig_id":"RHEL-07-030820","fix_id":"F-4684r833171_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204560' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the init_module and finit_module\n    syscalls.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.'\n  desc 'check', 'Verify the operating system generates audit records upon successful/unsuccessful attempts to use the \"init_module\" and \"finit_module\" syscalls. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep init_module /etc/audit/audit.rules \n\n-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\n-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"init_module\" and \"finit_module\" syscalls, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use the \"init_module\" and \"finit_module\" syscalls. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\n-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k modulechange\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72187', 'SV-86811']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000471-GPOS-00216'\n  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']\n  tag gid: 'V-204560'\n  tag rid: 'SV-204560r833172_rule'\n  tag stig_id: 'RHEL-07-030820'\n  tag fix_id: 'F-4684r833171_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['init_module', 'finit_module']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.key.uniq).to cmp 'modulechange'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204560.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall init_module is audited properly","run_time":0.000279,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"init_module\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall finit_module is audited properly","run_time":0.000269,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"finit_module\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204562","title":"The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"delete_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"delete_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"delete_module\" syscall, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"delete_module\" syscall occur. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72189","SV-86813"],"severity":"medium","gtitle":"SRG-OS-000471-GPOS-00216","satisfies":["SRG-OS-000471-GPOS-00216","SRG-OS-000477-GPOS-00222"],"gid":"V-204562","rid":"SV-204562r833175_rule","stig_id":"RHEL-07-030830","fix_id":"F-4686r833174_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204562' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the delete_module syscall.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"delete_module\" syscall occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep -w \"delete_module\" /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\nIf both the \"b32\" and \"b64\" audit rules are not defined for the \"delete_module\" syscall, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"delete_module\" syscall occur. \n\nAdd or update the following rules in \"/etc/audit/rules.d/audit.rules\": \n\n-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\n-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module-change\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72189', 'SV-86813']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000471-GPOS-00216'\n  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']\n  tag gid: 'V-204562'\n  tag rid: 'SV-204562r833175_rule'\n  tag stig_id: 'RHEL-07-030830'\n  tag fix_id: 'F-4686r833174_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['delete_module']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.key.uniq).to cmp 'module-change'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204562.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall delete_module is audited properly","run_time":0.000277,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"delete_module\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204563","title":"The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way."},{"label":"check","data":"Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"kmod\" command occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep \"/usr/bin/kmod\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules\n\nIf the command does not return any output, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"kmod\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules\n\nThe audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86815","V-72191"],"severity":"medium","gtitle":"SRG-OS-000471-GPOS-00216","satisfies":["SRG-OS-000471-GPOS-00216","SRG-OS-000477-GPOS-00222"],"gid":"V-204563","rid":"SV-204563r858498_rule","stig_id":"RHEL-07-030840","fix_id":"F-4687r858497_fix","cci":["CCI-000172"],"nist":["AU-12 c"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204563' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the kmod command.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.'\n  desc 'check', 'Verify the operating system generates audit records when successful/unsuccessful attempts to use the \"kmod\" command occur. \n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n\n$ sudo grep \"/usr/bin/kmod\" /etc/audit/audit.rules\n\n-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules\n\nIf the command does not return any output, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records when successful/unsuccessful attempts to use the \"kmod\" command occur. \n\nAdd or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules\n\nThe audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86815', 'V-72191']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000471-GPOS-00216'\n  tag satisfies: ['SRG-OS-000471-GPOS-00216', 'SRG-OS-000477-GPOS-00222']\n  tag gid: 'V-204563'\n  tag rid: 'SV-204563r858498_rule'\n  tag stig_id: 'RHEL-07-030840'\n  tag fix_id: 'F-4687r858497_fix'\n  tag cci: ['CCI-000172']\n  tag nist: ['AU-12 c']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/usr/bin/kmod'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'module-change'\n        expect(audit_rule.permissions.flatten).to cmp 'x'\n        expect(audit_rule.fields.flatten).to include 'auid!=-1'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204563.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /usr/bin/kmod is audited properly","run_time":0.000388,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/usr/bin/kmod\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204564","title":"The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/passwd.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/passwd\".\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/passwd /etc/audit/audit.rules\n    -w /etc/passwd -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/passwd\".\n    Add or update the following rule \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/passwd -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86821","V-72197"],"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","satisfies":["SRG-OS-000004-GPOS-00004","SRG-OS-000239-GPOS-00089","SRG-OS-000240-GPOS-00090","SRG-OS-000241-GPOS-00091","SRG-OS-000303-GPOS-00120","SRG-OS-000476-GPOS-00221"],"gid":"V-204564","rid":"SV-204564r853978_rule","stig_id":"RHEL-07-030870","fix_id":"F-4688r88885_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-002130"],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204564' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/passwd.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/passwd\".\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/passwd /etc/audit/audit.rules\n    -w /etc/passwd -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/passwd\".\n    Add or update the following rule \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/passwd -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86821', 'V-72197']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000004-GPOS-00004'\n  tag satisfies: ['SRG-OS-000004-GPOS-00004', 'SRG-OS-000239-GPOS-00089', 'SRG-OS-000240-GPOS-00090', 'SRG-OS-000241-GPOS-00091', 'SRG-OS-000303-GPOS-00120', 'SRG-OS-000476-GPOS-00221']\n  tag gid: 'V-204564'\n  tag rid: 'SV-204564r853978_rule'\n  tag stig_id: 'RHEL-07-030870'\n  tag fix_id: 'F-4688r88885_fix'\n  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']\n  tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/etc/passwd'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'identity'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204564.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /etc/passwd is audited properly","run_time":0.00028,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/passwd\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204565","title":"The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/group.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/group\".\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/group /etc/audit/audit.rules\n    -w /etc/group -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/group\".\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/group -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87817","V-73165"],"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","gid":"V-204565","rid":"SV-204565r853979_rule","stig_id":"RHEL-07-030871","fix_id":"F-4689r88888_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-002130"],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204565' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/group.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/group\".\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/group /etc/audit/audit.rules\n    -w /etc/group -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/group\".\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/group -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87817', 'V-73165']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000004-GPOS-00004'\n  tag gid: 'V-204565'\n  tag rid: 'SV-204565r853979_rule'\n  tag stig_id: 'RHEL-07-030871'\n  tag fix_id: 'F-4689r88888_fix'\n  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']\n  tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/etc/group'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'identity'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204565.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /etc/group is audited properly","run_time":0.00028,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/group\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204566","title":"The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/gshadow.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/gshadow\".\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/gshadow /etc/audit/audit.rules\n    -w /etc/gshadow -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/gshadow\".\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/gshadow -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87819","V-73167"],"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","gid":"V-204566","rid":"SV-204566r853980_rule","stig_id":"RHEL-07-030872","fix_id":"F-4690r88891_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-002130"],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204566' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/gshadow.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/gshadow\".\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/gshadow /etc/audit/audit.rules\n    -w /etc/gshadow -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect \"/etc/gshadow\".\n    Add or update the following rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/gshadow -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87819', 'V-73167']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000004-GPOS-00004'\n  tag gid: 'V-204566'\n  tag rid: 'SV-204566r853980_rule'\n  tag stig_id: 'RHEL-07-030872'\n  tag fix_id: 'F-4690r88891_fix'\n  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']\n  tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/etc/gshadow'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'identity'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204566.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /etc/gshadow is audited properly","run_time":0.000277,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/gshadow\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204567","title":"The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/shadow.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/shadow.\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/shadow /etc/audit/audit.rules\n    -w /etc/shadow -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/shadow.\n    Add or update the following file system rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/shadow -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87823","V-73171"],"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","gid":"V-204567","rid":"SV-204567r853981_rule","stig_id":"RHEL-07-030873","fix_id":"F-4691r88894_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-002130"],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204567' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/shadow.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/shadow.\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/shadow /etc/audit/audit.rules\n    -w /etc/shadow -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/shadow.\n    Add or update the following file system rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/shadow -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87823', 'V-73171']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000004-GPOS-00004'\n  tag gid: 'V-204567'\n  tag rid: 'SV-204567r853981_rule'\n  tag stig_id: 'RHEL-07-030873'\n  tag fix_id: 'F-4691r88894_fix'\n  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']\n  tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/etc/shadow'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'identity'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204567.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /etc/shadow is audited properly","run_time":0.00028,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/shadow\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204568","title":"The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/security/opasswd.","desc":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).","descriptions":[{"label":"default","data":"Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter)."},{"label":"check","data":"Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/security/opasswd.\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/security/opasswd /etc/audit/audit.rules\n    -w /etc/security/opasswd -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/security/opasswd.\n    Add or update the following file system rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/security/opasswd -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect:\n    # systemctl restart auditd"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87825","V-73173"],"severity":"medium","gtitle":"SRG-OS-000004-GPOS-00004","gid":"V-204568","rid":"SV-204568r853982_rule","stig_id":"RHEL-07-030874","fix_id":"F-4692r744114_fix","cci":["CCI-000018","CCI-000172","CCI-001403","CCI-002130"],"nist":["AC-2 (4)","AU-12 c","AC-2 (4)","AC-2 (4)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204568' do\n  title 'The Red Hat Enterprise Linux operating system must generate audit records for all account creations,\n    modifications, disabling, and termination events that affect /etc/security/opasswd.'\n  desc 'Without generating audit records that are specific to the security and mission needs of the organization, it\n    would be difficult to establish, correlate, and investigate the events relating to an incident or identify those\n    responsible for one.\n    Audit records can be generated from various components within the information system (e.g., module or policy\n    filter).'\n  desc 'check', 'Verify the operating system must generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/security/opasswd.\n    Check the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n    # grep /etc/security/opasswd /etc/audit/audit.rules\n    -w /etc/security/opasswd -p wa -k identity\n    If the command does not return a line, or the line is commented out, this is a finding.'\n  desc 'fix', 'Configure the operating system to generate audit records for all account creations, modifications,\n    disabling, and termination events that affect /etc/security/opasswd.\n    Add or update the following file system rule in \"/etc/audit/rules.d/audit.rules\":\n    -w /etc/security/opasswd -p wa -k identity\n    The audit daemon must be restarted for the changes to take effect:\n    # systemctl restart auditd'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87825', 'V-73173']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000004-GPOS-00004'\n  tag gid: 'V-204568'\n  tag rid: 'SV-204568r853982_rule'\n  tag stig_id: 'RHEL-07-030874'\n  tag fix_id: 'F-4692r744114_fix'\n  tag cci: ['CCI-000018', 'CCI-000172', 'CCI-001403', 'CCI-002130']\n  tag nist: ['AC-2 (4)', 'AU-12 c', 'AC-2 (4)', 'AC-2 (4)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_command = '/etc/security/opasswd'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Command' do\n      it \"#{audit_command} is audited properly\" do\n        audit_rule = auditd.file(audit_command)\n        expect(audit_rule).to exist\n        expect(audit_rule.key).to cmp 'identity'\n        expect(audit_rule.permissions.flatten).to include('w', 'a')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204568.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command /etc/security/opasswd is audited properly","run_time":0.000409,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with file == \"/etc/security/opasswd\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204572","title":"The Red Hat Enterprise Linux operating system must audit all uses of the unlink, unlinkat, rename,\n    renameat, and rmdir syscalls.","desc":"If the system is not configured to audit certain activities and write them to an audit log, it is more\n    difficult to detect and track system compromises and damages incurred during a system compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.","descriptions":[{"label":"default","data":"If the system is not configured to audit certain activities and write them to an audit log, it is more\n    difficult to detect and track system compromises and damages incurred during a system compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible."},{"label":"check","data":"Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"unlink\", \"unlinkat\", \"rename\", \"renameat\", and \"rmdir\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep 'unlink\\|rename\\|rmdir' /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"unlink\", \"unlinkat\", \"rename\", \"renameat\", and\n    \"rmdir\" syscalls, this is a finding."},{"label":"fix","data":"Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"unlink\", \"unlinkat\", \"rename\", \"renameat\", and \"rmdir\" syscalls.\n    Add the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    The audit daemon must be restarted for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72205","SV-86829"],"severity":"medium","gtitle":"SRG-OS-000466-GPOS-00210","satisfies":["SRG-OS-000466-GPOS-00210","SRG-OS-000467-GPOS-00211","SRG-OS-000468-GPOS-00212","SRG-OS-000392-GPOS-00172"],"gid":"V-204572","rid":"SV-204572r853985_rule","stig_id":"RHEL-07-030910","fix_id":"F-4696r853984_fix","cci":["CCI-000172","CCI-002884"],"nist":["AU-12 c","MA-4 (1) (a)"],"subsystems":["audit","auditd","audit_rule"],"host":null},"code":"control 'SV-204572' do\n  title 'The Red Hat Enterprise Linux operating system must audit all uses of the unlink, unlinkat, rename,\n    renameat, and rmdir syscalls.'\n  desc 'If the system is not configured to audit certain activities and write them to an audit log, it is more\n    difficult to detect and track system compromises and damages incurred during a system compromise.\n    When a user logs on, the auid is set to the uid of the account that is being authenticated. Daemons are not user\n    sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals\n    4294967295. The audit system interprets -1, 4294967295, and \"unset\" in the same way.\n    The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the\n    system. Therefore, it is very important to use syscall rules only when absolutely necessary since these affect\n    performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining\n    syscalls into one rule whenever possible.'\n  desc 'check', %q(Verify the operating system generates audit records upon successful/unsuccessful attempts to use the\n    \"unlink\", \"unlinkat\", \"rename\", \"renameat\", and \"rmdir\" syscalls.\n    Check the file system rules in \"/etc/audit/audit.rules\" with the following commands:\n    # grep 'unlink\\|rename\\|rmdir' /etc/audit/audit.rules\n    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    If both the \"b32\" and \"b64\" audit rules are not defined for the \"unlink\", \"unlinkat\", \"rename\", \"renameat\", and\n    \"rmdir\" syscalls, this is a finding.)\n  desc 'fix', 'Configure the operating system to generate audit records upon successful/unsuccessful attempts to use\n    the \"unlink\", \"unlinkat\", \"rename\", \"renameat\", and \"rmdir\" syscalls.\n    Add the following rules in \"/etc/audit/rules.d/audit.rules\":\n    -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    -a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>=1000 -F auid!=unset -k delete\n    The audit daemon must be restarted for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72205', 'SV-86829']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000466-GPOS-00210'\n  tag satisfies: ['SRG-OS-000466-GPOS-00210', 'SRG-OS-000467-GPOS-00211', 'SRG-OS-000468-GPOS-00212', 'SRG-OS-000392-GPOS-00172']\n  tag gid: 'V-204572'\n  tag rid: 'SV-204572r853985_rule'\n  tag stig_id: 'RHEL-07-030910'\n  tag fix_id: 'F-4696r853984_fix'\n  tag cci: ['CCI-000172', 'CCI-002884']\n  tag nist: ['AU-12 c', 'MA-4 (1) (a)']\n  tag subsystems: ['audit', 'auditd', 'audit_rule']\n  tag 'host'\n\n  audit_syscalls = ['unlink', 'unlinkat', 'rename', 'renameat', 'rmdir']\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe 'Syscall' do\n      audit_syscalls.each do |audit_syscall|\n        it \"#{audit_syscall} is audited properly\" do\n          audit_rule = auditd.syscall(audit_syscall)\n          expect(audit_rule).to exist\n          expect(audit_rule.action.uniq).to cmp 'always'\n          expect(audit_rule.list.uniq).to cmp 'exit'\n          if os.arch.match(/64/)\n            expect(audit_rule.arch.uniq).to include('b32', 'b64')\n          else\n            expect(audit_rule.arch.uniq).to cmp 'b32'\n          end\n          expect(audit_rule.fields.flatten).to include('auid>=1000', 'auid!=-1')\n          expect(audit_rule.key.uniq).to cmp 'delete'\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204572.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Syscall unlink is audited properly","run_time":0.000281,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"unlink\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall unlinkat is audited properly","run_time":0.00027,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"unlinkat\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall rename is audited properly","run_time":0.000273,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"rename\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall renameat is audited properly","run_time":0.000269,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"renameat\" to exist","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"Syscall rmdir is audited properly","run_time":0.000269,"start_time":"2023-04-18T13:20:14-04:00","message":"expected Auditd Rules with syscall == \"rmdir\" to exist","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204574","title":"The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.","desc":"Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event\n    that the system is compromised or has a hardware failure.","descriptions":[{"label":"default","data":"Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event\n    that the system is compromised or has a hardware failure."},{"label":"check","data":"Verify \"rsyslog\" is configured to send all messages to a log aggregation server.\n    Check the configuration of \"rsyslog\" with the following command:\n    Note: If another logging package is used, substitute the utility configuration file for \"/etc/rsyslog.conf\".\n    # grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf\n    *.* @@logagg.site.mil\n    If there are no lines in the \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files that contain the \"@\" or \"@@\"\n    symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all \"rsyslog\"\n    output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media.\n    If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is\n    a finding."},{"label":"fix","data":"Modify the \"/etc/rsyslog.conf\" or an \"/etc/rsyslog.d/*.conf\" file to contain a configuration line to\n    send all \"rsyslog\" output to a log aggregation system:\n    *.* @@<log aggregation system name>"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86833","V-72209"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204574","rid":"SV-204574r603261_rule","stig_id":"RHEL-07-031000","fix_id":"F-4698r88915_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["rsyslog"],"host":null},"code":"control 'SV-204574' do\n  title 'The Red Hat Enterprise Linux operating system must send rsyslog output to a log aggregation server.'\n  desc 'Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event\n    that the system is compromised or has a hardware failure.'\n  desc 'check', 'Verify \"rsyslog\" is configured to send all messages to a log aggregation server.\n    Check the configuration of \"rsyslog\" with the following command:\n    Note: If another logging package is used, substitute the utility configuration file for \"/etc/rsyslog.conf\".\n    # grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf\n    *.* @@logagg.site.mil\n    If there are no lines in the \"/etc/rsyslog.conf\" or \"/etc/rsyslog.d/*.conf\" files that contain the \"@\" or \"@@\"\n    symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all \"rsyslog\"\n    output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media.\n    If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is\n    a finding.'\n  desc 'fix', 'Modify the \"/etc/rsyslog.conf\" or an \"/etc/rsyslog.d/*.conf\" file to contain a configuration line to\n    send all \"rsyslog\" output to a log aggregation system:\n    *.* @@<log aggregation system name>'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86833', 'V-72209']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204574'\n  tag rid: 'SV-204574r603261_rule'\n  tag stig_id: 'RHEL-07-031000'\n  tag fix_id: 'F-4698r88915_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['rsyslog']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif input('alternate_logs')\n    describe 'An alternate logging system is used. This test cannot be checked in a automated fashion and you must check it manually' do\n      skip 'An alternate logging system is used. This check must be performed manually'\n    end\n  else\n    describe command(\"grep @ #{input('log_pkg_paths').join(' ')} | grep -v \\\"^#\\\"\") do\n      its('stdout.strip') { should_not be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204574.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `grep @ /etc/rsyslog.conf /etc/rsyslog.d/* | grep -v \"^#\"` ","run_time":0.000212,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"grep @ /etc/rsyslog.conf /etc/rsyslog.d/* | grep -v \\\"^#\\\"\"]"}]},{"id":"SV-204575","title":"The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept\n    log messages from other servers unless the server is being used for log aggregation.","desc":"Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk.\n    Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could\n    introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of\n    Service.\n    If the system is intended to be a log aggregation server its use must be documented with the ISSO.","descriptions":[{"label":"default","data":"Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk.\n    Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could\n    introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of\n    Service.\n    If the system is intended to be a log aggregation server its use must be documented with the ISSO."},{"label":"check","data":"Verify that the system is not accepting \"rsyslog\" messages from other systems unless it is\n    documented as a log aggregation server.\n    Check the configuration of \"rsyslog\" with the following command:\n    # grep imtcp /etc/rsyslog.conf\n    $ModLoad imtcp\n    # grep imudp /etc/rsyslog.conf\n    $ModLoad imudp\n    # grep imrelp /etc/rsyslog.conf\n    $ModLoad imrelp\n    If any of the above modules are being loaded in the \"/etc/rsyslog.conf\" file, ask to see the documentation for the\n    system being used for log aggregation.\n    If the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding."},{"label":"fix","data":"Modify the \"/etc/rsyslog.conf\" file to remove the \"ModLoad imtcp\", \"ModLoad imudp\", and \"ModLoad\n    imrelp\" configuration lines, or document the system as being used for log aggregation."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86835","V-72211"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204575","rid":"SV-204575r853986_rule","stig_id":"RHEL-07-031010","fix_id":"F-4699r88918_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["rsyslog"],"host":null},"code":"control 'SV-204575' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the rsyslog daemon does not accept\n    log messages from other servers unless the server is being used for log aggregation.'\n  desc \"Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk.\n    Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could\n    introduce misleading information in to the system's logs, or could fill the system's storage leading to a Denial of\n    Service.\n    If the system is intended to be a log aggregation server its use must be documented with the ISSO.\"\n  desc 'check', 'Verify that the system is not accepting \"rsyslog\" messages from other systems unless it is\n    documented as a log aggregation server.\n    Check the configuration of \"rsyslog\" with the following command:\n    # grep imtcp /etc/rsyslog.conf\n    $ModLoad imtcp\n    # grep imudp /etc/rsyslog.conf\n    $ModLoad imudp\n    # grep imrelp /etc/rsyslog.conf\n    $ModLoad imrelp\n    If any of the above modules are being loaded in the \"/etc/rsyslog.conf\" file, ask to see the documentation for the\n    system being used for log aggregation.\n    If the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding.'\n  desc 'fix', 'Modify the \"/etc/rsyslog.conf\" file to remove the \"ModLoad imtcp\", \"ModLoad imudp\", and \"ModLoad\n    imrelp\" configuration lines, or document the system as being used for log aggregation.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86835', 'V-72211']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204575'\n  tag rid: 'SV-204575r853986_rule'\n  tag stig_id: 'RHEL-07-031010'\n  tag fix_id: 'F-4699r88918_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['rsyslog']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  else\n    log_aggregation_server = input('log_aggregation_server')\n\n    if log_aggregation_server\n      describe file('/etc/rsyslog.conf') do\n        its('content') { should match(/^\\$ModLoad\\s+imtcp.*\\n?$/) }\n      end\n    else\n      describe.one do\n        describe file('/etc/rsyslog.conf') do\n          its('content') { should match(/\\$ModLoad\\s+imtcp.*\\n?$/) }\n        end\n        describe file('/etc/rsyslog.conf') do\n          its('content') { should_not match(/^\\$ModLoad\\s+imtcp.*\\n?$/) }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204575.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"File /etc/rsyslog.conf content is expected not to match /^\\$ModLoad\\s+imtcp.*\\n?$/","run_time":0.000114,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"file","resource_params":"[\"/etc/rsyslog.conf\"]"}]},{"id":"SV-204576","title":"The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all\n    accounts and/or account types.","desc":"Operating system management includes the ability to control the number of users and user sessions that\n    utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the\n    risks related to DoS attacks.\n    This requirement addresses concurrent sessions for information system accounts and does not address concurrent\n    sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined\n    based on mission needs and the operational environment for each system.","descriptions":[{"label":"default","data":"Operating system management includes the ability to control the number of users and user sessions that\n    utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the\n    risks related to DoS attacks.\n    This requirement addresses concurrent sessions for information system accounts and does not address concurrent\n    sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined\n    based on mission needs and the operational environment for each system."},{"label":"check","data":"Verify the operating system limits the number of concurrent sessions to \"10\" for all accounts and/or\n    account types by issuing the following command:\n    # grep \"maxlogins\" /etc/security/limits.conf /etc/security/limits.d/*.conf\n    * hard maxlogins 10\n    This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.\n    If the \"maxlogins\" item is missing, commented out, or the value is not set to \"10\" or less for all domains that have\n    the \"maxlogins\" item assigned, this is a finding."},{"label":"fix","data":"Configure the operating system to limit the number of concurrent sessions to \"10\" for all accounts\n    and/or account types.\n    Add the following line to the top of the /etc/security/limits.conf or in a \".conf\" file defined in\n    /etc/security/limits.d/ :\n    * hard maxlogins 10"}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72217","SV-86841"],"severity":"low","gtitle":"SRG-OS-000027-GPOS-00008","gid":"V-204576","rid":"SV-204576r877399_rule","stig_id":"RHEL-07-040000","fix_id":"F-4700r88921_fix","cci":["CCI-000054"],"nist":["AC-10"],"subsystems":["session"],"host":null,"container":null},"code":"control 'SV-204576' do\n  title 'The Red Hat Enterprise Linux operating system must limit the number of concurrent sessions to 10 for all\n    accounts and/or account types.'\n  desc 'Operating system management includes the ability to control the number of users and user sessions that\n    utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the\n    risks related to DoS attacks.\n    This requirement addresses concurrent sessions for information system accounts and does not address concurrent\n    sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined\n    based on mission needs and the operational environment for each system.'\n  desc 'check', 'Verify the operating system limits the number of concurrent sessions to \"10\" for all accounts and/or\n    account types by issuing the following command:\n    # grep \"maxlogins\" /etc/security/limits.conf /etc/security/limits.d/*.conf\n    * hard maxlogins 10\n    This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.\n    If the \"maxlogins\" item is missing, commented out, or the value is not set to \"10\" or less for all domains that have\n    the \"maxlogins\" item assigned, this is a finding.'\n  desc 'fix', 'Configure the operating system to limit the number of concurrent sessions to \"10\" for all accounts\n    and/or account types.\n    Add the following line to the top of the /etc/security/limits.conf or in a \".conf\" file defined in\n    /etc/security/limits.d/ :\n    * hard maxlogins 10'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72217', 'SV-86841']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000027-GPOS-00008'\n  tag gid: 'V-204576'\n  tag rid: 'SV-204576r877399_rule'\n  tag stig_id: 'RHEL-07-040000'\n  tag fix_id: 'F-4700r88921_fix'\n  tag cci: ['CCI-000054']\n  tag nist: ['AC-10']\n  tag subsystems: ['session']\n  tag 'host'\n  tag 'container'\n\n  maxlogins_limit = input('expected_maxlogins_limit')\n\n  # Collect any files under limits.d if they exist\n  limits_files = directory('/etc/security/limits.d').exist? ? command('ls /etc/security/limits.d/*.conf').stdout.strip.lines : []\n  # Add limits.conf to the list\n  limits_files.push('/etc/security/limits.conf')\n  compliant_files = []\n  noncompliant_files = []\n\n  limits_files.each do |limits_file|\n    # Get any universal limits from each file\n    local_limits = limits_conf(limits_file).*\n    # If we got an array (results) check further\n    next unless local_limits.is_a?(Array)\n\n    local_limits.each do |temp_limit|\n      # For each result check if it is a 'hard' limit for 'maxlogins'\n      if temp_limit.include?('hard') && temp_limit.include?('maxlogins')\n        # If the limit is correct, push to compliant files\n        if temp_limit[-1].to_i == input('expected_maxlogins_limit')\n          compliant_files.push(limits_file)\n        # Otherwise add to noncompliant files\n        else\n          noncompliant_files.push(limits_file)\n        end\n      end\n    end\n  end\n\n  # It is required that at least 1 file contain compliant configuration\n  describe \"Files configuring maxlogins less than or equal to #{input('expected_maxlogins_limit')}\" do\n    subject { compliant_files.length }\n    it { should be_positive }\n  end\n\n  # No files should set 'hard' 'maxlogins' to any noncompliant value\n  describe \"Files configuring maxlogins greater than #{input('expected_maxlogins_limit')}\" do\n    subject { noncompliant_files }\n    it { should cmp [] }\n  end\n\n  # No files should set 'hard' 'maxlogins' to any noncompliant value\n  describe 'The expected maxlogins value should be within policy limit' do\n    subject { input('expected_maxlogins_limit') }\n    it { should cmp <= input('max_maxlogins_limit') }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204576.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Files configuring maxlogins less than or equal to 10 is expected to be positive","run_time":0.033621,"start_time":"2023-04-18T13:20:14-04:00","message":"expected `0.positive?` to be truthy, got false","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"Files configuring maxlogins greater than 10 is expected to cmp == []","run_time":0.000207,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"The expected maxlogins value should be within policy limit is expected to cmp <= 10","run_time":0.00035,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204577","title":"The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of\n    functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component\n    Local Service Assessment (PPSM CLSA) and vulnerability assessments.","desc":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or\n    unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict\n    unused or unnecessary physical and logical ports/protocols on information systems.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services provided by default may not be necessary to support essential organizational operations. Additionally, it\n    is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so\n    increases risk over limiting the services provided by any one component.\n    To support the requirements and principles of least functionality, the operating system must support the\n    organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or\n    services to only those required, authorized, and approved to conduct official business or to address authorized\n    quality of life issues.","descriptions":[{"label":"default","data":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or\n    unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict\n    unused or unnecessary physical and logical ports/protocols on information systems.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services provided by default may not be necessary to support essential organizational operations. Additionally, it\n    is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so\n    increases risk over limiting the services provided by any one component.\n    To support the requirements and principles of least functionality, the operating system must support the\n    organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or\n    services to only those required, authorized, and approved to conduct official business or to address authorized\n    quality of life issues."},{"label":"check","data":"Inspect the firewall configuration and running services to verify that it is configured to prohibit\n    or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.\n    Check which services are currently active with the following command:\n    # firewall-cmd --list-all\n    public (default, active)\n    interfaces: enp0s3\n    sources:\n    services: dhcpv6-client dns http https ldaps rpc-bind ssh\n    ports:\n    masquerade: no\n    forward-ports:\n    icmp-blocks:\n    rich rules:\n    Ask the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match\n    the PPSM CLSA.\n    If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols,\n    or services that are prohibited by the PPSM Category Assurance List (CAL), this is a finding."},{"label":"fix","data":"Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site\n    or program and the PPSM CAL."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72219","SV-86843"],"severity":"medium","gtitle":"SRG-OS-000096-GPOS-00050","satisfies":["SRG-OS-000096-GPOS-00050","SRG-OS-000297-GPOS-00115"],"gid":"V-204577","rid":"SV-204577r861069_rule","stig_id":"RHEL-07-040100","fix_id":"F-4701r88924_fix","cci":["CCI-000382","CCI-002314"],"nist":["CM-7 b","AC-17 (1)"],"subsystems":["firewall","manual"],"host":null,"container":null},"code":"control 'SV-204577' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to prohibit or restrict the use of\n    functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component\n    Local Service Assessment (PPSM CLSA) and vulnerability assessments.'\n  desc 'In order to prevent unauthorized connection of devices, unauthorized transfer of information, or\n    unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict\n    unused or unnecessary physical and logical ports/protocols on information systems.\n    Operating systems are capable of providing a wide variety of functions and services. Some of the functions and\n    services provided by default may not be necessary to support essential organizational operations. Additionally, it\n    is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so\n    increases risk over limiting the services provided by any one component.\n    To support the requirements and principles of least functionality, the operating system must support the\n    organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or\n    services to only those required, authorized, and approved to conduct official business or to address authorized\n    quality of life issues.'\n  desc 'check', 'Inspect the firewall configuration and running services to verify that it is configured to prohibit\n    or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited.\n    Check which services are currently active with the following command:\n    # firewall-cmd --list-all\n    public (default, active)\n    interfaces: enp0s3\n    sources:\n    services: dhcpv6-client dns http https ldaps rpc-bind ssh\n    ports:\n    masquerade: no\n    forward-ports:\n    icmp-blocks:\n    rich rules:\n    Ask the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match\n    the PPSM CLSA.\n    If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols,\n    or services that are prohibited by the PPSM Category Assurance List (CAL), this is a finding.'\n  desc 'fix', \"Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site\n    or program and the PPSM CAL.\"\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72219', 'SV-86843']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000096-GPOS-00050'\n  tag satisfies: ['SRG-OS-000096-GPOS-00050', 'SRG-OS-000297-GPOS-00115']\n  tag gid: 'V-204577'\n  tag rid: 'SV-204577r861069_rule'\n  tag stig_id: 'RHEL-07-040100'\n  tag fix_id: 'F-4701r88924_fix'\n  tag cci: ['CCI-000382', 'CCI-002314']\n  tag nist: ['CM-7 b', 'AC-17 (1)']\n  tag subsystems: ['firewall', 'manual']\n  tag 'host'\n  tag 'container'\n\n  if input('firewall_application_package') != ''\n    describe 'Manual review of third-party firewall needed' do\n      skip \"A manual review of firewall application \\'#{input('firewall_application_package')}\\' is needed to determine if it is properly configured\"\n    end\n  else\n\n    firewalld_services_deny = input('firewalld_services_deny')\n    firewalld_hosts_deny = input('firewalld_hosts_deny')\n    firewalld_ports_deny = input('firewalld_ports_deny')\n    firewalld_zones = input('firewalld_zones')\n    iptables_rules = input('iptables_rules')\n\n    if service('firewalld').running?\n\n      # Check that the rules specified in 'firewalld_host_deny' are not enabled\n      describe firewalld do\n        firewalld_hosts_deny.each do |rule|\n          it { should_not have_rule_enabled(rule) }\n        end\n      end\n\n      # Check to make sure zones are specified\n      if firewalld_zones.empty?\n        describe \"Firewalld zones are not specified. Check 'firewalld_zones' input.\" do\n          subject { firewalld_zones.empty? }\n          it { should be false }\n        end\n      end\n\n      # Check that the services specified in 'firewalld_services_deny' and\n      # ports specified in 'firewalld_ports_deny' are not enabled\n      firewalld_zones.each do |zone|\n        if firewalld.has_zone?(zone)\n          zone_services = firewalld_services_deny[zone.to_sym]\n          zone_ports = firewalld_ports_deny[zone.to_sym]\n\n          if !zone_services.nil?\n            describe firewalld do\n              zone_services.each do |serv|\n                it { should_not have_service_enabled_in_zone(serv, zone) }\n              end\n            end\n          else\n            describe \"Services for zone '#{zone}' are not specified. Check 'firewalld_services_deny' input.\" do\n              subject { zone_services.nil? }\n              it { should be false }\n            end\n          end\n\n          if !zone_ports.nil?\n            describe firewalld do\n              zone_ports.each do |port|\n                it { should_not have_port_enabled_in_zone(port, zone) }\n              end\n            end\n          else\n            describe \"Ports for zone '#{zone}' are not specified. Check 'firewalld_ports_deny' input.\" do\n              subject { zone_ports.nil? }\n              it { should be false }\n            end\n          end\n        else\n          describe \"Firewalld zone '#{zone}' exists\" do\n            subject { firewalld.has_zone?(zone) }\n            it { should be true }\n          end\n        end\n      end\n    elsif service('iptables').running?\n      describe iptables do\n        iptables_rules.each do |rule|\n          it { should have_rule(rule) }\n        end\n      end\n    else\n      describe 'An application firewall is running' do\n        subject { service('firewalld').running? || service('iptables').running? }\n        it { should eq true }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204577.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"An application firewall is running is expected to eq true","run_time":0.000518,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: true\n     got: false\n\n(compared using ==)\n\nDiff:\n@@ -1,2 +1,2 @@\n-true\n+false\n","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204578","title":"The Red Hat Enterprise Linux 7 operating system must implement DoD-approved encryption to protect the\n    confidentiality of SSH connections.","desc":"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and\n    therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\n    Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to\n    cryptographic modules.\n    FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize\n    authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general\n    purpose computing system.\n    The system will attempt to use the first cipher presented by the client that matches the server list. Listing the\n    values \"strongest to weakest\" is a method to ensure the use of the strongest cipher available to secure the SSH\n    connection.","descriptions":[{"label":"default","data":"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and\n    therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\n    Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to\n    cryptographic modules.\n    FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize\n    authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general\n    purpose computing system.\n    The system will attempt to use the first cipher presented by the client that matches the server list. Listing the\n    values \"strongest to weakest\" is a method to ensure the use of the strongest cipher available to secure the SSH\n    connection."},{"label":"check","data":"Verify the operating system uses mechanisms meeting the requirements of applicable federal laws,\n    Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic\n    module.\n    The location of the \"sshd_config\" file may vary if a different daemon is in use.\n    Inspect the \"Ciphers\" configuration with the following command:\n    # grep -i ciphers /etc/ssh/sshd_config\n    Ciphers aes256-ctr,aes192-ctr,aes128-ctr\n    If any ciphers other than \"aes256-ctr\", \"aes192-ctr\", or \"aes128-ctr\" are listed, the order differs from the example\n    above, the \"Ciphers\" keyword is missing, or the returned line is commented out, this is a finding."},{"label":"fix","data":"Configure SSH to use FIPS 140-2 approved cryptographic algorithms.\n    Add the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file\n    may be named differently or be in a different location if using a version of SSH that is provided by a third-party\n    vendor).\n    Ciphers aes256-ctr,aes192-ctr,aes128-ctr\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72221","SV-86845"],"severity":"medium","gtitle":"SRG-OS-000033-GPOS-00014","satisfies":["SRG-OS-000033-GPOS-00014","SRG-OS-000120-GPOS-00061","SRG-OS-000125-GPOS-00065","SRG-OS-000250-GPOS-00093","SRG-OS-000393-GPOS-00173"],"gid":"V-204578","rid":"SV-204578r877398_rule","stig_id":"RHEL-07-040110","fix_id":"F-4702r622306_fix","cci":["CCI-000068","CCI-000366","CCI-000803"],"nist":["AC-17 (2)","CM-6 b","IA-7"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204578' do\n  title 'The Red Hat Enterprise Linux 7 operating system must implement DoD-approved encryption to protect the\n    confidentiality of SSH connections.'\n  desc 'Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and\n    therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised.\n    Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to\n    cryptographic modules.\n    FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize\n    authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general\n    purpose computing system.\n    The system will attempt to use the first cipher presented by the client that matches the server list. Listing the\n    values \"strongest to weakest\" is a method to ensure the use of the strongest cipher available to secure the SSH\n    connection.'\n  desc 'check', 'Verify the operating system uses mechanisms meeting the requirements of applicable federal laws,\n    Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic\n    module.\n    The location of the \"sshd_config\" file may vary if a different daemon is in use.\n    Inspect the \"Ciphers\" configuration with the following command:\n    # grep -i ciphers /etc/ssh/sshd_config\n    Ciphers aes256-ctr,aes192-ctr,aes128-ctr\n    If any ciphers other than \"aes256-ctr\", \"aes192-ctr\", or \"aes128-ctr\" are listed, the order differs from the example\n    above, the \"Ciphers\" keyword is missing, or the returned line is commented out, this is a finding.'\n  desc 'fix', 'Configure SSH to use FIPS 140-2 approved cryptographic algorithms.\n    Add the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file\n    may be named differently or be in a different location if using a version of SSH that is provided by a third-party\n    vendor).\n    Ciphers aes256-ctr,aes192-ctr,aes128-ctr\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72221', 'SV-86845']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000033-GPOS-00014'\n  tag satisfies: ['SRG-OS-000033-GPOS-00014', 'SRG-OS-000120-GPOS-00061', 'SRG-OS-000125-GPOS-00065', 'SRG-OS-000250-GPOS-00093', 'SRG-OS-000393-GPOS-00173']\n  tag gid: 'V-204578'\n  tag rid: 'SV-204578r877398_rule'\n  tag stig_id: 'RHEL-07-040110'\n  tag fix_id: 'F-4702r622306_fix'\n  tag cci: ['CCI-000068', 'CCI-000366', 'CCI-000803']\n  tag nist: ['AC-17 (2)', 'CM-6 b', 'IA-7']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    ciphers_array = sshd_config.params('ciphers')\n\n    ciphers_array = ciphers_array.first.split(',') unless ciphers_array.nil?\n\n    describe 'List of encryption algortihms used for SSH connections' do\n      subject { ciphers_array }\n      it { should_not be_nil }\n      it { should eq ['aes256-ctr', 'aes192-ctr', 'aes128-ctr'] }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204578.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204578.rb:1 ","run_time":8.5e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204579","title":"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated\n    with a communication session are terminated at the end of the session or after 15 minutes of inactivity from the\n    user at a command prompt, except to fulfill documented and validated mission requirements.","desc":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized\n    personnel to take control of a management session enabled on the console or console port that has been left\n    unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed\n    network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session.","descriptions":[{"label":"default","data":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized\n    personnel to take control of a management session enabled on the console or console port that has been left\n    unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed\n    network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session."},{"label":"check","data":"Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.\n\nCheck the value of the system inactivity timeout with the following command:\n\n$ sudo grep -irw tmout /etc/profile /etc/bashrc /etc/profile.d\n\netc/profile.d/tmout.sh:declare -xr TMOUT=900\n\nIf conflicting results are returned, this is a finding.\nIf \"TMOUT\" is not set to \"900\" or less to enforce session termination after inactivity, this is a finding."},{"label":"fix","data":"Configure the operating system to terminate all network connections associated with a communications\n    session at the end of the session or after a period of inactivity.\n    Create a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:\n    #!/bin/bash\n    declare -xr TMOUT=900"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86847","V-72223"],"severity":"medium","gtitle":"SRG-OS-000163-GPOS-00072","gid":"V-204579","rid":"SV-204579r861070_rule","stig_id":"RHEL-07-040160","fix_id":"F-4703r646843_fix","cci":["CCI-001133","CCI-002361"],"nist":["SC-10","AC-12"],"subsystems":["user_profile"],"host":null,"container":null},"code":"control 'SV-204579' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all network connections associated\n    with a communication session are terminated at the end of the session or after 15 minutes of inactivity from the\n    user at a command prompt, except to fulfill documented and validated mission requirements.'\n  desc 'Terminating an idle session within a short time period reduces the window of opportunity for unauthorized\n    personnel to take control of a management session enabled on the console or console port that has been left\n    unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed\n    network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session.'\n  desc 'check', 'Verify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity.\n\nCheck the value of the system inactivity timeout with the following command:\n\n$ sudo grep -irw tmout /etc/profile /etc/bashrc /etc/profile.d\n\netc/profile.d/tmout.sh:declare -xr TMOUT=900\n\nIf conflicting results are returned, this is a finding.\nIf \"TMOUT\" is not set to \"900\" or less to enforce session termination after inactivity, this is a finding.'\n  desc 'fix', 'Configure the operating system to terminate all network connections associated with a communications\n    session at the end of the session or after a period of inactivity.\n    Create a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as:\n    #!/bin/bash\n    declare -xr TMOUT=900'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86847', 'V-72223']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000163-GPOS-00072'\n  tag gid: 'V-204579'\n  tag rid: 'SV-204579r861070_rule'\n  tag stig_id: 'RHEL-07-040160'\n  tag fix_id: 'F-4703r646843_fix'\n  tag cci: ['CCI-001133', 'CCI-002361']\n  tag nist: ['SC-10', 'AC-12']\n  tag subsystems: ['user_profile']\n  tag 'host'\n  tag 'container'\n\n  # Get current TMOUT environment variable (active test)\n  describe 'Environment variable TMOUT' do\n    subject { os_env('TMOUT').content.to_i }\n    it { should cmp input('expected_system_activity_timeout') }\n    it { should cmp <= input('max_system_activity_timeout') }\n  end\n\n  # Check if TMOUT is set in files (passive test)\n  files = ['/etc/bashrc'] + ['/etc/profile'] + command('find /etc/profile.d/*').stdout.split(\"\\n\")\n  latest_val = nil\n\n  files.each do |file|\n    readonly = false\n\n    # Skip to next file if TMOUT isn't present. Otherwise, get the last occurrence of TMOUT\n    if (values = command(\"grep -Po '.*TMOUT.*' #{file}\").stdout.split(\"\\n\")).empty?\n      next\n    end\n\n    # Loop through each TMOUT match and see if set TMOUT's value or makes it readonly\n    values.each_with_index do |value, index|\n      # Skip if starts with '#' - it represents a comment\n      next unless value.match(/^#/).nil?\n\n      # If readonly and value is inline - use that value\n      if !value.match(/^readonly\\s+TMOUT\\s*=\\s*\\d+$/).nil?\n        latest_val = value.match(/\\d+/)[0].to_i\n        readonly = true\n        break\n      # If readonly, but, value is not inline - use the most recent value\n      elsif !value.match(/^readonly\\s+(\\w+\\s+)?TMOUT\\s*(\\s+\\w+\\s*)*$/).nil?\n        # If the index is greater than 0, the configuraiton setting value.\n        # Otherwise, the configuration setting value is in the previous file\n        # and is already set in latest_val.\n        latest_val = values[index - 1].match(/\\d+/)[0].to_i if index >= 1\n        readonly = true\n        break\n      # Readonly is not set use the lastest value\n      else\n        latest_val = value.match(/\\d+/)[0].to_i\n      end\n    end\n    # Readonly is set - stop processing files\n    break if readonly === true\n  end\n\n  if latest_val.nil?\n    describe 'The TMOUT setting is configured' do\n      subject { !latest_val.nil? }\n      it { should be true }\n    end\n  else\n    describe 'The TMOUT setting is configured properly' do\n      subject { latest_val }\n      it { should cmp input('expected_system_activity_timeout') }\n      it { should cmp <= input('max_system_activity_timeout') }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204579.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Environment variable TMOUT is expected to cmp == 600","run_time":0.009151,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: 600\n     got: 0\n\n(compared using `cmp` matcher)\n","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"Environment variable TMOUT is expected to cmp <= 600","run_time":0.000765,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The TMOUT setting is configured is expected to equal true","run_time":0.000272,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected true\n     got false\n","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204580","title":"The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent\n    Banner immediately prior to, or as part of, remote access logon prompts.","desc":"Display of a standardized and approved use notification before granting access to the publicly accessible\n    operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws,\n    Executive Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"","descriptions":[{"label":"default","data":"Display of a standardized and approved use notification before granting access to the publicly accessible\n    operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws,\n    Executive Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\""},{"label":"check","data":"Verify any publicly accessible connection to the operating system displays the Standard Mandatory\n    DoD Notice and Consent Banner before granting access to the system.\n    Check for the location of the banner file being used with the following command:\n    # grep -i banner /etc/ssh/sshd_config\n    banner /etc/issue\n    This command will return the banner keyword and the name of the file that contains the ssh banner (in this case\n    \"/etc/issue\").\n    If the line is commented out, this is a finding.\n    View the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice\n    and Consent Banner:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"\n    If the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD\n    Notice and Consent Banner, this is a finding.\n    If the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding."},{"label":"fix","data":"Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the system via the ssh.\n    Edit the \"/etc/ssh/sshd_config\" file to uncomment the banner keyword and configure it to point to a file that will\n    contain the logon banner (this file may be named differently or be in a different location if using a version of SSH\n    that is provided by a third-party vendor). An example configuration line is:\n    banner /etc/issue\n    Either create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice\n    and Consent Banner. The DoD required text is:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72225","SV-86849"],"severity":"medium","gtitle":"SRG-OS-000023-GPOS-00006","satisfies":["SRG-OS-000023-GPOS-00006","SRG-OS-000024-GPOS-00007","SRG-OS-000228-GPOS-00088"],"gid":"V-204580","rid":"SV-204580r603261_rule","stig_id":"RHEL-07-040170","fix_id":"F-4704r297486_fix","cci":["CCI-000048","CCI-000050","CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"],"nist":["AC-8 a","AC-8 b","AC-8 c 1","AC-8 c 2","AC-8 c\\n2","AC-8 c 3"],"subsystems":["ssh","banner"],"host":null},"code":"control 'SV-204580' do\n  title 'The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent\n    Banner immediately prior to, or as part of, remote access logon prompts.'\n  desc 'Display of a standardized and approved use notification before granting access to the publicly accessible\n    operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws,\n    Executive Orders, directives, policies, regulations, standards, and guidance.\n    System use notifications are required only for access via logon interfaces with human users and are not required\n    when such human interfaces do not exist.\n    The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating\n    systems that can accommodate banners of 1300 characters:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"'\n  desc 'check', 'Verify any publicly accessible connection to the operating system displays the Standard Mandatory\n    DoD Notice and Consent Banner before granting access to the system.\n    Check for the location of the banner file being used with the following command:\n    # grep -i banner /etc/ssh/sshd_config\n    banner /etc/issue\n    This command will return the banner keyword and the name of the file that contains the ssh banner (in this case\n    \"/etc/issue\").\n    If the line is commented out, this is a finding.\n    View the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice\n    and Consent Banner:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"\n    If the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD\n    Notice and Consent Banner, this is a finding.\n    If the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.'\n  desc 'fix', 'Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before\n    granting access to the system via the ssh.\n    Edit the \"/etc/ssh/sshd_config\" file to uncomment the banner keyword and configure it to point to a file that will\n    contain the logon banner (this file may be named differently or be in a different location if using a version of SSH\n    that is provided by a third-party vendor). An example configuration line is:\n    banner /etc/issue\n    Either create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice\n    and Consent Banner. The DoD required text is:\n    \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n    By using this IS (which includes any device attached to this IS), you consent to the following conditions:\n    -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to,\n    penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement\n    (LE), and counterintelligence (CI) investigations.\n    -At any time, the USG may inspect and seize data stored on this IS.\n    -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception,\n    and search, and may be disclosed or used for any USG-authorized purpose.\n    -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for\n    your personal benefit or privacy.\n    -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or\n    monitoring of the content of privileged communications, or work product, related to personal representation or\n    services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are\n    private and confidential. See User Agreement for details.\"\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72225', 'SV-86849']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000023-GPOS-00006'\n  tag satisfies: ['SRG-OS-000023-GPOS-00006', 'SRG-OS-000024-GPOS-00007', 'SRG-OS-000228-GPOS-00088']\n  tag gid: 'V-204580'\n  tag rid: 'SV-204580r603261_rule'\n  tag stig_id: 'RHEL-07-040170'\n  tag fix_id: 'F-4704r297486_fix'\n  tag cci: ['CCI-000048', 'CCI-000050', 'CCI-001384', 'CCI-001385', 'CCI-001386', 'CCI-001387', 'CCI-001388']\n  tag nist: ['AC-8 a', 'AC-8 b', 'AC-8 c 1', 'AC-8 c 2', 'AC-8 c\\\\n2', 'AC-8 c 3']\n  tag subsystems: ['ssh', 'banner']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n\n    banner_message_text_ral = input('banner_message_text_ral')\n    banner_message_text_ral_limited = input('banner_message_text_ral_limited')\n\n    # When Banner is commented, not found, disabled, or the specified file does not exist, this is a finding.\n    banner_files = [sshd_config.banner].flatten\n\n    banner_files.each do |banner_file|\n      # Banner property is commented out.\n      if banner_file.nil?\n        describe 'The SSHD Banner is not set' do\n          subject { banner_file.nil? }\n          it { should be false }\n        end\n      end\n\n      # Banner property is set to \"none\"\n      if !banner_file.nil? && !banner_file.match(/none/i).nil?\n        describe 'The SSHD Banner is disabled' do\n          subject { banner_file.match(/none/i).nil? }\n          it { should be true }\n        end\n      end\n\n      # Banner property provides a path to a file, however, it does not exist.\n      if !banner_file.nil? && banner_file.match(/none/i).nil? && !file(banner_file).exist?\n        describe 'The SSHD Banner is set, but, the file does not exist' do\n          subject { file(banner_file).exist? }\n          it { should be true }\n        end\n      end\n\n      # Banner property provides a path to a file and it exists.\n      unless !banner_file.nil? && banner_file.match(/none/i).nil? && file(banner_file).exist?\n        next\n      end\n\n      describe.one do\n        banner = file(banner_file).content.gsub(/[\\r\\n\\s]/, '')\n        clean_banner = banner_message_text_ral.gsub(/[\\r\\n\\s]/, '')\n        clean_banner_limited = banner_message_text_ral_limited.gsub(/[\\r\\n\\s]/,\n                                                                    '')\n\n        describe 'The SSHD Banner is set to the standard banner and has the correct text' do\n          subject { banner }\n          it { should cmp clean_banner }\n        end\n\n        describe 'The SSHD Banner is set to the standard limited banner and has the correct text' do\n          subject { banner }\n          it { should cmp clean_banner_limited }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204580.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204580.rb:1 ","run_time":9.6e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204581","title":"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of\n    Lightweight Directory Access Protocol (LDAP) authentication communications.","desc":"Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.","descriptions":[{"label":"default","data":"Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash."},{"label":"check","data":"If LDAP is not being utilized, this requirement is Not Applicable.\n    Verify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.\n    To determine if LDAP is being used for authentication, use the following command:\n    # systemctl status sssd.service\n    sssd.service - System Security Services Daemon\n    Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\n    Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n    If the \"sssd.service\" is \"active\", then LDAP is being used.\n    Determine the \"id_provider\" the LDAP is currently using:\n    # grep -i \"id_provider\" /etc/sssd/sssd.conf\n    id_provider = ad\n    If \"id_provider\" is set to \"ad\", this is Not Applicable.\n    Ensure that LDAP is configured to use TLS by using the following command:\n    # grep -i \"start_tls\" /etc/sssd/sssd.conf\n    ldap_id_use_start_tls = true\n    If the \"ldap_id_use_start_tls\" option is not \"true\", this is a finding."},{"label":"fix","data":"Configure the operating system to implement cryptography to protect the integrity of LDAP\n    authentication sessions.\n    Add or modify the following line in \"/etc/sssd/sssd.conf\":\n    ldap_id_use_start_tls = true"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72227","SV-86851"],"severity":"medium","gtitle":"SRG-OS-000250-GPOS-00093","gid":"V-204581","rid":"SV-204581r877394_rule","stig_id":"RHEL-07-040180","fix_id":"F-4705r88936_fix","cci":["CCI-001453"],"nist":["AC-17 (2)"],"subsystems":["sssd","ldap"],"host":null},"code":"control 'SV-204581' do\n  title 'The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of\n    Lightweight Directory Access Protocol (LDAP) authentication communications.'\n  desc 'Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.'\n  desc 'check', 'If LDAP is not being utilized, this requirement is Not Applicable.\n    Verify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions.\n    To determine if LDAP is being used for authentication, use the following command:\n    # systemctl status sssd.service\n    sssd.service - System Security Services Daemon\n    Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\n    Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n    If the \"sssd.service\" is \"active\", then LDAP is being used.\n    Determine the \"id_provider\" the LDAP is currently using:\n    # grep -i \"id_provider\" /etc/sssd/sssd.conf\n    id_provider = ad\n    If \"id_provider\" is set to \"ad\", this is Not Applicable.\n    Ensure that LDAP is configured to use TLS by using the following command:\n    # grep -i \"start_tls\" /etc/sssd/sssd.conf\n    ldap_id_use_start_tls = true\n    If the \"ldap_id_use_start_tls\" option is not \"true\", this is a finding.'\n  desc 'fix', 'Configure the operating system to implement cryptography to protect the integrity of LDAP\n    authentication sessions.\n    Add or modify the following line in \"/etc/sssd/sssd.conf\":\n    ldap_id_use_start_tls = true'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72227', 'SV-86851']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000250-GPOS-00093'\n  tag gid: 'V-204581'\n  tag rid: 'SV-204581r877394_rule'\n  tag stig_id: 'RHEL-07-040180'\n  tag fix_id: 'F-4705r88936_fix'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\n  tag subsystems: ['sssd', 'ldap']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n\n    sssd_id_ldap_enabled = (package('sssd').installed? and\n      !command('grep \"^\\s*id_provider\\s*=\\s*ldap\" /etc/sssd/sssd.conf').stdout.strip.empty?)\n\n    pam_ldap_enabled = !command('grep \"^[^#]*pam_ldap\\.so\" /etc/pam.d/*').stdout.strip.empty?\n\n    unless sssd_id_ldap_enabled or pam_ldap_enabled\n      impact 0.0\n      describe 'LDAP not enabled' do\n        skip 'LDAP not enabled using any known mechanisms, this control is Not Applicable.'\n      end\n    end\n\n    if sssd_id_ldap_enabled\n      ldap_id_use_start_tls = command('grep ldap_id_use_start_tls /etc/sssd/sssd.conf')\n      describe ldap_id_use_start_tls do\n        its('stdout.strip') do\n          should match(/^ldap_id_use_start_tls\\s*=\\s*true$/)\n        end\n      end\n\n      ldap_id_use_start_tls.stdout.strip.each_line do |line|\n        describe line do\n          it { should match(/^ldap_id_use_start_tls\\s*=\\s*true$/) }\n        end\n      end\n    end\n\n    if pam_ldap_enabled\n      describe command('grep -i ssl /etc/pam_ldap.conf') do\n        its('stdout.strip') { should match(/^ssl start_tls$/) }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204581.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"LDAP not enabled","run_time":8.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"LDAP not enabled using any known mechanisms, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204582","title":"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of\n    Lightweight Directory Access Protocol (LDAP) communications.","desc":"Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.","descriptions":[{"label":"default","data":"Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash."},{"label":"check","data":"If LDAP is not being utilized, this requirement is Not Applicable.\n    Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\n    To determine if LDAP is being used for authentication, use the following command:\n    # systemctl status sssd.service\n    sssd.service - System Security Services Daemon\n    Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\n    Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n    If the \"sssd.service\" is \"active\", then LDAP is being used.\n    Determine the \"id_provider\" the LDAP is currently using:\n    # grep -i \"id_provider\" /etc/sssd/sssd.conf\n    id_provider = ad\n    If \"id_provider\" is set to \"ad\", this is Not Applicable.\n    Verify the sssd service is configured to require the use of certificates:\n    # grep -i tls_reqcert /etc/sssd/sssd.conf\n    ldap_tls_reqcert = demand\n    If the \"ldap_tls_reqcert\" setting is missing, commented out, or does not exist, this is a finding.\n    If the \"ldap_tls_reqcert\" setting is not set to \"demand\" or \"hard\", this is a finding."},{"label":"fix","data":"Configure the operating system to implement cryptography to protect the integrity of LDAP remote\n    access sessions.\n    Add or modify the following line in \"/etc/sssd/sssd.conf\":\n    ldap_tls_reqcert = demand"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72229","SV-86853"],"severity":"medium","gtitle":"SRG-OS-000250-GPOS-00093","gid":"V-204582","rid":"SV-204582r877394_rule","stig_id":"RHEL-07-040190","fix_id":"F-4706r88939_fix","cci":["CCI-001453"],"nist":["AC-17 (2)"],"subsystems":["sssd","ldap"],"host":null},"code":"control 'SV-204582' do\n  title 'The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of\n    Lightweight Directory Access Protocol (LDAP) communications.'\n  desc 'Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.'\n  desc 'check', 'If LDAP is not being utilized, this requirement is Not Applicable.\n    Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\n    To determine if LDAP is being used for authentication, use the following command:\n    # systemctl status sssd.service\n    sssd.service - System Security Services Daemon\n    Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\n    Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n    If the \"sssd.service\" is \"active\", then LDAP is being used.\n    Determine the \"id_provider\" the LDAP is currently using:\n    # grep -i \"id_provider\" /etc/sssd/sssd.conf\n    id_provider = ad\n    If \"id_provider\" is set to \"ad\", this is Not Applicable.\n    Verify the sssd service is configured to require the use of certificates:\n    # grep -i tls_reqcert /etc/sssd/sssd.conf\n    ldap_tls_reqcert = demand\n    If the \"ldap_tls_reqcert\" setting is missing, commented out, or does not exist, this is a finding.\n    If the \"ldap_tls_reqcert\" setting is not set to \"demand\" or \"hard\", this is a finding.'\n  desc 'fix', 'Configure the operating system to implement cryptography to protect the integrity of LDAP remote\n    access sessions.\n    Add or modify the following line in \"/etc/sssd/sssd.conf\":\n    ldap_tls_reqcert = demand'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72229', 'SV-86853']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000250-GPOS-00093'\n  tag gid: 'V-204582'\n  tag rid: 'SV-204582r877394_rule'\n  tag stig_id: 'RHEL-07-040190'\n  tag fix_id: 'F-4706r88939_fix'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\n  tag subsystems: ['sssd', 'ldap']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n\n    sssd_id_ldap_enabled = (package('sssd').installed? and\n      !command('grep \"^\\s*id_provider\\s*=\\s*ldap\" /etc/sssd/sssd.conf').stdout.strip.empty?)\n\n    sssd_ldap_enabled = (package('sssd').installed? and\n      !command('grep \"^\\s*[a-z]*_provider\\s*=\\s*ldap\" /etc/sssd/sssd.conf').stdout.strip.empty?)\n\n    pam_ldap_enabled = !command('grep \"^[^#]*pam_ldap\\.so\" /etc/pam.d/*').stdout.strip.empty?\n\n    unless sssd_id_ldap_enabled or sssd_ldap_enabled or pam_ldap_enabled\n      impact 0.0\n      describe 'LDAP not enabled' do\n        skip 'LDAP not enabled using any known mechanisms, this control is Not Applicable.'\n      end\n    end\n\n    if sssd_id_ldap_enabled\n      ldap_id_use_start_tls = command('grep ldap_id_use_start_tls /etc/sssd/sssd.conf')\n      describe ldap_id_use_start_tls do\n        its('stdout.strip') do\n          should match(/^ldap_id_use_start_tls\\s*=\\s*true$/)\n        end\n      end\n\n      ldap_id_use_start_tls.stdout.strip.each_line do |line|\n        describe line do\n          it { should match(/^ldap_id_use_start_tls\\s*=\\s*true$/) }\n        end\n      end\n    end\n\n    if sssd_ldap_enabled\n      ldap_tls_cacertdir = command('grep -i ldap_tls_cacertdir /etc/sssd/sssd.conf')\n                           .stdout.strip.scan(/^ldap_tls_cacertdir\\s*=\\s*(.*)/).last\n\n      describe 'ldap_tls_cacertdir' do\n        subject { ldap_tls_cacertdir }\n        it { should_not eq nil }\n      end\n\n      unless ldap_tls_cacertdir.nil?\n        describe file(ldap_tls_cacertdir.last) do\n          it { should exist }\n          it { should be_directory }\n        end\n      end\n    end\n\n    if pam_ldap_enabled\n      tls_cacertdir = command('grep -i tls_cacertdir /etc/pam_ldap.conf')\n                      .stdout.strip.scan(/^tls_cacertdir\\s+(.*)/).last\n\n      describe 'tls_cacertdir' do\n        subject { tls_cacertdir }\n        it { should_not eq nil }\n      end\n\n      unless tls_cacertdir.nil?\n        describe file(tls_cacertdir.last) do\n          it { should exist }\n          it { should be_directory }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204582.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"LDAP not enabled","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"LDAP not enabled using any known mechanisms, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204583","title":"The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of\n    Lightweight Directory Access Protocol (LDAP) communications.","desc":"Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.","descriptions":[{"label":"default","data":"Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash."},{"label":"check","data":"If LDAP is not being utilized, this requirement is Not Applicable.\n    Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\n    To determine if LDAP is being used for authentication, use the following command:\n    # systemctl status sssd.service\n    sssd.service - System Security Services Daemon\n    Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\n    Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n    If the \"sssd.service\" is \"active\", then LDAP is being used.\n    Determine the \"id_provider\" that the LDAP is currently using:\n    # grep -i \"id_provider\" /etc/sssd/sssd.conf\n    id_provider = ad\n    If \"id_provider\" is set to \"ad\", this is Not Applicable.\n    Check the path to the X.509 certificate for peer authentication with the following command:\n    # grep -i tls_cacert /etc/sssd/sssd.conf\n    ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\n    Verify the \"ldap_tls_cacert\" option points to a file that contains the trusted CA certificate.\n    If this file does not exist, or the option is commented out or missing, this is a finding."},{"label":"fix","data":"Configure the operating system to implement cryptography to protect the integrity of LDAP remote\n    access sessions.\n    Add or modify the following line in \"/etc/sssd/sssd.conf\":\n    ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86855","V-72231"],"severity":"medium","gtitle":"SRG-OS-000250-GPOS-00093","gid":"V-204583","rid":"SV-204583r877394_rule","stig_id":"RHEL-07-040200","fix_id":"F-4707r88942_fix","cci":["CCI-001453"],"nist":["AC-17 (2)"],"subsystems":["sssd","ldap"],"host":null},"code":"control 'SV-204583' do\n  title 'The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of\n    Lightweight Directory Access Protocol (LDAP) communications.'\n  desc 'Without cryptographic integrity protections, information can be altered by unauthorized users without\n    detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.'\n  desc 'check', 'If LDAP is not being utilized, this requirement is Not Applicable.\n    Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions.\n    To determine if LDAP is being used for authentication, use the following command:\n    # systemctl status sssd.service\n    sssd.service - System Security Services Daemon\n    Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)\n    Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago\n    If the \"sssd.service\" is \"active\", then LDAP is being used.\n    Determine the \"id_provider\" that the LDAP is currently using:\n    # grep -i \"id_provider\" /etc/sssd/sssd.conf\n    id_provider = ad\n    If \"id_provider\" is set to \"ad\", this is Not Applicable.\n    Check the path to the X.509 certificate for peer authentication with the following command:\n    # grep -i tls_cacert /etc/sssd/sssd.conf\n    ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt\n    Verify the \"ldap_tls_cacert\" option points to a file that contains the trusted CA certificate.\n    If this file does not exist, or the option is commented out or missing, this is a finding.'\n  desc 'fix', 'Configure the operating system to implement cryptography to protect the integrity of LDAP remote\n    access sessions.\n    Add or modify the following line in \"/etc/sssd/sssd.conf\":\n    ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86855', 'V-72231']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000250-GPOS-00093'\n  tag gid: 'V-204583'\n  tag rid: 'SV-204583r877394_rule'\n  tag stig_id: 'RHEL-07-040200'\n  tag fix_id: 'F-4707r88942_fix'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\n  tag subsystems: ['sssd', 'ldap']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n\n    sssd_id_ldap_enabled = (package('sssd').installed? and\n      !command('grep \"^\\s*id_provider\\s*=\\s*ldap\" /etc/sssd/sssd.conf').stdout.strip.empty?)\n\n    sssd_ldap_enabled = (package('sssd').installed? and\n      !command('grep \"^\\s*[a-z]*_provider\\s*=\\s*ldap\" /etc/sssd/sssd.conf').stdout.strip.empty?)\n\n    pam_ldap_enabled = !command('grep \"^[^#]*pam_ldap\\.so\" /etc/pam.d/*').stdout.strip.empty?\n\n    unless sssd_id_ldap_enabled or sssd_ldap_enabled or pam_ldap_enabled\n      impact 0.0\n      describe 'LDAP not enabled' do\n        skip 'LDAP not enabled using any known mechanisms, this control is Not Applicable.'\n      end\n    end\n\n    if sssd_id_ldap_enabled\n      ldap_id_use_start_tls = command('grep ldap_id_use_start_tls /etc/sssd/sssd.conf')\n      describe ldap_id_use_start_tls do\n        its('stdout.strip') do\n          should match(/^ldap_id_use_start_tls\\s*=\\s*true$/)\n        end\n      end\n\n      ldap_id_use_start_tls.stdout.strip.each_line do |line|\n        describe line do\n          it { should match(/^ldap_id_use_start_tls\\s*=\\s*true$/) }\n        end\n      end\n    end\n\n    if sssd_ldap_enabled\n      ldap_tls_cacert = command('grep -i ldap_tls_cacert /etc/sssd/sssd.conf')\n                        .stdout.strip.scan(/^ldap_tls_cacert\\s*=\\s*(.*)/).last\n\n      describe 'ldap_tls_cacert' do\n        subject { ldap_tls_cacert }\n        it { should_not eq nil }\n      end\n\n      unless ldap_tls_cacert.nil?\n        describe file(ldap_tls_cacert.last) do\n          it { should exist }\n          it { should be_file }\n        end\n      end\n    end\n\n    if pam_ldap_enabled\n      tls_cacertfile = command('grep -i tls_cacertfile /etc/pam_ldap.conf')\n                       .stdout.strip.scan(/^tls_cacertfile\\s+(.*)/).last\n\n      describe 'tls_cacertfile' do\n        subject { tls_cacertfile }\n        it { should_not eq nil }\n      end\n\n      unless tls_cacertfile.nil?\n        describe file(tls_cacertfile.last) do\n          it { should exist }\n          it { should be_file }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204583.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"LDAP not enabled","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"LDAP not enabled using any known mechanisms, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204584","title":"The Red Hat Enterprise Linux operating system must implement virtual address space randomization.","desc":"Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of\n    attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally,\n    ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it\n    using return-oriented programming (ROP) techniques.","descriptions":[{"label":"default","data":"Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of\n    attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally,\n    ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it\n    using return-oriented programming (ROP) techniques."},{"label":"check","data":"Verify the operating system implements virtual address space randomization.\n\n     # grep -r kernel.randomize_va_space /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     kernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" is not configured in the /etc/sysctl.conf file or or in any of the other sysctl.d directories, is commented out or does not have a value of \"2\", this is a finding.\n\nCheck that the operating system implements virtual address space randomization with the following command:\n\n     # /sbin/sysctl -a | grep kernel.randomize_va_space \n     kernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" does not have a value of \"2\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Configure the operating system implement virtual address space randomization.\n    Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a config file\n    in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n    kernel.randomize_va_space = 2\n    Issue the following command to make the changes take effect:\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-92521","V-77825"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204584","rid":"SV-204584r880794_rule","stig_id":"RHEL-07-040201","fix_id":"F-4708r880793_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["aslr","kernel_parameter"],"host":null},"code":"control 'SV-204584' do\n  title 'The Red Hat Enterprise Linux operating system must implement virtual address space randomization.'\n  desc \"Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of\n    attack code he or she has introduced into a process's address space during an attempt at exploitation. Additionally,\n    ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it\n    using return-oriented programming (ROP) techniques.\"\n  desc 'check', 'Verify the operating system implements virtual address space randomization.\n\n     # grep -r kernel.randomize_va_space /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     kernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" is not configured in the /etc/sysctl.conf file or or in any of the other sysctl.d directories, is commented out or does not have a value of \"2\", this is a finding.\n\nCheck that the operating system implements virtual address space randomization with the following command:\n\n     # /sbin/sysctl -a | grep kernel.randomize_va_space \n     kernel.randomize_va_space = 2\n\nIf \"kernel.randomize_va_space\" does not have a value of \"2\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Configure the operating system implement virtual address space randomization.\n    Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a config file\n    in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n    kernel.randomize_va_space = 2\n    Issue the following command to make the changes take effect:\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-92521', 'V-77825']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204584'\n  tag rid: 'SV-204584r880794_rule'\n  tag stig_id: 'RHEL-07-040201'\n  tag fix_id: 'F-4708r880793_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['aslr', 'kernel_parameter']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    randomize_va_space = input('randomize_va_space')\n\n    describe kernel_parameter('kernel.randomize_va_space') do\n      its('value') { should eq randomize_va_space }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204584.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter kernel.randomize_va_space","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter kernel.randomize_va_space","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"kernel.randomize_va_space\"]"}]},{"id":"SV-204585","title":"The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH\n    installed.","desc":"Without protection of the transmitted information, confidentiality and integrity may be compromised because\n    unprotected communications can be intercepted and either read or altered.\n    This requirement applies to both internal and external networks and all types of information system components from\n    which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers,\n    scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are\n    exposed to the possibility of interception and modification.\n    Protecting the confidentiality and integrity of organizational information can be accomplished by physical means\n    (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If\n    physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.","descriptions":[{"label":"default","data":"Without protection of the transmitted information, confidentiality and integrity may be compromised because\n    unprotected communications can be intercepted and either read or altered.\n    This requirement applies to both internal and external networks and all types of information system components from\n    which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers,\n    scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are\n    exposed to the possibility of interception and modification.\n    Protecting the confidentiality and integrity of organizational information can be accomplished by physical means\n    (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If\n    physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa."},{"label":"check","data":"Check to see if sshd is installed with the following command:\n    # yum list installed \\*ssh\\*\n    libssh2.x86_64 1.4.3-8.el7 @anaconda/7.1\n    openssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1\n    openssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1\n    If the \"SSH server\" package is not installed, this is a finding."},{"label":"fix","data":"Install SSH packages onto the host with the following commands:\n    # yum install openssh-server.x86_64"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86857","V-72233"],"severity":"medium","gtitle":"SRG-OS-000423-GPOS-00187","satisfies":["SRG-OS-000423-GPOS-00187","SRG-OS-000424-GPOS-00188","SRG-OS-000425-GPOS-00189","SRG-OS-000426-GPOS-00190"],"gid":"V-204585","rid":"SV-204585r853989_rule","stig_id":"RHEL-07-040300","fix_id":"F-4709r88948_fix","cci":["CCI-002418","CCI-002420","CCI-002421","CCI-002422"],"nist":["SC-8","SC-8 (2)","SC-8 (1)","SC-8 (2)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204585' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all networked systems have SSH\n    installed.'\n  desc 'Without protection of the transmitted information, confidentiality and integrity may be compromised because\n    unprotected communications can be intercepted and either read or altered.\n    This requirement applies to both internal and external networks and all types of information system components from\n    which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers,\n    scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are\n    exposed to the possibility of interception and modification.\n    Protecting the confidentiality and integrity of organizational information can be accomplished by physical means\n    (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If\n    physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa.'\n  desc 'check', 'Check to see if sshd is installed with the following command:\n    # yum list installed \\\\*ssh\\\\*\n    libssh2.x86_64 1.4.3-8.el7 @anaconda/7.1\n    openssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1\n    openssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1\n    If the \"SSH server\" package is not installed, this is a finding.'\n  desc 'fix', 'Install SSH packages onto the host with the following commands:\n    # yum install openssh-server.x86_64'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86857', 'V-72233']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000423-GPOS-00187'\n  tag satisfies: ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000424-GPOS-00188', 'SRG-OS-000425-GPOS-00189', 'SRG-OS-000426-GPOS-00190']\n  tag gid: 'V-204585'\n  tag rid: 'SV-204585r853989_rule'\n  tag stig_id: 'RHEL-07-040300'\n  tag fix_id: 'F-4709r88948_fix'\n  tag cci: ['CCI-002418', 'CCI-002420', 'CCI-002421', 'CCI-002422']\n  tag nist: ['SC-8', 'SC-8 (2)', 'SC-8 (1)', 'SC-8 (2)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe package('openssh-server') do\n      it { should be_installed }\n    end\n    describe package('openssh-clients') do\n      it { should be_installed }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204585.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package openssh-server","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package openssh-server","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"openssh-server\"]"},{"status":"skipped","code_desc":"System Package openssh-clients","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package openssh-clients","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"openssh-clients\"]"}]},{"id":"SV-204586","title":"The Red Hat Enterprise Linux operating system must be configured so that all networked systems use SSH for\n    confidentiality and integrity of transmitted and received information as well as information during preparation for\n    transmission.","desc":"Without protection of the transmitted information, confidentiality and integrity may be compromised because\n    unprotected communications can be intercepted and either read or altered.\n    This requirement applies to both internal and external networks and all types of information system components from\n    which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers,\n    scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are\n    exposed to the possibility of interception and modification.\n    Protecting the confidentiality and integrity of organizational information can be accomplished by physical means\n    (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If\n    physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice\n    versa.","descriptions":[{"label":"default","data":"Without protection of the transmitted information, confidentiality and integrity may be compromised because\n    unprotected communications can be intercepted and either read or altered.\n    This requirement applies to both internal and external networks and all types of information system components from\n    which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers,\n    scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are\n    exposed to the possibility of interception and modification.\n    Protecting the confidentiality and integrity of organizational information can be accomplished by physical means\n    (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If\n    physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice\n    versa."},{"label":"check","data":"Verify SSH is loaded and active with the following command:\n    # systemctl status sshd\n    sshd.service - OpenSSH server daemon\n    Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\n    Active: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago\n    Main PID: 1348 (sshd)\n    CGroup: /system.slice/sshd.service\n    1053 /usr/sbin/sshd -D\n    If \"sshd\" does not show a status of \"active\" and \"running\", this is a finding."},{"label":"fix","data":"Configure the SSH service to automatically start after reboot with the following command:\n    # systemctl enable sshd.service"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86859","V-72235"],"severity":"medium","gtitle":"SRG-OS-000423-GPOS-00187","satisfies":["SRG-OS-000423-GPOS-00187","SRG-OS-000423-GPOS-00188","SRG-OS-000423-GPOS-00189","SRG-OS-000423-GPOS-00190","SRG-OS-000424-GPOS-00188","SRG-OS-000425-GPOS-00189","SRG-OS-000426-GPOS-00190"],"gid":"V-204586","rid":"SV-204586r861071_rule","stig_id":"RHEL-07-040310","fix_id":"F-4710r88951_fix","cci":["CCI-002418","CCI-002420","CCI-002421","CCI-002422"],"nist":["SC-8","SC-8 (2)","SC-8 (1)","SC-8 (2)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204586' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all networked systems use SSH for\n    confidentiality and integrity of transmitted and received information as well as information during preparation for\n    transmission.'\n  desc 'Without protection of the transmitted information, confidentiality and integrity may be compromised because\n    unprotected communications can be intercepted and either read or altered.\n    This requirement applies to both internal and external networks and all types of information system components from\n    which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers,\n    scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are\n    exposed to the possibility of interception and modification.\n    Protecting the confidentiality and integrity of organizational information can be accomplished by physical means\n    (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If\n    physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice\n    versa.'\n  desc 'check', 'Verify SSH is loaded and active with the following command:\n    # systemctl status sshd\n    sshd.service - OpenSSH server daemon\n    Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)\n    Active: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago\n    Main PID: 1348 (sshd)\n    CGroup: /system.slice/sshd.service\n    1053 /usr/sbin/sshd -D\n    If \"sshd\" does not show a status of \"active\" and \"running\", this is a finding.'\n  desc 'fix', 'Configure the SSH service to automatically start after reboot with the following command:\n    # systemctl enable sshd.service'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86859', 'V-72235']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000423-GPOS-00187'\n  tag satisfies: ['SRG-OS-000423-GPOS-00187', 'SRG-OS-000423-GPOS-00188', 'SRG-OS-000423-GPOS-00189', 'SRG-OS-000423-GPOS-00190', 'SRG-OS-000424-GPOS-00188', 'SRG-OS-000425-GPOS-00189', 'SRG-OS-000426-GPOS-00190']\n  tag gid: 'V-204586'\n  tag rid: 'SV-204586r861071_rule'\n  tag stig_id: 'RHEL-07-040310'\n  tag fix_id: 'F-4710r88951_fix'\n  tag cci: ['CCI-002418', 'CCI-002420', 'CCI-002421', 'CCI-002422']\n  tag nist: ['SC-8', 'SC-8 (2)', 'SC-8 (1)', 'SC-8 (2)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe systemd_service('sshd.service') do\n      it { should be_running }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204586.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service sshd.service ","run_time":8.7e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `systemd_service` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"systemd_service","resource_params":"[\"sshd.service\"]"}]},{"id":"SV-204587","title":"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated\n    with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill\n    documented and validated mission requirements.","desc":"Terminating an idle SSH session within a short time period reduces the window of opportunity for\n    unauthorized personnel to take control of a management session enabled on the console or console port that has been\n    left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the\n    managed network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session.","descriptions":[{"label":"default","data":"Terminating an idle SSH session within a short time period reduces the window of opportunity for\n    unauthorized personnel to take control of a management session enabled on the console or console port that has been\n    left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the\n    managed network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session."},{"label":"check","data":"Verify the operating system automatically terminates a user session after inactivity time-outs have\n    expired.\n    Check for the value of the \"ClientAliveInterval\" keyword with the following command:\n    # grep -iw clientaliveinterval /etc/ssh/sshd_config\n    ClientAliveInterval 600\n    If \"ClientAliveInterval\" is not configured, commented out, or has a value of \"0\", this is a finding.\n    If \"ClientAliveInterval\" has a value that is greater than \"600\" and is not documented with the Information System\n    Security Officer (ISSO) as an operational requirement, this is a finding."},{"label":"fix","data":"Configure the operating system to automatically terminate a user session after inactivity time-outs\n    have expired or at shutdown.\n    Add the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file\n    may be named differently or be in a different location if using a version of SSH that is provided by a third-party\n    vendor):\n    ClientAliveInterval 600\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72237","SV-86861"],"severity":"medium","gtitle":"SRG-OS-000163-GPOS-00072","satisfies":["SRG-OS-000163-GPOS-00072","SRG-OS-000279-GPOS-00109"],"gid":"V-204587","rid":"SV-204587r861072_rule","stig_id":"RHEL-07-040320","fix_id":"F-4711r88954_fix","cci":["CCI-001133","CCI-002361"],"nist":["SC-10","AC-12"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204587' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all network connections associated\n    with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill\n    documented and validated mission requirements.'\n  desc 'Terminating an idle SSH session within a short time period reduces the window of opportunity for\n    unauthorized personnel to take control of a management session enabled on the console or console port that has been\n    left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the\n    managed network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session.'\n  desc 'check', 'Verify the operating system automatically terminates a user session after inactivity time-outs have\n    expired.\n    Check for the value of the \"ClientAliveInterval\" keyword with the following command:\n    # grep -iw clientaliveinterval /etc/ssh/sshd_config\n    ClientAliveInterval 600\n    If \"ClientAliveInterval\" is not configured, commented out, or has a value of \"0\", this is a finding.\n    If \"ClientAliveInterval\" has a value that is greater than \"600\" and is not documented with the Information System\n    Security Officer (ISSO) as an operational requirement, this is a finding.'\n  desc 'fix', 'Configure the operating system to automatically terminate a user session after inactivity time-outs\n    have expired or at shutdown.\n    Add the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file\n    may be named differently or be in a different location if using a version of SSH that is provided by a third-party\n    vendor):\n    ClientAliveInterval 600\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72237', 'SV-86861']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000163-GPOS-00072'\n  tag satisfies: ['SRG-OS-000163-GPOS-00072', 'SRG-OS-000279-GPOS-00109']\n  tag gid: 'V-204587'\n  tag rid: 'SV-204587r861072_rule'\n  tag stig_id: 'RHEL-07-040320'\n  tag fix_id: 'F-4711r88954_fix'\n  tag cci: ['CCI-001133', 'CCI-002361']\n  tag nist: ['SC-10', 'AC-12']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    # This may show slightly confusing results when a ClientAliveInterValue is not\n    # specified. Specifically, because the value will be nil and when you try to\n    # convert it to an integer using to_i it will convert it to 0 and pass the\n    # <= client_alive_interval check. However, the control as a whole will still fail.\n    describe sshd_config do\n      its('ClientAliveInterval') { should cmp input('expected_client_alive_interval') }\n      its('ClientAliveInterval') { should be_between(1, input('max_client_alive_interval')) }\n      its('ClientAliveInterval') { should_not eq nil }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204587.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204588","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using RSA rhosts authentication.","desc":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.","descriptions":[{"label":"default","data":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere."},{"label":"check","data":"Check the version of the operating system with the following command:\n    # cat /etc/redhat-release\n    If the release is 7.4 or newer this requirement is Not Applicable.\n    Verify the SSH daemon does not allow authentication using RSA rhosts authentication.\n    To determine how the SSH daemon's \"RhostsRSAAuthentication\" option is set, run the following command:\n    # grep RhostsRSAAuthentication /etc/ssh/sshd_config\n    RhostsRSAAuthentication no\n    If the value is returned as \"yes\", the returned line is commented out, or no output is returned, this is a finding."},{"label":"fix","data":"Configure the SSH daemon to not allow authentication using RSA rhosts authentication.\n    Add the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"no\":\n    RhostsRSAAuthentication no\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72239","SV-86863"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204588","rid":"SV-204588r603261_rule","stig_id":"RHEL-07-040330","fix_id":"F-4712r88957_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204588' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using RSA rhosts authentication.'\n  desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.'\n  desc 'check', %q(Check the version of the operating system with the following command:\n    # cat /etc/redhat-release\n    If the release is 7.4 or newer this requirement is Not Applicable.\n    Verify the SSH daemon does not allow authentication using RSA rhosts authentication.\n    To determine how the SSH daemon's \"RhostsRSAAuthentication\" option is set, run the following command:\n    # grep RhostsRSAAuthentication /etc/ssh/sshd_config\n    RhostsRSAAuthentication no\n    If the value is returned as \"yes\", the returned line is commented out, or no output is returned, this is a finding.)\n  desc 'fix', 'Configure the SSH daemon to not allow authentication using RSA rhosts authentication.\n    Add the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"no\":\n    RhostsRSAAuthentication no\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72239', 'SV-86863']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204588'\n  tag rid: 'SV-204588r603261_rule'\n  tag stig_id: 'RHEL-07-040330'\n  tag fix_id: 'F-4712r88957_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('RhostsRSAAuthentication') { should cmp 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204588.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204589","title":"The Red Hat Enterprise Linux operating system must be configured so that all network connections associated\n    with SSH traffic terminate after a period of inactivity.","desc":"Terminating an idle SSH session within a short time period reduces the window of opportunity for\n    unauthorized personnel to take control of a management session enabled on the console or console port that has been\n    left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the\n    managed network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session.","descriptions":[{"label":"default","data":"Terminating an idle SSH session within a short time period reduces the window of opportunity for\n    unauthorized personnel to take control of a management session enabled on the console or console port that has been\n    left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the\n    managed network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session."},{"label":"check","data":"Verify the operating system automatically terminates a user session after inactivity time-outs have\n    expired.\n    Check for the value of the \"ClientAliveCountMax\" keyword with the following command:\n    # grep -i clientalivecount /etc/ssh/sshd_config\n    ClientAliveCountMax 0\n    If \"ClientAliveCountMax\" is not set to \"0\", this is a finding."},{"label":"fix","data":"Configure the operating system to terminate automatically a user session after inactivity time-outs\n    have expired or at shutdown.\n    Add the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file\n    may be named differently or be in a different location if using a version of SSH that is provided by a third-party\n    vendor):\n    ClientAliveCountMax 0\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86865","V-72241"],"severity":"medium","gtitle":"SRG-OS-000163-GPOS-00072","satisfies":["SRG-OS-000163-GPOS-00072","SRG-OS-000279-GPOS-00109"],"gid":"V-204589","rid":"SV-204589r853992_rule","stig_id":"RHEL-07-040340","fix_id":"F-4713r88960_fix","cci":["CCI-001133","CCI-002361"],"nist":["SC-10","AC-12"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204589' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all network connections associated\n    with SSH traffic terminate after a period of inactivity.'\n  desc 'Terminating an idle SSH session within a short time period reduces the window of opportunity for\n    unauthorized personnel to take control of a management session enabled on the console or console port that has been\n    left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the\n    managed network element.\n    Terminating network connections associated with communications sessions includes, for example, de-allocating\n    associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the\n    application level if multiple application sessions are using a single operating system-level network connection.\n    This does not mean that the operating system terminates all sessions or network access; it only ends the inactive\n    session and releases the resources associated with that session.'\n  desc 'check', 'Verify the operating system automatically terminates a user session after inactivity time-outs have\n    expired.\n    Check for the value of the \"ClientAliveCountMax\" keyword with the following command:\n    # grep -i clientalivecount /etc/ssh/sshd_config\n    ClientAliveCountMax 0\n    If \"ClientAliveCountMax\" is not set to \"0\", this is a finding.'\n  desc 'fix', 'Configure the operating system to terminate automatically a user session after inactivity time-outs\n    have expired or at shutdown.\n    Add the following line (or modify the line to have the required value) to the \"/etc/ssh/sshd_config\" file (this file\n    may be named differently or be in a different location if using a version of SSH that is provided by a third-party\n    vendor):\n    ClientAliveCountMax 0\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86865', 'V-72241']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000163-GPOS-00072'\n  tag satisfies: ['SRG-OS-000163-GPOS-00072', 'SRG-OS-000279-GPOS-00109']\n  tag gid: 'V-204589'\n  tag rid: 'SV-204589r853992_rule'\n  tag stig_id: 'RHEL-07-040340'\n  tag fix_id: 'F-4713r88960_fix'\n  tag cci: ['CCI-001133', 'CCI-002361']\n  tag nist: ['SC-10', 'AC-12']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  elsif os.release.to_f >= 7.4\n    impact 0.0\n    describe \"The release is #{os.release}\" do\n      skip 'The release is newer than 7.4; this control is Not Applicable.'\n    end\n  else\n    describe sshd_config do\n      its('ClientAliveCountMax') { should cmp '0' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204589.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204590","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using rhosts authentication.","desc":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.","descriptions":[{"label":"default","data":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere."},{"label":"check","data":"Verify the SSH daemon does not allow authentication using known hosts authentication.\n    To determine how the SSH daemon's \"IgnoreRhosts\" option is set, run the following command:\n    # grep -i IgnoreRhosts /etc/ssh/sshd_config\n    IgnoreRhosts yes\n    If the value is returned as \"no\", the returned line is commented out, or no output is returned, this is a finding."},{"label":"fix","data":"Configure the SSH daemon to not allow authentication using known hosts authentication.\n    Add the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\":\n    IgnoreRhosts yes"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72243","SV-86867"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204590","rid":"SV-204590r603261_rule","stig_id":"RHEL-07-040350","fix_id":"F-4714r88963_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204590' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using rhosts authentication.'\n  desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.'\n  desc 'check', %q(Verify the SSH daemon does not allow authentication using known hosts authentication.\n    To determine how the SSH daemon's \"IgnoreRhosts\" option is set, run the following command:\n    # grep -i IgnoreRhosts /etc/ssh/sshd_config\n    IgnoreRhosts yes\n    If the value is returned as \"no\", the returned line is commented out, or no output is returned, this is a finding.)\n  desc 'fix', 'Configure the SSH daemon to not allow authentication using known hosts authentication.\n    Add the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\":\n    IgnoreRhosts yes'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72243', 'SV-86867']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204590'\n  tag rid: 'SV-204590r603261_rule'\n  tag stig_id: 'RHEL-07-040350'\n  tag fix_id: 'F-4714r88963_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('IgnoreRhosts') { should cmp 'yes' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204590.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204591","title":"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account\n    logon upon an SSH logon.","desc":"Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition\n    and reporting of unauthorized account use.","descriptions":[{"label":"default","data":"Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition\n    and reporting of unauthorized account use."},{"label":"check","data":"Verify SSH provides users with feedback on when account accesses last occurred.\n    Check that \"PrintLastLog\" keyword in the sshd daemon configuration file is used and set to \"yes\" with the following\n    command:\n    # grep -i printlastlog /etc/ssh/sshd_config\n    PrintLastLog yes\n    If the \"PrintLastLog\" keyword is set to \"no\", is missing, or is commented out, this is a finding."},{"label":"fix","data":"Configure SSH to provide users with feedback on when account accesses last occurred by setting the\n    required configuration options in \"/etc/pam.d/sshd\" or in the \"sshd_config\" file used by the system\n    (\"/etc/ssh/sshd_config\" will be used in the example) (this file may be named differently or be in a different\n    location if using a version of SSH that is provided by a third-party vendor).\n    Modify the \"PrintLastLog\" line in \"/etc/ssh/sshd_config\" to match the following:\n    PrintLastLog yes\n    The SSH service must be restarted for changes to \"sshd_config\" to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72245","SV-86869"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204591","rid":"SV-204591r858477_rule","stig_id":"RHEL-07-040360","fix_id":"F-4715r88966_fix","cci":["CCI-000366","CCI-000052"],"nist":["CM-6 b","AC-9"],"subsystems":["pam","ssh","lastlog"],"host":null},"code":"control 'SV-204591' do\n  title 'The Red Hat Enterprise Linux operating system must display the date and time of the last successful account\n    logon upon an SSH logon.'\n  desc 'Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition\n    and reporting of unauthorized account use.'\n  desc 'check', 'Verify SSH provides users with feedback on when account accesses last occurred.\n    Check that \"PrintLastLog\" keyword in the sshd daemon configuration file is used and set to \"yes\" with the following\n    command:\n    # grep -i printlastlog /etc/ssh/sshd_config\n    PrintLastLog yes\n    If the \"PrintLastLog\" keyword is set to \"no\", is missing, or is commented out, this is a finding.'\n  desc 'fix', 'Configure SSH to provide users with feedback on when account accesses last occurred by setting the\n    required configuration options in \"/etc/pam.d/sshd\" or in the \"sshd_config\" file used by the system\n    (\"/etc/ssh/sshd_config\" will be used in the example) (this file may be named differently or be in a different\n    location if using a version of SSH that is provided by a third-party vendor).\n    Modify the \"PrintLastLog\" line in \"/etc/ssh/sshd_config\" to match the following:\n    PrintLastLog yes\n    The SSH service must be restarted for changes to \"sshd_config\" to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72245', 'SV-86869']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204591'\n  tag rid: 'SV-204591r858477_rule'\n  tag stig_id: 'RHEL-07-040360'\n  tag fix_id: 'F-4715r88966_fix'\n  tag cci: ['CCI-000366', 'CCI-000052']\n  tag nist: ['CM-6 b', 'AC-9']\n  tag subsystems: ['pam', 'ssh', 'lastlog']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  elsif sshd_config.params['printlastlog'] == ['yes']\n\n    describe sshd_config do\n      its('PrintLastLog') { should cmp 'yes' }\n    end\n  else\n    describe pam('/etc/pam.d/sshd') do\n      its('lines') do\n        should match_pam_rule('session required pam_lastlog.so showfailed')\n      end\n      its('lines') do\n        should_not match_pam_rule('session required pam_lastlog.so showfailed silent')\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204591.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204591.rb:1 ","run_time":9.0e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204592","title":"The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using\n    remote access via SSH.","desc":"Even though the communications channel may be encrypted, an additional layer of security is gained by\n    extending the policy of not logging on directly as root. In addition, logging on with a user-specific account\n    provides individual accountability of actions performed on the system.","descriptions":[{"label":"default","data":"Even though the communications channel may be encrypted, an additional layer of security is gained by\n    extending the policy of not logging on directly as root. In addition, logging on with a user-specific account\n    provides individual accountability of actions performed on the system."},{"label":"check","data":"Verify remote access using SSH prevents users from logging on directly as root.\n    Check that SSH prevents users from logging on directly as root with the following command:\n    # grep -i permitrootlogin /etc/ssh/sshd_config\n    PermitRootLogin no\n    If the \"PermitRootLogin\" keyword is set to \"yes\", is missing, or is commented out, this is a finding."},{"label":"fix","data":"Configure SSH to stop users from logging on remotely as the root user.\n    Edit the appropriate  \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"PermitRootLogin\" keyword and\n    set its value to \"no\" (this file may be named differently or be in a different location if using a version of SSH\n    that is provided by a third-party vendor):\n    PermitRootLogin no\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72247","SV-86871"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204592","rid":"SV-204592r603261_rule","stig_id":"RHEL-07-040370","fix_id":"F-4716r88969_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204592' do\n  title 'The Red Hat Enterprise Linux operating system must not permit direct logons to the root account using\n    remote access via SSH.'\n  desc 'Even though the communications channel may be encrypted, an additional layer of security is gained by\n    extending the policy of not logging on directly as root. In addition, logging on with a user-specific account\n    provides individual accountability of actions performed on the system.'\n  desc 'check', 'Verify remote access using SSH prevents users from logging on directly as root.\n    Check that SSH prevents users from logging on directly as root with the following command:\n    # grep -i permitrootlogin /etc/ssh/sshd_config\n    PermitRootLogin no\n    If the \"PermitRootLogin\" keyword is set to \"yes\", is missing, or is commented out, this is a finding.'\n  desc 'fix', 'Configure SSH to stop users from logging on remotely as the root user.\n    Edit the appropriate  \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"PermitRootLogin\" keyword and\n    set its value to \"no\" (this file may be named differently or be in a different location if using a version of SSH\n    that is provided by a third-party vendor):\n    PermitRootLogin no\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72247', 'SV-86871']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204592'\n  tag rid: 'SV-204592r603261_rule'\n  tag stig_id: 'RHEL-07-040370'\n  tag fix_id: 'F-4716r88969_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('PermitRootLogin') { should cmp 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204592.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204593","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using known hosts authentication.","desc":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.","descriptions":[{"label":"default","data":"Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere."},{"label":"check","data":"Verify the SSH daemon does not allow authentication using known hosts authentication.\n    To determine how the SSH daemon's \"IgnoreUserKnownHosts\" option is set, run the following command:\n    # grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config\n    IgnoreUserKnownHosts yes\n    If the value is returned as \"no\", the returned line is commented out, or no output is returned, this is a finding."},{"label":"fix","data":"Configure the SSH daemon to not allow authentication using known hosts authentication.\n    Add the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\":\n    IgnoreUserKnownHosts yes\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72249","SV-86873"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204593","rid":"SV-204593r603261_rule","stig_id":"RHEL-07-040380","fix_id":"F-4717r88972_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204593' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    authentication using known hosts authentication.'\n  desc 'Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will\n    require a password, even in the event of misconfiguration elsewhere.'\n  desc 'check', %q(Verify the SSH daemon does not allow authentication using known hosts authentication.\n    To determine how the SSH daemon's \"IgnoreUserKnownHosts\" option is set, run the following command:\n    # grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config\n    IgnoreUserKnownHosts yes\n    If the value is returned as \"no\", the returned line is commented out, or no output is returned, this is a finding.)\n  desc 'fix', 'Configure the SSH daemon to not allow authentication using known hosts authentication.\n    Add the following line in \"/etc/ssh/sshd_config\", or uncomment the line and set the value to \"yes\":\n    IgnoreUserKnownHosts yes\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72249', 'SV-86873']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204593'\n  tag rid: 'SV-204593r603261_rule'\n  tag stig_id: 'RHEL-07-040380'\n  tag fix_id: 'F-4717r88972_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('IgnoreUserKnownHosts') { should cmp 'yes' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204593.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204594","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to\n    only use the SSHv2 protocol.","desc":"SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits.\n    Exploits of the SSH daemon could provide immediate root access to the system.","descriptions":[{"label":"default","data":"SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits.\n    Exploits of the SSH daemon could provide immediate root access to the system."},{"label":"check","data":"Check the version of the operating system with the following command:\n    # cat /etc/redhat-release\n    If the release is 7.4 or newer this requirement is Not Applicable.\n    Verify the SSH daemon is configured to only use the SSHv2 protocol.\n    Check that the SSH daemon is configured to only use the SSHv2 protocol with the following command:\n    # grep -i protocol /etc/ssh/sshd_config\n    Protocol 2\n    #Protocol 1,2\n    If any protocol line other than \"Protocol 2\" is uncommented, this is a finding."},{"label":"fix","data":"Remove all Protocol lines that reference version \"1\" in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The\n    \"Protocol\" line must be as follows:\n    Protocol 2\n    The SSH service must be restarted for changes to take effect."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86875","V-72251"],"severity":"high","gtitle":"SRG-OS-000074-GPOS-00042","satisfies":["SRG-OS-000074-GPOS-00042","SRG-OS-000480-GPOS-00227"],"gid":"V-204594","rid":"SV-204594r877396_rule","stig_id":"RHEL-07-040390","fix_id":"F-4718r88975_fix","cci":["CCI-000197","CCI-000366"],"nist":["IA-5 (1) (c)","CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204594' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to\n    only use the SSHv2 protocol.'\n  desc 'SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits.\n    Exploits of the SSH daemon could provide immediate root access to the system.'\n  desc 'check', 'Check the version of the operating system with the following command:\n    # cat /etc/redhat-release\n    If the release is 7.4 or newer this requirement is Not Applicable.\n    Verify the SSH daemon is configured to only use the SSHv2 protocol.\n    Check that the SSH daemon is configured to only use the SSHv2 protocol with the following command:\n    # grep -i protocol /etc/ssh/sshd_config\n    Protocol 2\n    #Protocol 1,2\n    If any protocol line other than \"Protocol 2\" is uncommented, this is a finding.'\n  desc 'fix', 'Remove all Protocol lines that reference version \"1\" in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The\n    \"Protocol\" line must be as follows:\n    Protocol 2\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86875', 'V-72251']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000074-GPOS-00042'\n  tag satisfies: ['SRG-OS-000074-GPOS-00042', 'SRG-OS-000480-GPOS-00227']\n  tag gid: 'V-204594'\n  tag rid: 'SV-204594r877396_rule'\n  tag stig_id: 'RHEL-07-040390'\n  tag fix_id: 'F-4718r88975_fix'\n  tag cci: ['CCI-000197', 'CCI-000366']\n  tag nist: ['IA-5 (1) (c)', 'CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  elsif os.release.to_f >= 7.4\n\n    impact 0.0\n    describe \"The release is #{os.release}\" do\n      skip 'The release is newer than 7.4; this control is Not Applicable.'\n    end\n  else\n    describe sshd_config do\n      its('Protocol') { should cmp '2' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204594.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204595","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to\n    only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.","desc":"DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2\n    hash algorithm meeting this requirement is SHA.\n    The system will attempt to use the first hash presented by the client that matches the server list. Listing the\n    values \"strongest to weakest\" is a method to ensure the use of the strongest hash available to secure the SSH\n    connection.","descriptions":[{"label":"default","data":"DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2\n    hash algorithm meeting this requirement is SHA.\n    The system will attempt to use the first hash presented by the client that matches the server list. Listing the\n    values \"strongest to weakest\" is a method to ensure the use of the strongest hash available to secure the SSH\n    connection."},{"label":"check","data":"Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved hashes.\n    Note: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS\n    140-2-approved cryptographic algorithms and hashes.\n    Check that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved hashes with the following\n    command:\n    # grep -i macs /etc/ssh/sshd_config\n    MACs hmac-sha2-512,hmac-sha2-256\n    If any hashes other than \"hmac-sha2-512\" or \"hmac-sha2-256\" are listed, the order differs from the example above,\n    they are missing, or the returned line is commented out, this is a finding."},{"label":"fix","data":"Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"MACs\" keyword and set its\n    value to \"hmac-sha2-512\" and/or \"hmac-sha2-256\" (this file may be named differently or be in a different location if\n    using a version of SSH that is provided by a third-party vendor):\n    MACs hmac-sha2-512,hmac-sha2-256\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86877","V-72253"],"severity":"medium","gtitle":"SRG-OS-000250-GPOS-00093","gid":"V-204595","rid":"SV-204595r877394_rule","stig_id":"RHEL-07-040400","fix_id":"F-4719r622309_fix","cci":["CCI-001453"],"nist":["AC-17 (2)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204595' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to\n    only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.'\n  desc 'DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2\n    hash algorithm meeting this requirement is SHA.\n    The system will attempt to use the first hash presented by the client that matches the server list. Listing the\n    values \"strongest to weakest\" is a method to ensure the use of the strongest hash available to secure the SSH\n    connection.'\n  desc 'check', 'Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved hashes.\n    Note: If RHEL-07-021350 is a finding, this is automatically a finding as the system cannot implement FIPS\n    140-2-approved cryptographic algorithms and hashes.\n    Check that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved hashes with the following\n    command:\n    # grep -i macs /etc/ssh/sshd_config\n    MACs hmac-sha2-512,hmac-sha2-256\n    If any hashes other than \"hmac-sha2-512\" or \"hmac-sha2-256\" are listed, the order differs from the example above,\n    they are missing, or the returned line is commented out, this is a finding.'\n  desc 'fix', 'Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"MACs\" keyword and set its\n    value to \"hmac-sha2-512\" and/or \"hmac-sha2-256\" (this file may be named differently or be in a different location if\n    using a version of SSH that is provided by a third-party vendor):\n    MACs hmac-sha2-512,hmac-sha2-256\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86877', 'V-72253']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000250-GPOS-00093'\n  tag gid: 'V-204595'\n  tag rid: 'SV-204595r877394_rule'\n  tag stig_id: 'RHEL-07-040400'\n  tag fix_id: 'F-4719r622309_fix'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n\n    macs = sshd_config.params('macs')\n    if macs.nil?\n      # fail fast\n      describe 'The `sshd_config` setting for `MACs`' do\n        subject { macs }\n        it 'should be explicitly set and not commented out' do\n          expect(subject).not_to be_nil\n        end\n      end\n    else\n      describe 'The list of MACs enabled on the system' do\n        subject { macs }\n        it { should cmp 'hmac-sha2-512,hmac-sha2-256' }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204595.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204595.rb:1 ","run_time":8.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204596","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have\n    mode 0644 or less permissive.","desc":"If a public host key file is modified by an unauthorized user, the SSH service may be compromised.","descriptions":[{"label":"default","data":"If a public host key file is modified by an unauthorized user, the SSH service may be compromised."},{"label":"check","data":"Verify the SSH public host key files have mode \"0644\" or less permissive.\n    Note: SSH public key files may be found in other directories on the system depending on the installation.\n    The following command will find all SSH public key files on the system:\n    # find /etc/ssh -name '*.pub' -exec ls -lL {} \\;\n    -rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub\n    -rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub\n    -rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub\n    If any file has a mode more permissive than \"0644\", this is a finding."},{"label":"fix","data":"Note: SSH public key files may be found in other directories on the system depending on the\n    installation.\n    Change the mode of public host key files under \"/etc/ssh\" to \"0644\" with the following command:\n    # chmod 0644 /etc/ssh/*.key.pub"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72255","SV-86879"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204596","rid":"SV-204596r603261_rule","stig_id":"RHEL-07-040410","fix_id":"F-4720r88981_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204596' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH public host key files have\n    mode 0644 or less permissive.'\n  desc 'If a public host key file is modified by an unauthorized user, the SSH service may be compromised.'\n  desc 'check', %q(Verify the SSH public host key files have mode \"0644\" or less permissive.\n    Note: SSH public key files may be found in other directories on the system depending on the installation.\n    The following command will find all SSH public key files on the system:\n    # find /etc/ssh -name '*.pub' -exec ls -lL {} \\;\n    -rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub\n    -rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub\n    -rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub\n    If any file has a mode more permissive than \"0644\", this is a finding.)\n  desc 'fix', 'Note: SSH public key files may be found in other directories on the system depending on the\n    installation.\n    Change the mode of public host key files under \"/etc/ssh\" to \"0644\" with the following command:\n    # chmod 0644 /etc/ssh/*.key.pub'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72255', 'SV-86879']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204596'\n  tag rid: 'SV-204596r603261_rule'\n  tag stig_id: 'RHEL-07-040410'\n  tag fix_id: 'F-4720r88981_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    pub_files = command(\"find #{input('public_host_key_directories').join(' ')} -xdev -name '*.pub'\").stdout.split(\"\\n\")\n    if !pub_files.nil? and !pub_files.empty?\n      pub_files.each do |pubfile|\n        describe file(pubfile) do\n          it { should_not be_more_permissive_than(input('public_host_key_file_mode')) }\n        end\n      end\n    else\n      describe 'No public host key files found.' do\n        subject { pub_files.nil? or pub_files.empty? }\n        it { should eq true }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204596.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"No public host key files found. is expected to eq true","run_time":0.00013,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204597","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.","desc":"If an unauthorized user obtains the private SSH host key file, the host could be impersonated.","descriptions":[{"label":"default","data":"If an unauthorized user obtains the private SSH host key file, the host could be impersonated."},{"label":"check","data":"Verify the SSH private host key files have mode \"0640\" or less permissive.\n\nThe following command will find all SSH private key files on the system and list their modes:\n\n     # find / -name '*ssh_host*key' | xargs ls -lL\n\n     -rw-r----- 1 root ssh_keys 112 Apr 1 11:59 ssh_host_dsa_key\n     -rw-r----- 1 root ssh_keys 202 Apr 1 11:59 ssh_host_key\n     -rw-r----- 1 root ssh_keys 352 Apr 1 11:59 ssh_host_rsa_key\n\nIf any file has a mode more permissive than \"0640\", this is a finding."},{"label":"fix","data":"Configure the mode of SSH private host key files under \"/etc/ssh\" to \"0640\" with the following command:\n\n# chmod 0640 /path/to/file/ssh_host*key"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72257","SV-86881"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204597","rid":"SV-204597r880743_rule","stig_id":"RHEL-07-040420","fix_id":"F-4721r880742_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204597' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.'\n  desc 'If an unauthorized user obtains the private SSH host key file, the host could be impersonated.'\n  desc 'check', %q(Verify the SSH private host key files have mode \"0640\" or less permissive.\n\nThe following command will find all SSH private key files on the system and list their modes:\n\n     # find / -name '*ssh_host*key' | xargs ls -lL\n\n     -rw-r----- 1 root ssh_keys 112 Apr 1 11:59 ssh_host_dsa_key\n     -rw-r----- 1 root ssh_keys 202 Apr 1 11:59 ssh_host_key\n     -rw-r----- 1 root ssh_keys 352 Apr 1 11:59 ssh_host_rsa_key\n\nIf any file has a mode more permissive than \"0640\", this is a finding.)\n  desc 'fix', 'Configure the mode of SSH private host key files under \"/etc/ssh\" to \"0640\" with the following command:\n\n# chmod 0640 /path/to/file/ssh_host*key'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72257', 'SV-86881']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204597'\n  tag rid: 'SV-204597r880743_rule'\n  tag stig_id: 'RHEL-07-040420'\n  tag fix_id: 'F-4721r880742_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    pub_files = command(\"find #{input('private_host_key_directories').join(' ')} -xdev -name '*ssh_host*key'\").stdout.split(\"\\n\")\n    if !pub_files.nil? and !pub_files.empty?\n      pub_files.each do |pubfile|\n        describe file(pubfile) do\n          it { should_not be_more_permissive_than(input('private_host_key_file_mode')) }\n        end\n      end\n    else\n      describe 'No public host key files found.' do\n        subject { pub_files.nil? or pub_files.empty? }\n        it { should eq true }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204597.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"No public host key files found. is expected to eq true","run_time":0.000108,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204598","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit\n    Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.","desc":"GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing\n    GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the\n    system. GSSAPI authentication must be disabled unless needed.","descriptions":[{"label":"default","data":"GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing\n    GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the\n    system. GSSAPI authentication must be disabled unless needed."},{"label":"check","data":"Verify the SSH daemon does not permit GSSAPI authentication unless approved.\n    Check that the SSH daemon does not permit GSSAPI authentication with the following command:\n    # grep -i gssapiauth /etc/ssh/sshd_config\n    GSSAPIAuthentication no\n    If the \"GSSAPIAuthentication\" keyword is missing, is set to \"yes\" and is not documented with the Information System\n    Security Officer (ISSO), or the returned line is commented out, this is a finding."},{"label":"fix","data":"Uncomment the \"GSSAPIAuthentication\" keyword in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and\n    set the value to \"no\":\n    GSSAPIAuthentication no\n    The SSH service must be restarted for changes to take effect.\n    If GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with\n    the ISSO."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72259","SV-86883"],"severity":"medium","gtitle":"SRG-OS-000364-GPOS-00151","gid":"V-204598","rid":"SV-204598r853993_rule","stig_id":"RHEL-07-040430","fix_id":"F-4722r88987_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204598' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit\n    Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.'\n  desc \"GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing\n    GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the\n    system. GSSAPI authentication must be disabled unless needed.\"\n  desc 'check', 'Verify the SSH daemon does not permit GSSAPI authentication unless approved.\n    Check that the SSH daemon does not permit GSSAPI authentication with the following command:\n    # grep -i gssapiauth /etc/ssh/sshd_config\n    GSSAPIAuthentication no\n    If the \"GSSAPIAuthentication\" keyword is missing, is set to \"yes\" and is not documented with the Information System\n    Security Officer (ISSO), or the returned line is commented out, this is a finding.'\n  desc 'fix', 'Uncomment the \"GSSAPIAuthentication\" keyword in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and\n    set the value to \"no\":\n    GSSAPIAuthentication no\n    The SSH service must be restarted for changes to take effect.\n    If GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with\n    the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72259', 'SV-86883']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000364-GPOS-00151'\n  tag gid: 'V-204598'\n  tag rid: 'SV-204598r853993_rule'\n  tag stig_id: 'RHEL-07-040430'\n  tag fix_id: 'F-4722r88987_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  elsif input('gssapi_approved')\n    describe sshd_config do\n      its('GSSAPIAuthentication') { should cmp 'no' }\n    end\n  else\n    impact 0.0\n    describe 'GSSAPI authentication is not approved' do\n      skip 'GSSAPI authentication is not approved, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204598.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204599","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit\n    Kerberos authentication unless needed.","desc":"Kerberos authentication for SSH is often implemented using Generic Security Service Application Program\n    Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's\n    Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to\n    exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be\n    disabled for systems not using this capability.","descriptions":[{"label":"default","data":"Kerberos authentication for SSH is often implemented using Generic Security Service Application Program\n    Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's\n    Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to\n    exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be\n    disabled for systems not using this capability."},{"label":"check","data":"Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.\n    Check that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:\n    # grep -i kerberosauth /etc/ssh/sshd_config\n    KerberosAuthentication no\n    If the \"KerberosAuthentication\" keyword is missing, or is set to \"yes\" and is not documented with the Information\n    System Security Officer (ISSO), or the returned line is commented out, this is a finding."},{"label":"fix","data":"Uncomment the \"KerberosAuthentication\" keyword in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and\n    set the value to \"no\":\n    KerberosAuthentication no\n    The SSH service must be restarted for changes to take effect.\n    If Kerberos authentication is required, it must be documented, to include the location of the configuration file,\n    with the ISSO."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72261","SV-86885"],"severity":"medium","gtitle":"SRG-OS-000364-GPOS-00151","gid":"V-204599","rid":"SV-204599r853994_rule","stig_id":"RHEL-07-040440","fix_id":"F-4723r88990_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204599' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not permit\n    Kerberos authentication unless needed.'\n  desc \"Kerberos authentication for SSH is often implemented using Generic Security Service Application Program\n    Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's\n    Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to\n    exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be\n    disabled for systems not using this capability.\"\n  desc 'check', 'Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved.\n    Check that the SSH daemon does not permit Kerberos to authenticate passwords with the following command:\n    # grep -i kerberosauth /etc/ssh/sshd_config\n    KerberosAuthentication no\n    If the \"KerberosAuthentication\" keyword is missing, or is set to \"yes\" and is not documented with the Information\n    System Security Officer (ISSO), or the returned line is commented out, this is a finding.'\n  desc 'fix', 'Uncomment the \"KerberosAuthentication\" keyword in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and\n    set the value to \"no\":\n    KerberosAuthentication no\n    The SSH service must be restarted for changes to take effect.\n    If Kerberos authentication is required, it must be documented, to include the location of the configuration file,\n    with the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72261', 'SV-86885']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000364-GPOS-00151'\n  tag gid: 'V-204599'\n  tag rid: 'SV-204599r853994_rule'\n  tag stig_id: 'RHEL-07-040440'\n  tag fix_id: 'F-4723r88990_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('KerberosAuthentication') { should cmp 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204599.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204600","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict\n    mode checking of home directory configuration files.","desc":"If other users have access to modify user-specific SSH configuration files, they may be able to log on to\n    the system as another user.","descriptions":[{"label":"default","data":"If other users have access to modify user-specific SSH configuration files, they may be able to log on to\n    the system as another user."},{"label":"check","data":"Verify the SSH daemon performs strict mode checking of home directory configuration files.\n    The location of the \"sshd_config\" file may vary if a different daemon is in use.\n    Inspect the \"sshd_config\" file with the following command:\n    # grep -i strictmodes /etc/ssh/sshd_config\n    StrictModes yes\n    If \"StrictModes\" is set to \"no\", is missing, or the returned line is commented out, this is a finding."},{"label":"fix","data":"Uncomment the \"StrictModes\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or\n    be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to\n    \"yes\":\n    StrictModes yes\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86887","V-72263"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204600","rid":"SV-204600r603261_rule","stig_id":"RHEL-07-040450","fix_id":"F-4724r88993_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204600' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon performs strict\n    mode checking of home directory configuration files.'\n  desc 'If other users have access to modify user-specific SSH configuration files, they may be able to log on to\n    the system as another user.'\n  desc 'check', 'Verify the SSH daemon performs strict mode checking of home directory configuration files.\n    The location of the \"sshd_config\" file may vary if a different daemon is in use.\n    Inspect the \"sshd_config\" file with the following command:\n    # grep -i strictmodes /etc/ssh/sshd_config\n    StrictModes yes\n    If \"StrictModes\" is set to \"no\", is missing, or the returned line is commented out, this is a finding.'\n  desc 'fix', 'Uncomment the \"StrictModes\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or\n    be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to\n    \"yes\":\n    StrictModes yes\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86887', 'V-72263']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204600'\n  tag rid: 'SV-204600r603261_rule'\n  tag stig_id: 'RHEL-07-040450'\n  tag fix_id: 'F-4724r88993_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('StrictModes') { should cmp 'yes' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204600.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204601","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege\n    separation.","desc":"SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would\n    decrease the impact of software vulnerabilities in the unprivileged section.","descriptions":[{"label":"default","data":"SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would\n    decrease the impact of software vulnerabilities in the unprivileged section."},{"label":"check","data":"Verify the SSH daemon performs privilege separation.\n    Check that the SSH daemon performs privilege separation with the following command:\n    # grep -i usepriv /etc/ssh/sshd_config\n    UsePrivilegeSeparation sandbox\n    If the \"UsePrivilegeSeparation\" keyword is set to \"no\", is missing, or the returned line is commented out, this is a\n    finding."},{"label":"fix","data":"Uncomment the \"UsePrivilegeSeparation\" keyword in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and\n    set the value to \"sandbox\" or \"yes\":\n    UsePrivilegeSeparation sandbox\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86889","V-72265"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204601","rid":"SV-204601r603261_rule","stig_id":"RHEL-07-040460","fix_id":"F-4725r88996_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204601' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon uses privilege\n    separation.'\n  desc 'SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would\n    decrease the impact of software vulnerabilities in the unprivileged section.'\n  desc 'check', 'Verify the SSH daemon performs privilege separation.\n    Check that the SSH daemon performs privilege separation with the following command:\n    # grep -i usepriv /etc/ssh/sshd_config\n    UsePrivilegeSeparation sandbox\n    If the \"UsePrivilegeSeparation\" keyword is set to \"no\", is missing, or the returned line is commented out, this is a\n    finding.'\n  desc 'fix', 'Uncomment the \"UsePrivilegeSeparation\" keyword in \"/etc/ssh/sshd_config\" (this file may be named\n    differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and\n    set the value to \"sandbox\" or \"yes\":\n    UsePrivilegeSeparation sandbox\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86889', 'V-72265']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204601'\n  tag rid: 'SV-204601r603261_rule'\n  tag stig_id: 'RHEL-07-040460'\n  tag fix_id: 'F-4725r88996_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe.one do\n      describe sshd_config do\n        its('UsePrivilegeSeparation') { should cmp 'sandbox' }\n      end\n      describe sshd_config do\n        its('UsePrivilegeSeparation') { should cmp 'yes' }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204601.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"SSHD Configuration UsePrivilegeSeparation ","run_time":0.000279,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RSpec::Core::MultipleExceptionError","resource_class":"sshd_config","resource_params":"[]"},{"status":"failed","code_desc":"SSHD Configuration UsePrivilegeSeparation ","run_time":0.000429,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RSpec::Core::MultipleExceptionError","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204602","title":"The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    compression or only allows compression after successful authentication.","desc":"If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression\n    software could result in compromise of the system from an unauthenticated connection, potentially with root\n    privileges.","descriptions":[{"label":"default","data":"If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression\n    software could result in compromise of the system from an unauthenticated connection, potentially with root\n    privileges."},{"label":"check","data":"Note: For RHEL 7.4 and above, this requirement is not applicable.\n\nVerify the SSH daemon performs compression after a user successfully authenticates.\n\nCheck that the SSH daemon performs compression after a user successfully authenticates with the following command:\n\n     # grep -i compression /etc/ssh/sshd_config\n     Compression delayed\n\nIf the \"Compression\" keyword is set to \"yes\", is missing, or the returned line is commented out, this is a finding."},{"label":"fix","data":"Uncomment the \"Compression\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or\n    be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set\n    the value to \"delayed\" or \"no\":\n    Compression no\n    The SSH service must be restarted for changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86891","V-72267"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204602","rid":"SV-204602r880758_rule","stig_id":"RHEL-07-040470","fix_id":"F-4726r880757_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204602' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow\n    compression or only allows compression after successful authentication.'\n  desc 'If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression\n    software could result in compromise of the system from an unauthenticated connection, potentially with root\n    privileges.'\n  desc 'check', 'Note: For RHEL 7.4 and above, this requirement is not applicable.\n\nVerify the SSH daemon performs compression after a user successfully authenticates.\n\nCheck that the SSH daemon performs compression after a user successfully authenticates with the following command:\n\n     # grep -i compression /etc/ssh/sshd_config\n     Compression delayed\n\nIf the \"Compression\" keyword is set to \"yes\", is missing, or the returned line is commented out, this is a finding.'\n  desc 'fix', 'Uncomment the \"Compression\" keyword in \"/etc/ssh/sshd_config\" (this file may be named differently or\n    be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set\n    the value to \"delayed\" or \"no\":\n    Compression no\n    The SSH service must be restarted for changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86891', 'V-72267']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204602'\n  tag rid: 'SV-204602r880758_rule'\n  tag stig_id: 'RHEL-07-040470'\n  tag fix_id: 'F-4726r880757_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n\n    describe.one do\n      describe sshd_config do\n        its('Compression') { should cmp 'delayed' }\n      end\n      describe sshd_config do\n        its('Compression') { should cmp 'no' }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204602.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"SSHD Configuration Compression ","run_time":0.000229,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RSpec::Core::MultipleExceptionError","resource_class":"sshd_config","resource_params":"[]"},{"status":"failed","code_desc":"SSHD Configuration Compression ","run_time":0.000225,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RSpec::Core::MultipleExceptionError","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204603","title":"The Red Hat Enterprise Linux operating system must, for networked systems, synchronize clocks with a server\n    that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server\n    designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).","desc":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis.\n    Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis\n    and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\n    Synchronizing internal information system clocks provides uniformity of time stamps for information systems with\n    multiple system clocks and systems connected over a network.\n    Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g.,\n    mobile, teleworking, and tactical endpoints).","descriptions":[{"label":"default","data":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis.\n    Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis\n    and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\n    Synchronizing internal information system clocks provides uniformity of time stamps for information systems with\n    multiple system clocks and systems connected over a network.\n    Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g.,\n    mobile, teleworking, and tactical endpoints)."},{"label":"check","data":"Check to see if NTP is running in continuous mode:\n    # ps -ef | grep ntp\n    If NTP is not running, check to see if \"chronyd\" is running in continuous mode:\n    # ps -ef | grep chronyd\n    If NTP or \"chronyd\" is not running, this is a finding.\n    If the NTP process is found, then check the \"ntp.conf\" file for the \"maxpoll\" option setting:\n    # grep maxpoll /etc/ntp.conf\n    server 0.rhel.pool.ntp.org iburst maxpoll 16\n    If the \"maxpoll\" option is set to a number greater than 16 or the line is commented out, this is a finding.\n    If the file does not exist, check the \"/etc/cron.daily\" subdirectory for a crontab file controlling the execution of\n    the \"ntpd -q\" command.\n    # grep -i \"ntpd -q\" /etc/cron.daily/*\n    # ls -al /etc/cron.* | grep ntp\n    ntp\n    If a crontab file does not exist in the \"/etc/cron.daily\" that executes the \"ntpd -q\" command, this is a finding.\n    If the \"chronyd\" process is found, then check the \"chrony.conf\" file for the \"maxpoll\" option setting:\n    # grep maxpoll /etc/chrony.conf\n    server 0.rhel.pool.ntp.org iburst maxpoll 16\n    If the option is not set or the line is commented out, this is a finding."},{"label":"fix","data":"Edit the \"/etc/ntp.conf\" or \"/etc/chrony.conf\" file and add or update an entry to define \"maxpoll\" to\n    \"16\" as follows:\n    server 0.rhel.pool.ntp.org iburst maxpoll 16\n    If NTP was running and \"maxpoll\" was updated, the NTP service must be restarted:\n    # systemctl restart ntpd\n    If NTP was not running, it must be started:\n    # systemctl start ntpd\n    If \"chronyd\" was running and \"maxpoll\" was updated, the service must be restarted:\n    # systemctl restart chronyd.service\n    If \"chronyd\" was not running, it must be started:\n    # systemctl start chronyd.service"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72269","SV-86893"],"severity":"medium","gtitle":"SRG-OS-000355-GPOS-00143","satisfies":["SRG-OS-000355-GPOS-00143","SRG-OS-000356-GPOS-00144"],"gid":"V-204603","rid":"SV-204603r877038_rule","stig_id":"RHEL-07-040500","fix_id":"F-4727r809210_fix","cci":["CCI-001891","CCI-002046"],"nist":["AU-8 (1) (a)","AU-8 (1) (b)"],"subsystems":["ntp"],"host":null,"container":null},"code":"control 'SV-204603' do\n  title 'The Red Hat Enterprise Linux operating system must, for networked systems, synchronize clocks with a server\n    that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server\n    designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).'\n  desc 'Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis.\n    Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis\n    and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\n    Synchronizing internal information system clocks provides uniformity of time stamps for information systems with\n    multiple system clocks and systems connected over a network.\n    Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g.,\n    mobile, teleworking, and tactical endpoints).'\n  desc 'check', 'Check to see if NTP is running in continuous mode:\n    # ps -ef | grep ntp\n    If NTP is not running, check to see if \"chronyd\" is running in continuous mode:\n    # ps -ef | grep chronyd\n    If NTP or \"chronyd\" is not running, this is a finding.\n    If the NTP process is found, then check the \"ntp.conf\" file for the \"maxpoll\" option setting:\n    # grep maxpoll /etc/ntp.conf\n    server 0.rhel.pool.ntp.org iburst maxpoll 16\n    If the \"maxpoll\" option is set to a number greater than 16 or the line is commented out, this is a finding.\n    If the file does not exist, check the \"/etc/cron.daily\" subdirectory for a crontab file controlling the execution of\n    the \"ntpd -q\" command.\n    # grep -i \"ntpd -q\" /etc/cron.daily/*\n    # ls -al /etc/cron.* | grep ntp\n    ntp\n    If a crontab file does not exist in the \"/etc/cron.daily\" that executes the \"ntpd -q\" command, this is a finding.\n    If the \"chronyd\" process is found, then check the \"chrony.conf\" file for the \"maxpoll\" option setting:\n    # grep maxpoll /etc/chrony.conf\n    server 0.rhel.pool.ntp.org iburst maxpoll 16\n    If the option is not set or the line is commented out, this is a finding.'\n  desc 'fix', 'Edit the \"/etc/ntp.conf\" or \"/etc/chrony.conf\" file and add or update an entry to define \"maxpoll\" to\n    \"16\" as follows:\n    server 0.rhel.pool.ntp.org iburst maxpoll 16\n    If NTP was running and \"maxpoll\" was updated, the NTP service must be restarted:\n    # systemctl restart ntpd\n    If NTP was not running, it must be started:\n    # systemctl start ntpd\n    If \"chronyd\" was running and \"maxpoll\" was updated, the service must be restarted:\n    # systemctl restart chronyd.service\n    If \"chronyd\" was not running, it must be started:\n    # systemctl start chronyd.service'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72269', 'SV-86893']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000355-GPOS-00143'\n  tag satisfies: ['SRG-OS-000355-GPOS-00143', 'SRG-OS-000356-GPOS-00144']\n  tag gid: 'V-204603'\n  tag rid: 'SV-204603r877038_rule'\n  tag stig_id: 'RHEL-07-040500'\n  tag fix_id: 'F-4727r809210_fix'\n  tag cci: ['CCI-001891', 'CCI-002046']\n  tag nist: ['AU-8 (1) (a)', 'AU-8 (1) (b)']\n  tag subsystems: ['ntp']\n  tag 'host'\n  tag 'container'\n\n  # Either ntpd or chronyd should be running\n  describe.one do\n    [service('ntpd'), service('chronyd')].each do |time_service|\n      describe time_service do\n        it { should be_running }\n        it { should be_enabled }\n        it { should be_installed }\n      end\n    end\n  end\n\n  if service('ntpd').installed?\n    time_service = service('ntpd')\n    time_sources = ntp_conf('/etc/ntp.conf').server\n    max_poll_values = time_sources.map do |val|\n      if val.match?(/.*maxpoll.*/)\n        val.gsub(/.*maxpoll\\s+(\\d+)(\\s+.*|$)/,\n                 '\\1').to_i\n      else\n        99\n      end\n    end\n    ntpdate_crons = command('grep -l \"ntpd -q\" /etc/cron.daily/*').stdout.strip.lines\n\n    describe 'ntpd time sources list' do\n      subject { time_sources }\n      it { should_not be_empty }\n    end\n\n    describe.one do\n      # Case where maxpoll empty\n      describe \"Daily cron jobs for 'ntpd -q'\" do\n        subject { ntpdate_crons }\n        it { should_not be_empty }\n      end\n      # All time sources must contain valid maxpoll entries\n      describe 'ntpd maxpoll values (99=maxpoll absent)' do\n        subject { max_poll_values }\n        it { should all be <= input('maxpoll') }\n      end\n    end\n  end\n\n  if service('chronyd').installed?\n    time_service = service('chronyd')\n    time_sources = ntp_conf('/etc/chrony.conf').server\n    max_poll_values = time_sources.map do |val|\n      if val.match?(/.*maxpoll.*/)\n        val.gsub(/.*maxpoll\\s+(\\d+)(\\s+.*|$)/,\n                 '\\1').to_i\n      else\n        99\n      end\n    end\n\n    describe 'chronyd time sources list' do\n      subject { time_sources }\n      it { should_not be_empty }\n    end\n\n    # All time sources must contain valid maxpoll entries\n    describe 'chronyd maxpoll values (99=maxpoll absent)' do\n      subject { max_poll_values }\n      it { should all be <= input('maxpoll') }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204603.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service ntpd is expected to be running","run_time":0.000145,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service ntpd` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"ntpd\"]"},{"status":"failed","code_desc":"Service ntpd is expected to be enabled","run_time":0.000134,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service ntpd` is enabled","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"ntpd\"]"},{"status":"failed","code_desc":"Service ntpd is expected to be installed","run_time":0.000132,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service ntpd` is installed","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"ntpd\"]"},{"status":"failed","code_desc":"Service chronyd is expected to be running","run_time":0.000131,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service chronyd` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"chronyd\"]"},{"status":"failed","code_desc":"Service chronyd is expected to be enabled","run_time":0.000334,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service chronyd` is enabled","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"chronyd\"]"},{"status":"failed","code_desc":"Service chronyd is expected to be installed","run_time":0.00013,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service chronyd` is installed","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"chronyd\"]"}]},{"id":"SV-204604","title":"The Red Hat Enterprise Linux operating system must enable an application firewall, if available.","desc":"Firewalls protect computers from network attacks by blocking or limiting access to open network ports.\n    Application firewalls limit which applications are allowed to communicate over the network.","descriptions":[{"label":"default","data":"Firewalls protect computers from network attacks by blocking or limiting access to open network ports.\n    Application firewalls limit which applications are allowed to communicate over the network."},{"label":"check","data":"Verify the operating system enabled an application firewall.\n    Check to see if \"firewalld\" is installed with the following command:\n    # yum list installed firewalld\n    firewalld-0.3.9-11.el7.noarch.rpm\n    If the \"firewalld\" package is not installed, ask the System Administrator if another firewall application (such as\n    iptables) is installed.\n    If an application firewall is not installed, this is a finding.\n    Check to see if the firewall is loaded and active with the following command:\n    # systemctl status firewalld\n    firewalld.service - firewalld - dynamic firewall daemon\n    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\n    Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago\n    If \"firewalld\" does not show a status of \"loaded\" and \"active\", this is a finding.\n    Check the state of the firewall:\n    # firewall-cmd --state\n    running\n    If \"firewalld\" does not show a state of \"running\", this is a finding."},{"label":"fix","data":"Ensure the operating system's application firewall is enabled.\n    Install the \"firewalld\" package, if it is not on the system, with the following command:\n    # yum install firewalld\n    Start the firewall via \"systemctl\" with the following command:\n    # systemctl start firewalld"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86897","V-72273"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":["SRG-OS-000480-GPOS-00227","SRG-OS-000480-GPOS-00231","SRG-OS-000480-GPOS-00232"],"gid":"V-204604","rid":"SV-204604r603261_rule","stig_id":"RHEL-07-040520","fix_id":"F-4728r89005_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["firewalld","iptables"],"host":null,"container":null},"code":"control 'SV-204604' do\n  title 'The Red Hat Enterprise Linux operating system must enable an application firewall, if available.'\n  desc 'Firewalls protect computers from network attacks by blocking or limiting access to open network ports.\n    Application firewalls limit which applications are allowed to communicate over the network.'\n  desc 'check', 'Verify the operating system enabled an application firewall.\n    Check to see if \"firewalld\" is installed with the following command:\n    # yum list installed firewalld\n    firewalld-0.3.9-11.el7.noarch.rpm\n    If the \"firewalld\" package is not installed, ask the System Administrator if another firewall application (such as\n    iptables) is installed.\n    If an application firewall is not installed, this is a finding.\n    Check to see if the firewall is loaded and active with the following command:\n    # systemctl status firewalld\n    firewalld.service - firewalld - dynamic firewall daemon\n    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\n    Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago\n    If \"firewalld\" does not show a status of \"loaded\" and \"active\", this is a finding.\n    Check the state of the firewall:\n    # firewall-cmd --state\n    running\n    If \"firewalld\" does not show a state of \"running\", this is a finding.'\n  desc 'fix', %q(Ensure the operating system's application firewall is enabled.\n    Install the \"firewalld\" package, if it is not on the system, with the following command:\n    # yum install firewalld\n    Start the firewall via \"systemctl\" with the following command:\n    # systemctl start firewalld)\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86897', 'V-72273']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: ['SRG-OS-000480-GPOS-00227', 'SRG-OS-000480-GPOS-00231', 'SRG-OS-000480-GPOS-00232']\n  tag gid: 'V-204604'\n  tag rid: 'SV-204604r603261_rule'\n  tag stig_id: 'RHEL-07-040520'\n  tag fix_id: 'F-4728r89005_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['firewalld', 'iptables']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    describe package('firewalld') do\n      it { should be_installed }\n    end\n    describe package('iptables') do\n      it { should be_installed }\n    end\n    if input('firewall_application_package') != ''\n      describe package(input('firewall_application_package')) do\n        it { should be_installed }\n      end\n    end\n  end\n  describe.one do\n    describe systemd_service('firewalld.service') do\n      it { should be_running }\n    end\n    describe systemd_service('iptables.service') do\n      it { should be_running }\n    end\n    if input('firewall_application_service') != ''\n      describe systemd_service(input('firewall_application_service')) do\n        it { should be_running }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204604.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"System Package firewalld is expected to be installed","run_time":0.000174,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package firewalld` is installed","exception":"RSpec::Core::MultipleExceptionError","resource_class":"package","resource_params":"[\"firewalld\"]"},{"status":"failed","code_desc":"System Package iptables is expected to be installed","run_time":0.00014,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package iptables` is installed","exception":"RSpec::Core::MultipleExceptionError","resource_class":"package","resource_params":"[\"iptables\"]"},{"status":"failed","code_desc":"Service firewalld.service is expected to be running","run_time":0.000208,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service firewalld.service` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"systemd_service","resource_params":"[\"firewalld.service\"]"},{"status":"failed","code_desc":"Service iptables.service is expected to be running","run_time":0.000197,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service iptables.service` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"systemd_service","resource_params":"[\"iptables.service\"]"}]},{"id":"SV-204605","title":"The Red Hat Enterprise Linux operating system must display the date and time of the last successful account\n    logon upon logon.","desc":"Providing users with feedback on when account accesses last occurred facilitates user recognition and\n    reporting of unauthorized account use.","descriptions":[{"label":"default","data":"Providing users with feedback on when account accesses last occurred facilitates user recognition and\n    reporting of unauthorized account use."},{"label":"check","data":"Verify users are provided with feedback on when account accesses last occurred.\n    Check that \"pam_lastlog\" is used and not silent with the following command:\n    # grep pam_lastlog /etc/pam.d/postlogin\n    session required pam_lastlog.so showfailed\n    If \"pam_lastlog\" is missing from \"/etc/pam.d/postlogin\" file, or the silent option is present, this is a finding."},{"label":"fix","data":"Configure the operating system to provide users with feedback on when account accesses last occurred\n    by setting the required configuration options in \"/etc/pam.d/postlogin\".\n    Add the following line to the top of \"/etc/pam.d/postlogin\":\n    session required pam_lastlog.so showfailed"}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86899","V-72275"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204605","rid":"SV-204605r858478_rule","stig_id":"RHEL-07-040530","fix_id":"F-4729r89008_fix","cci":["CCI-000366","CCI-000052"],"nist":["CM-6 b","AC-9"],"subsystems":["pam","lastlog","ssh"],"host":null,"container":null},"code":"control 'SV-204605' do\n  title 'The Red Hat Enterprise Linux operating system must display the date and time of the last successful account\n    logon upon logon.'\n  desc 'Providing users with feedback on when account accesses last occurred facilitates user recognition and\n    reporting of unauthorized account use.'\n  desc 'check', 'Verify users are provided with feedback on when account accesses last occurred.\n    Check that \"pam_lastlog\" is used and not silent with the following command:\n    # grep pam_lastlog /etc/pam.d/postlogin\n    session required pam_lastlog.so showfailed\n    If \"pam_lastlog\" is missing from \"/etc/pam.d/postlogin\" file, or the silent option is present, this is a finding.'\n  desc 'fix', 'Configure the operating system to provide users with feedback on when account accesses last occurred\n    by setting the required configuration options in \"/etc/pam.d/postlogin\".\n    Add the following line to the top of \"/etc/pam.d/postlogin\":\n    session required pam_lastlog.so showfailed'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86899', 'V-72275']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204605'\n  tag rid: 'SV-204605r858478_rule'\n  tag stig_id: 'RHEL-07-040530'\n  tag fix_id: 'F-4729r89008_fix'\n  tag cci: ['CCI-000366', 'CCI-000052']\n  tag nist: ['CM-6 b', 'AC-9']\n  tag subsystems: ['pam', 'lastlog', 'ssh']\n  tag 'host'\n  tag 'container'\n\n  describe pam('/etc/pam.d/postlogin') do\n    its('lines') do\n      should match_pam_rule('session .* pam_lastlog.so showfailed')\n    end\n  end\n\n  unless virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    describe.one do\n      describe sshd_config do\n        its('PrintLastLog') { should cmp 'yes' }\n      end\n      describe pam('/etc/pam.d/postlogin') do\n        its('lines') do\n          should_not match_pam_rule('session .* pam_lastlog.so showfailed silent')\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204605.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"PAM Config[/etc/pam.d/postlogin] ","run_time":7.6e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `pam` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"pam","resource_params":"[\"/etc/pam.d/postlogin\"]"},{"status":"failed","code_desc":"SSHD Configuration PrintLastLog ","run_time":0.00043,"start_time":"2023-04-18T13:20:14-04:00","message":"Can't find file: /etc/ssh/sshd_config","exception":"RSpec::Core::MultipleExceptionError","resource_class":"sshd_config","resource_params":"[]"},{"status":"failed","code_desc":"PAM Config[/etc/pam.d/postlogin] lines is expected not to include session .* pam_lastlog.so showfailed silent","run_time":0.000193,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `basename' for #<Train::Transports::Mock::Connection::File:0x00007f8621fda9e0 @backend=Train::Transports::Mock::Connection[mock], @path=\"/etc/pam.d/postlogin\", @follow_symlink=true, @type=:unknown, @exist=false>","exception":"RSpec::Core::MultipleExceptionError","resource_class":"pam","resource_params":"[\"/etc/pam.d/postlogin\"]"}]},{"id":"SV-204606","title":"The Red Hat Enterprise Linux operating system must not contain .shosts files.","desc":"The .shosts files are used to configure host-based authentication for individual users or the system via\n    SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not\n    require interactive identification and authentication of a connection request, or for the use of two-factor\n    authentication.","descriptions":[{"label":"default","data":"The .shosts files are used to configure host-based authentication for individual users or the system via\n    SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not\n    require interactive identification and authentication of a connection request, or for the use of two-factor\n    authentication."},{"label":"check","data":"Verify there are no \".shosts\" files on the system.\n    Check the system for the existence of these files with the following command:\n    # find / -name '*.shosts'\n    If any \".shosts\" files are found on the system, this is a finding."},{"label":"fix","data":"Remove any found \".shosts\" files from the system.\n    # rm /[path]/[to]/[file]/.shosts"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86901","V-72277"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204606","rid":"SV-204606r603261_rule","stig_id":"RHEL-07-040540","fix_id":"F-4730r89011_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null,"container":null},"code":"control 'SV-204606' do\n  title 'The Red Hat Enterprise Linux operating system must not contain .shosts files.'\n  desc 'The .shosts files are used to configure host-based authentication for individual users or the system via\n    SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not\n    require interactive identification and authentication of a connection request, or for the use of two-factor\n    authentication.'\n  desc 'check', %q(Verify there are no \".shosts\" files on the system.\n    Check the system for the existence of these files with the following command:\n    # find / -name '*.shosts'\n    If any \".shosts\" files are found on the system, this is a finding.)\n  desc 'fix', 'Remove any found \".shosts\" files from the system.\n    # rm /[path]/[to]/[file]/.shosts'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86901', 'V-72277']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204606'\n  tag rid: 'SV-204606r603261_rule'\n  tag stig_id: 'RHEL-07-040540'\n  tag fix_id: 'F-4730r89011_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n  tag 'container'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe command(\"find / -xdev -xautofs -name '*.shosts'\") do\n      its('stdout.strip') { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204606.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `find / -xdev -xautofs -name '*.shosts'` ","run_time":8.3e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"find / -xdev -xautofs -name '*.shosts'\"]"}]},{"id":"SV-204607","title":"The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.","desc":"The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based\n    authentication is not sufficient for preventing unauthorized access to the system, as it does not require\n    interactive identification and authentication of a connection request, or for the use of two-factor authentication.","descriptions":[{"label":"default","data":"The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based\n    authentication is not sufficient for preventing unauthorized access to the system, as it does not require\n    interactive identification and authentication of a connection request, or for the use of two-factor authentication."},{"label":"check","data":"Verify there are no \"shosts.equiv\" files on the system.\n    Check the system for the existence of these files with the following command:\n    # find / -name shosts.equiv\n    If any \"shosts.equiv\" files are found on the system, this is a finding."},{"label":"fix","data":"Remove any found \"shosts.equiv\" files from the system.\n    # rm /[path]/[to]/[file]/shosts.equiv"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86903","V-72279"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204607","rid":"SV-204607r603261_rule","stig_id":"RHEL-07-040550","fix_id":"F-4731r89014_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null,"container":null},"code":"control 'SV-204607' do\n  title 'The Red Hat Enterprise Linux operating system must not contain shosts.equiv files.'\n  desc 'The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based\n    authentication is not sufficient for preventing unauthorized access to the system, as it does not require\n    interactive identification and authentication of a connection request, or for the use of two-factor authentication.'\n  desc 'check', 'Verify there are no \"shosts.equiv\" files on the system.\n    Check the system for the existence of these files with the following command:\n    # find / -name shosts.equiv\n    If any \"shosts.equiv\" files are found on the system, this is a finding.'\n  desc 'fix', 'Remove any found \"shosts.equiv\" files from the system.\n    # rm /[path]/[to]/[file]/shosts.equiv'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86903', 'V-72279']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204607'\n  tag rid: 'SV-204607r603261_rule'\n  tag stig_id: 'RHEL-07-040550'\n  tag fix_id: 'F-4731r89014_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n  tag 'container'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe command('find / -xdev -xautofs -name shosts.equiv') do\n      its('stdout.strip') { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204607.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `find / -xdev -xautofs -name shosts.equiv` ","run_time":7.2e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"find / -xdev -xautofs -name shosts.equiv\"]"}]},{"id":"SV-204608","title":"For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be\n    configured.","desc":"To provide availability for name resolution services, multiple redundant name servers are mandated. A\n    failure in name resolution could lead to the failure of security functions requiring name resolution, which may\n    include time synchronization, centralized authentication, and remote system logging.","descriptions":[{"label":"default","data":"To provide availability for name resolution services, multiple redundant name servers are mandated. A\n    failure in name resolution could lead to the failure of security functions requiring name resolution, which may\n    include time synchronization, centralized authentication, and remote system logging."},{"label":"check","data":"Determine whether the system is using local or DNS name resolution with the following command:\n    # grep hosts /etc/nsswitch.conf\n    hosts: files dns\n    If the DNS entry is missing from the host's line in the \"/etc/nsswitch.conf\" file, the \"/etc/resolv.conf\" file must\n    be empty.\n    Verify the \"/etc/resolv.conf\" file is empty with the following command:\n    # ls -al /etc/resolv.conf\n    -rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf\n    If local host authentication is being used and the \"/etc/resolv.conf\" file is not empty, this is a finding.\n    If the DNS entry is found on the host's line of the \"/etc/nsswitch.conf\" file, verify the operating system is\n    configured to use two or more name servers for DNS resolution.\n    Determine the name servers used by the system with the following command:\n    # grep nameserver /etc/resolv.conf\n    nameserver 192.168.1.2\n    nameserver 192.168.1.3\n    If less than two lines are returned that are not commented out, this is a finding.\n    Verify that the \"/etc/resolv.conf\" file is immutable with the following command:\n    # sudo lsattr /etc/resolv.conf\n    ----i----------- /etc/resolv.conf\n    If the file is mutable and has not been documented with the Information System Security Officer (ISSO), this is a\n    finding."},{"label":"fix","data":"Configure the operating system to use two or more name servers for DNS resolution.\n    Edit the \"/etc/resolv.conf\" file to uncomment or add the two or more \"nameserver\" option lines with the IP address\n    of local authoritative name servers. If local host resolution is being performed, the \"/etc/resolv.conf\" file must\n    be empty. An empty \"/etc/resolv.conf\" file can be created as follows:\n    # echo -n > /etc/resolv.conf\n    And then make the file immutable with the following command:\n    # chattr +i /etc/resolv.conf\n    If the \"/etc/resolv.conf\" file must be mutable, the required configuration must be documented with the Information\n    System Security Officer (ISSO) and the file must be verified by the system file integrity tool."}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86905","V-72281"],"severity":"low","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204608","rid":"SV-204608r603261_rule","stig_id":"RHEL-07-040600","fix_id":"F-4732r89017_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["dns","resolv"],"host":null,"container":null},"code":"control 'SV-204608' do\n  title 'For Red Hat Enterprise Linux operating systems using DNS resolution, at least two name servers must be\n    configured.'\n  desc 'To provide availability for name resolution services, multiple redundant name servers are mandated. A\n    failure in name resolution could lead to the failure of security functions requiring name resolution, which may\n    include time synchronization, centralized authentication, and remote system logging.'\n  desc 'check', %q(Determine whether the system is using local or DNS name resolution with the following command:\n    # grep hosts /etc/nsswitch.conf\n    hosts: files dns\n    If the DNS entry is missing from the host's line in the \"/etc/nsswitch.conf\" file, the \"/etc/resolv.conf\" file must\n    be empty.\n    Verify the \"/etc/resolv.conf\" file is empty with the following command:\n    # ls -al /etc/resolv.conf\n    -rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf\n    If local host authentication is being used and the \"/etc/resolv.conf\" file is not empty, this is a finding.\n    If the DNS entry is found on the host's line of the \"/etc/nsswitch.conf\" file, verify the operating system is\n    configured to use two or more name servers for DNS resolution.\n    Determine the name servers used by the system with the following command:\n    # grep nameserver /etc/resolv.conf\n    nameserver 192.168.1.2\n    nameserver 192.168.1.3\n    If less than two lines are returned that are not commented out, this is a finding.\n    Verify that the \"/etc/resolv.conf\" file is immutable with the following command:\n    # sudo lsattr /etc/resolv.conf\n    ----i----------- /etc/resolv.conf\n    If the file is mutable and has not been documented with the Information System Security Officer (ISSO), this is a\n    finding.)\n  desc 'fix', 'Configure the operating system to use two or more name servers for DNS resolution.\n    Edit the \"/etc/resolv.conf\" file to uncomment or add the two or more \"nameserver\" option lines with the IP address\n    of local authoritative name servers. If local host resolution is being performed, the \"/etc/resolv.conf\" file must\n    be empty. An empty \"/etc/resolv.conf\" file can be created as follows:\n    # echo -n > /etc/resolv.conf\n    And then make the file immutable with the following command:\n    # chattr +i /etc/resolv.conf\n    If the \"/etc/resolv.conf\" file must be mutable, the required configuration must be documented with the Information\n    System Security Officer (ISSO) and the file must be verified by the system file integrity tool.'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86905', 'V-72281']\n  tag severity: 'low'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204608'\n  tag rid: 'SV-204608r603261_rule'\n  tag stig_id: 'RHEL-07-040600'\n  tag fix_id: 'F-4732r89017_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['dns', 'resolv']\n  tag 'host'\n  tag 'container'\n\n  dns_in_host_line = parse_config_file('/etc/nsswitch.conf',\n                                       {\n                                         comment_char: '#',\n                                         assignment_regex: /^\\s*([^:]*?)\\s*:\\s*(.*?)\\s*$/\n                                       }).params['hosts'].include?('dns')\n\n  unless dns_in_host_line\n    describe 'If `local` resolution is being used, a `hosts` entry in /etc/nsswitch.conf having `dns`' do\n      subject { dns_in_host_line }\n      it { should be false }\n    end\n  end\n\n  unless dns_in_host_line\n    describe 'If `local` resoultion is being used, the /etc/resolv.conf file should' do\n      subject do\n        parse_config_file('/etc/resolv.conf', { comment_char: '#' }).params\n      end\n      it { should be_empty }\n    end\n  end\n\n  nameservers = parse_config_file('/etc/resolv.conf',\n                                  { comment_char: '#' }).params.keys.grep(/nameserver/)\n\n  if dns_in_host_line\n    describe \"The system's nameservers: #{nameservers}\" do\n      subject { nameservers }\n      it { should_not be nil }\n    end\n  end\n\n  if dns_in_host_line\n    describe 'The number of nameservers' do\n      subject { nameservers.count }\n      it { should cmp >= 2 }\n    end\n  end\n\n  describe '/etc/resolv.conf should be immutable -- file attributes' do\n    subject { command('lsattr /etc/resolve.conf').stdout }\n    it { should match /i/ }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204608.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Control Source Code Error ./controls/SV-204608.rb:1 ","run_time":8.2e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"undefined method `include?' for nil:NilClass","exception":"RuntimeError","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/rule.rb:61:in `block (2 levels) in initialize'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:608:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204609","title":"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4)\n    source-routed packets.","desc":"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the\n    system is functioning as a router.","descriptions":[{"label":"default","data":"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the\n    system is functioning as a router."},{"label":"check","data":"Verify the system does not accept IPv4 source-routed packets.\n\n     # grep -r net.ipv4.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.all.accept_source_route = 0\n\nIf \"net.ipv4.conf.all.accept_source_route\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route\n     net.ipv4.conf.all.accept_source_route = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.all.accept_source_route = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl -system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72283","SV-86907"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204609","rid":"SV-204609r880797_rule","stig_id":"RHEL-07-040610","fix_id":"F-4733r880796_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204609' do\n  title 'The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4)\n    source-routed packets.'\n  desc 'Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the\n    system is functioning as a router.'\n  desc 'check', 'Verify the system does not accept IPv4 source-routed packets.\n\n     # grep -r net.ipv4.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.all.accept_source_route = 0\n\nIf \"net.ipv4.conf.all.accept_source_route\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route\n     net.ipv4.conf.all.accept_source_route = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.all.accept_source_route = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl -system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72283', 'SV-86907']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204609'\n  tag rid: 'SV-204609r880797_rule'\n  tag stig_id: 'RHEL-07-040610'\n  tag fix_id: 'F-4733r880796_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.conf.all.accept_source_route') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204609.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.all.accept_source_route","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.all.accept_source_route","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.all.accept_source_route\"]"}]},{"id":"SV-204610","title":"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when\n    possible on all interfaces.","desc":"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks, but is helpful for end hosts and routers serving small networks.","descriptions":[{"label":"default","data":"Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks, but is helpful for end hosts and routers serving small networks."},{"label":"check","data":"Verify the system uses a reverse-path filter for IPv4:\n\n     # grep -r net.ipv4.conf.all.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.all.rp_filter = 1\n\nIf \"net.ipv4.conf.all.rp_filter\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter\n     net.ipv4.conf.all.rp_filter = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.all.rp_filter = 1\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-92251","SV-102353"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204610","rid":"SV-204610r880800_rule","stig_id":"RHEL-07-040611","fix_id":"F-4734r880799_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204610' do\n  title 'The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when\n    possible on all interfaces.'\n  desc 'Enabling reverse path filtering drops packets with source addresses that should not have been able to be received on the interface they were received on. It should not be used on systems that are routers for complicated networks, but is helpful for end hosts and routers serving small networks.'\n  desc 'check', 'Verify the system uses a reverse-path filter for IPv4:\n\n     # grep -r net.ipv4.conf.all.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.all.rp_filter = 1\n\nIf \"net.ipv4.conf.all.rp_filter\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter\n     net.ipv4.conf.all.rp_filter = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.all.rp_filter = 1\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-92251', 'SV-102353']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204610'\n  tag rid: 'SV-204610r880800_rule'\n  tag stig_id: 'RHEL-07-040611'\n  tag fix_id: 'F-4734r880799_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.conf.all.rp_filter') do\n      its('value') { should eq 1 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204610.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.all.rp_filter","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.all.rp_filter","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.all.rp_filter\"]"}]},{"id":"SV-204611","title":"The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when\n    possible by default.","desc":"Enabling reverse path filtering drops packets with source addresses that should not have been able to be\n    received on the interface they were received on. It should not be used on systems which are routers for complicated\n    networks, but is helpful for end hosts and routers serving small networks.","descriptions":[{"label":"default","data":"Enabling reverse path filtering drops packets with source addresses that should not have been able to be\n    received on the interface they were received on. It should not be used on systems which are routers for complicated\n    networks, but is helpful for end hosts and routers serving small networks."},{"label":"check","data":"Verify the system uses a reverse-path filter for IPv4:\n\n     # grep -r net.ipv4.conf.default.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.default.rp_filter = 1\n\nIf \"net.ipv4.conf.default.rp_filter\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter\n     net.ipv4.conf.default.rp_filter = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.default.rp_filter = 1\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-92253","SV-102355"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204611","rid":"SV-204611r880803_rule","stig_id":"RHEL-07-040612","fix_id":"F-4735r880802_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204611' do\n  title 'The Red Hat Enterprise Linux operating system must use a reverse-path filter for IPv4 network traffic when\n    possible by default.'\n  desc 'Enabling reverse path filtering drops packets with source addresses that should not have been able to be\n    received on the interface they were received on. It should not be used on systems which are routers for complicated\n    networks, but is helpful for end hosts and routers serving small networks.'\n  desc 'check', 'Verify the system uses a reverse-path filter for IPv4:\n\n     # grep -r net.ipv4.conf.default.rp_filter /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.default.rp_filter = 1\n\nIf \"net.ipv4.conf.default.rp_filter\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter\n     net.ipv4.conf.default.rp_filter = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.default.rp_filter = 1\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-92253', 'SV-102355']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204611'\n  tag rid: 'SV-204611r880803_rule'\n  tag stig_id: 'RHEL-07-040612'\n  tag fix_id: 'F-4735r880802_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.conf.default.rp_filter') do\n      its('value') { should eq 1 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204611.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.default.rp_filter","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.default.rp_filter","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.default.rp_filter\"]"}]},{"id":"SV-204612","title":"The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4)\n    source-routed packets by default.","desc":"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the\n    system is functioning as a router.","descriptions":[{"label":"default","data":"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the\n    system is functioning as a router."},{"label":"check","data":"Verify the system does not accept IPv4 source-routed packets by default.\n\n     # grep -r net.ipv4.conf.default.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.default.accept_source_route = 0\n\nIf  \"net.ipv4.conf.default.accept_source_route\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route\n     net.ipv4.conf.default.accept_source_route = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.default.accept_source_route = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72285","SV-86909"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204612","rid":"SV-204612r880806_rule","stig_id":"RHEL-07-040620","fix_id":"F-4736r880805_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204612' do\n  title 'The Red Hat Enterprise Linux operating system must not forward Internet Protocol version 4 (IPv4)\n    source-routed packets by default.'\n  desc 'Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the\n    system is functioning as a router.'\n  desc 'check', 'Verify the system does not accept IPv4 source-routed packets by default.\n\n     # grep -r net.ipv4.conf.default.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.conf.default.accept_source_route = 0\n\nIf  \"net.ipv4.conf.default.accept_source_route\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route\n     net.ipv4.conf.default.accept_source_route = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.conf.default.accept_source_route = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72285', 'SV-86909']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204612'\n  tag rid: 'SV-204612r880806_rule'\n  tag stig_id: 'RHEL-07-040620'\n  tag fix_id: 'F-4736r880805_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.conf.default.accept_source_route') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204612.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.default.accept_source_route","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.default.accept_source_route","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.default.accept_source_route\"]"}]},{"id":"SV-204613","title":"The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4)\n    Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.","desc":"Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification\n    attacks.","descriptions":[{"label":"default","data":"Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification\n    attacks."},{"label":"check","data":"Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.\n\n     # grep -r net.ipv4.icmp_echo_ignore_broadcasts /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.icmp_echo_ignore_broadcasts\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the \"icmp_echo_ignore_broadcasts\" variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts\n     net.ipv4.icmp_echo_ignore_broadcasts = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.icmp_echo_ignore_broadcasts = 1\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72287","SV-86911"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204613","rid":"SV-204613r880809_rule","stig_id":"RHEL-07-040630","fix_id":"F-4737r880808_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204613' do\n  title 'The Red Hat Enterprise Linux operating system must not respond to Internet Protocol version 4 (IPv4)\n    Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.'\n  desc 'Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification\n    attacks.'\n  desc 'check', 'Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.\n\n     # grep -r net.ipv4.icmp_echo_ignore_broadcasts /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.icmp_echo_ignore_broadcasts\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"1\", this is a finding.\n\nCheck that the operating system implements the \"icmp_echo_ignore_broadcasts\" variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts\n     net.ipv4.icmp_echo_ignore_broadcasts = 1\n\nIf the returned line does not have a value of \"1\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.icmp_echo_ignore_broadcasts = 1\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72287', 'SV-86911']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204613'\n  tag rid: 'SV-204613r880809_rule'\n  tag stig_id: 'RHEL-07-040630'\n  tag fix_id: 'F-4737r880808_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do\n      its('value') { should eq 1 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204613.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.icmp_echo_ignore_broadcasts","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.icmp_echo_ignore_broadcasts","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.icmp_echo_ignore_broadcasts\"]"}]},{"id":"SV-204614","title":"The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet\n    Control Message Protocol (ICMP) redirect messages from being accepted.","desc":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message\n    could result in a man-in-the-middle attack.","descriptions":[{"label":"default","data":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message\n    could result in a man-in-the-middle attack."},{"label":"check","data":"Verify the system will not accept IPv4 ICMP redirect messages.\n\n     # grep -r net.ipv4.conf.default.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.default.accept_redirects\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the value of the \"accept_redirects\" variables with the following command:\n\n    # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_redirects\n    net.ipv4.conf.default.accept_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to not accept IPv4 ICMP redirect messages by adding the\nfollowing line to \"/etc/sysctl.conf\" or a configuration file in the\n/etc/sysctl.d/ directory (or modify the line to have the required value):\n\n    net.ipv4.conf.default.accept_redirects = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86913","V-72289"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204614","rid":"SV-204614r880812_rule","stig_id":"RHEL-07-040640","fix_id":"F-4738r880811_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204614' do\n  title 'The Red Hat Enterprise Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet\n    Control Message Protocol (ICMP) redirect messages from being accepted.'\n  desc \"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message\n    could result in a man-in-the-middle attack.\"\n  desc 'check', 'Verify the system will not accept IPv4 ICMP redirect messages.\n\n     # grep -r net.ipv4.conf.default.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.default.accept_redirects\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the value of the \"accept_redirects\" variables with the following command:\n\n    # /sbin/sysctl -a | grep net.ipv4.conf.default.accept_redirects\n    net.ipv4.conf.default.accept_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to not accept IPv4 ICMP redirect messages by adding the\nfollowing line to \"/etc/sysctl.conf\" or a configuration file in the\n/etc/sysctl.d/ directory (or modify the line to have the required value):\n\n    net.ipv4.conf.default.accept_redirects = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86913', 'V-72289']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204614'\n  tag rid: 'SV-204614r880812_rule'\n  tag stig_id: 'RHEL-07-040640'\n  tag fix_id: 'F-4738r880811_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.conf.default.accept_redirects') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204614.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.default.accept_redirects","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.default.accept_redirects","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.default.accept_redirects\"]"}]},{"id":"SV-204615","title":"The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet\n    Control Message Protocol (ICMP) redirect messages.","desc":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message\n    could result in a man-in-the-middle attack.","descriptions":[{"label":"default","data":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message\n    could result in a man-in-the-middle attack."},{"label":"check","data":"Verify the system ignores IPv4 ICMP redirect messages.\n\n     # grep -r net.ipv4.conf.all.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.all.accept_redirects\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"accept_redirects\" variables with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_redirects\n     net.ipv4.conf.all.accept_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to ignore IPv4 ICMP redirect messages by adding the\nfollowing line to \"/etc/sysctl.conf\" or a configuration file in the\n/etc/sysctl.d/ directory (or modify the line to have the required value):\n\n    net.ipv4.conf.all.accept_redirects = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87827","V-73175"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204615","rid":"SV-204615r880815_rule","stig_id":"RHEL-07-040641","fix_id":"F-4739r880814_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204615' do\n  title 'The Red Hat Enterprise Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet\n    Control Message Protocol (ICMP) redirect messages.'\n  desc \"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message\n    could result in a man-in-the-middle attack.\"\n  desc 'check', 'Verify the system ignores IPv4 ICMP redirect messages.\n\n     # grep -r net.ipv4.conf.all.accept_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.all.accept_redirects\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"accept_redirects\" variables with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.accept_redirects\n     net.ipv4.conf.all.accept_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to ignore IPv4 ICMP redirect messages by adding the\nfollowing line to \"/etc/sysctl.conf\" or a configuration file in the\n/etc/sysctl.d/ directory (or modify the line to have the required value):\n\n    net.ipv4.conf.all.accept_redirects = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87827', 'V-73175']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204615'\n  tag rid: 'SV-204615r880815_rule'\n  tag stig_id: 'RHEL-07-040641'\n  tag fix_id: 'F-4739r880814_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n\n    describe kernel_parameter('net.ipv4.conf.all.accept_redirects') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204615.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.all.accept_redirects","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.all.accept_redirects","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.all.accept_redirects\"]"}]},{"id":"SV-204616","title":"The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol\n    version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.","desc":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages contain information from the system's route table, possibly revealing portions of the\n    network topology.","descriptions":[{"label":"default","data":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages contain information from the system's route table, possibly revealing portions of the\n    network topology."},{"label":"check","data":"Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.\n\n     # grep -r net.ipv4.conf.default.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.default.send_redirects\" is not configured in the \"/etc/sysctl.conf\" file or in any of the other sysctl.d directories, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"default send_redirects\" variables with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.default.send_redirects\n     net.ipv4.conf.default.send_redirects = 0 \n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default.\n    Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a\n    configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n    net.ipv4.conf.default.send_redirects = 0\n    Issue the following command to make the changes take effect:\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72291","SV-86915"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204616","rid":"SV-204616r880818_rule","stig_id":"RHEL-07-040650","fix_id":"F-4740r880817_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204616' do\n  title 'The Red Hat Enterprise Linux operating system must not allow interfaces to perform Internet Protocol\n    version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.'\n  desc \"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages contain information from the system's route table, possibly revealing portions of the\n    network topology.\"\n  desc 'check', 'Verify the system does not allow interfaces to perform IPv4 ICMP redirects by default.\n\n     # grep -r net.ipv4.conf.default.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.default.send_redirects\" is not configured in the \"/etc/sysctl.conf\" file or in any of the other sysctl.d directories, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"default send_redirects\" variables with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.default.send_redirects\n     net.ipv4.conf.default.send_redirects = 0 \n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Configure the system to not allow interfaces to perform IPv4 ICMP redirects by default.\n    Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a\n    configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n    net.ipv4.conf.default.send_redirects = 0\n    Issue the following command to make the changes take effect:\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72291', 'SV-86915']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204616'\n  tag rid: 'SV-204616r880818_rule'\n  tag stig_id: 'RHEL-07-040650'\n  tag fix_id: 'F-4740r880817_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n\n    describe kernel_parameter('net.ipv4.conf.default.send_redirects') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204616.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.default.send_redirects","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.default.send_redirects","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.default.send_redirects\"]"}]},{"id":"SV-204617","title":"The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet\n    Control Message Protocol (ICMP) redirects.","desc":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages contain information from the system's route table, possibly revealing portions of the\n    network topology.","descriptions":[{"label":"default","data":"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages contain information from the system's route table, possibly revealing portions of the\n    network topology."},{"label":"check","data":"Verify the system does not send IPv4 ICMP redirect messages.\n\n     # grep -r net.ipv4.conf.all.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.all.send_redirects\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"all send_redirects\" variables with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.send_redirects\n     net.ipv4.conf.all.send_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Configure the system to not allow interfaces to perform IPv4 ICMP redirects.\n    Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a\n    configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n    net.ipv4.conf.all.send_redirects = 0\n    Issue the following command to make the changes take effect:\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72293","SV-86917"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204617","rid":"SV-204617r880821_rule","stig_id":"RHEL-07-040660","fix_id":"F-4741r880820_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv4"],"host":null},"code":"control 'SV-204617' do\n  title 'The Red Hat Enterprise Linux operating system must not send Internet Protocol version 4 (IPv4) Internet\n    Control Message Protocol (ICMP) redirects.'\n  desc \"ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular\n    destination. These messages contain information from the system's route table, possibly revealing portions of the\n    network topology.\"\n  desc 'check', 'Verify the system does not send IPv4 ICMP redirect messages.\n\n     # grep -r net.ipv4.conf.all.send_redirects /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n\nIf \"net.ipv4.conf.all.send_redirects\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the \"all send_redirects\" variables with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.conf.all.send_redirects\n     net.ipv4.conf.all.send_redirects = 0\n\nIf the returned line does not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Configure the system to not allow interfaces to perform IPv4 ICMP redirects.\n    Set the system to the required kernel parameter by adding the following line to \"/etc/sysctl.conf\" or a\n    configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):\n    net.ipv4.conf.all.send_redirects = 0\n    Issue the following command to make the changes take effect:\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72293', 'SV-86917']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204617'\n  tag rid: 'SV-204617r880821_rule'\n  tag stig_id: 'RHEL-07-040660'\n  tag fix_id: 'F-4741r880820_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv4']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n\n    describe kernel_parameter('net.ipv4.conf.all.send_redirects') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204617.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.conf.all.send_redirects","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.conf.all.send_redirects","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.conf.all.send_redirects\"]"}]},{"id":"SV-204618","title":"Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous\n    mode.","desc":"Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system.\n    If unauthorized individuals can access these applications, it may allow then to collect information such as logon\n    IDs, passwords, and key exchanges between systems.\n    If the system is being used to perform a network troubleshooting function, the use of these tools must be documented\n    with the Information System Security Officer (ISSO) and restricted to only authorized personnel.","descriptions":[{"label":"default","data":"Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system.\n    If unauthorized individuals can access these applications, it may allow then to collect information such as logon\n    IDs, passwords, and key exchanges between systems.\n    If the system is being used to perform a network troubleshooting function, the use of these tools must be documented\n    with the Information System Security Officer (ISSO) and restricted to only authorized personnel."},{"label":"check","data":"Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.\n    Check for the status with the following command:\n    # ip link | grep -i promisc\n    If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO\n    and documented, this is a finding."},{"label":"fix","data":"Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented.\n    Set the promiscuous mode of an interface to off with the following command:\n    #ip link set dev <devicename> multicast off promisc off"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72295","SV-86919"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204618","rid":"SV-204618r603261_rule","stig_id":"RHEL-07-040670","fix_id":"F-4742r89047_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["network","ip_link"],"host":null,"container":null},"code":"control 'SV-204618' do\n  title 'Network interfaces configured on the Red Hat Enterprise Linux operating system must not be in promiscuous\n    mode.'\n  desc 'Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system.\n    If unauthorized individuals can access these applications, it may allow then to collect information such as logon\n    IDs, passwords, and key exchanges between systems.\n    If the system is being used to perform a network troubleshooting function, the use of these tools must be documented\n    with the Information System Security Officer (ISSO) and restricted to only authorized personnel.'\n  desc 'check', 'Verify network interfaces are not in promiscuous mode unless approved by the ISSO and documented.\n    Check for the status with the following command:\n    # ip link | grep -i promisc\n    If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO\n    and documented, this is a finding.'\n  desc 'fix', 'Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented.\n    Set the promiscuous mode of an interface to off with the following command:\n    #ip link set dev <devicename> multicast off promisc off'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72295', 'SV-86919']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204618'\n  tag rid: 'SV-204618r603261_rule'\n  tag stig_id: 'RHEL-07-040670'\n  tag fix_id: 'F-4742r89047_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['network', 'ip_link']\n  tag 'host'\n  tag 'container'\n\n  describe command('ip link | grep -i promisc') do\n    its('stdout.strip') { should match(/^$/) }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204618.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `ip link | grep -i promisc` ","run_time":7.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"ip link | grep -i promisc\"]"}]},{"id":"SV-204619","title":"The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.","desc":"If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the\n    purpose of sending spam or other unauthorized activity.","descriptions":[{"label":"default","data":"If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the\n    purpose of sending spam or other unauthorized activity."},{"label":"check","data":"Verify the system is configured to prevent unrestricted mail relaying.\n    Determine if \"postfix\" is installed with the following commands:\n    # yum list installed postfix\n    postfix-2.6.6-6.el7.x86_64.rpm\n    If postfix is not installed, this is Not Applicable.\n    If postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with\n    the following command:\n    # postconf -n smtpd_client_restrictions\n    smtpd_client_restrictions = permit_mynetworks, reject\n    If the \"smtpd_client_restrictions\" parameter contains any entries other than \"permit_mynetworks\" and \"reject\", this\n    is a finding."},{"label":"fix","data":"If \"postfix\" is installed, modify the \"/etc/postfix/main.cf\" file to restrict client connections to\n    the local network with the following command:\n    # postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86921","V-72297"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204619","rid":"SV-204619r603261_rule","stig_id":"RHEL-07-040680","fix_id":"F-4743r89050_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["postfix"],"host":null,"container":null},"code":"control 'SV-204619' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to prevent unrestricted mail relaying.'\n  desc 'If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the\n    purpose of sending spam or other unauthorized activity.'\n  desc 'check', 'Verify the system is configured to prevent unrestricted mail relaying.\n    Determine if \"postfix\" is installed with the following commands:\n    # yum list installed postfix\n    postfix-2.6.6-6.el7.x86_64.rpm\n    If postfix is not installed, this is Not Applicable.\n    If postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with\n    the following command:\n    # postconf -n smtpd_client_restrictions\n    smtpd_client_restrictions = permit_mynetworks, reject\n    If the \"smtpd_client_restrictions\" parameter contains any entries other than \"permit_mynetworks\" and \"reject\", this\n    is a finding.'\n  desc 'fix', %q(If \"postfix\" is installed, modify the \"/etc/postfix/main.cf\" file to restrict client connections to\n    the local network with the following command:\n    # postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject')\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86921', 'V-72297']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204619'\n  tag rid: 'SV-204619r603261_rule'\n  tag stig_id: 'RHEL-07-040680'\n  tag fix_id: 'F-4743r89050_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['postfix']\n  tag 'host'\n  tag 'container'\n\n  if package('postfix').installed?\n    options = { assignment_regex: /^\\s*([^=]*?)\\s*=\\s*(.*?)\\s*$/ }\n\n    if defined? parse_config_file('/etc/postfix/main.cf', options).params['smtpd_client_restrictions']\n      pf_config = parse_config_file('/etc/postfix/main.cf', options).params['smtpd_client_restrictions'].split(',')\n    end\n\n    describe 'Postfix config setting smptd_client_restrictions' do\n      it \"should be set to 'permit_mynetworks', 'reject', or both\" do\n        expect(pf_config).to all satisfy { |x| ['permit_mynetworks', 'reject'].include?(x) }\n      end\n    end\n  else\n    describe 'The `postfix` package is not installed' do\n      skip 'The `postfix` package is not installed, this control is Not Applicable'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204619.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The `postfix` package is not installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The `postfix` package is not installed, this control is Not Applicable","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204620","title":"The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package\n    installed unless needed.","desc":"The FTP service provides an unencrypted remote access that does not provide for the confidentiality and\n    integrity of user passwords or the remote session. If a privileged user were to log on using this service, the\n    privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of\n    this service.","descriptions":[{"label":"default","data":"The FTP service provides an unencrypted remote access that does not provide for the confidentiality and\n    integrity of user passwords or the remote session. If a privileged user were to log on using this service, the\n    privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of\n    this service."},{"label":"check","data":"Verify an FTP server has not been installed on the system.\n    Check to see if an FTP server has been installed with the following commands:\n    # yum list installed vsftpd\n    vsftpd-3.0.2.el7.x86_64.rpm\n    If \"vsftpd\" is installed and is not documented with the Information System Security Officer (ISSO) as an operational\n    requirement, this is a finding."},{"label":"fix","data":"Document the \"vsftpd\" package with the ISSO as an operational requirement or remove it from the system\n    with the following command:\n    # yum remove vsftpd"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86923","V-72299"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204620","rid":"SV-204620r603261_rule","stig_id":"RHEL-07-040690","fix_id":"F-4744r89053_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["vsftpd"],"host":null,"container":null},"code":"control 'SV-204620' do\n  title 'The Red Hat Enterprise Linux operating system must not have a File Transfer Protocol (FTP) server package\n    installed unless needed.'\n  desc 'The FTP service provides an unencrypted remote access that does not provide for the confidentiality and\n    integrity of user passwords or the remote session. If a privileged user were to log on using this service, the\n    privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of\n    this service.'\n  desc 'check', 'Verify an FTP server has not been installed on the system.\n    Check to see if an FTP server has been installed with the following commands:\n    # yum list installed vsftpd\n    vsftpd-3.0.2.el7.x86_64.rpm\n    If \"vsftpd\" is installed and is not documented with the Information System Security Officer (ISSO) as an operational\n    requirement, this is a finding.'\n  desc 'fix', 'Document the \"vsftpd\" package with the ISSO as an operational requirement or remove it from the system\n    with the following command:\n    # yum remove vsftpd'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86923', 'V-72299']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204620'\n  tag rid: 'SV-204620r603261_rule'\n  tag stig_id: 'RHEL-07-040690'\n  tag fix_id: 'F-4744r89053_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['vsftpd']\n  tag 'host'\n  tag 'container'\n\n  describe.one do\n    describe package('vsftpd') do\n      it { should_not be_installed }\n    end\n    describe parse_config_file('/etc/vsftpd/vsftpd.conf') do\n      its('ssl_enable') { should cmp 'YES' }\n      its('force_anon_data_ssl') { should cmp 'YES' }\n      its('force_anon_logins_ssl') { should cmp 'YES' }\n      its('force_local_data_ssl') { should cmp 'YES' }\n      its('force_local_logins_ssl') { should cmp 'YES' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204620.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"System Package vsftpd is expected not to be installed","run_time":0.000123,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"package","resource_params":"[\"vsftpd\"]"}]},{"id":"SV-204621","title":"The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP)\n    server package installed if not required for operational support.","desc":"If TFTP is required for operational support (such as the transmission of router configurations) its use must\n    be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have\n    access control rules established.","descriptions":[{"label":"default","data":"If TFTP is required for operational support (such as the transmission of router configurations) its use must\n    be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have\n    access control rules established."},{"label":"check","data":"Verify a TFTP server has not been installed on the system.\n    Check to see if a TFTP server has been installed with the following command:\n    # yum list installed tftp-server\n    tftp-server-0.49-9.el7.x86_64.rpm\n    If TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding."},{"label":"fix","data":"Remove the TFTP package from the system with the following command:\n    # yum remove tftp-server"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86925","V-72301"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204621","rid":"SV-204621r853996_rule","stig_id":"RHEL-07-040700","fix_id":"F-4745r89056_fix","cci":["CCI-000318","CCI-000368","CCI-001812","CCI-001813","CCI-001814"],"nist":["CM-3 f","CM-6 c","CM-11 (2)","CM-5 (1)","CM-5 (1) (a)"],"subsystems":["tftp"],"host":null,"container":null},"code":"control 'SV-204621' do\n  title 'The Red Hat Enterprise Linux operating system must not have the Trivial File Transfer Protocol (TFTP)\n    server package installed if not required for operational support.'\n  desc 'If TFTP is required for operational support (such as the transmission of router configurations) its use must\n    be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have\n    access control rules established.'\n  desc 'check', 'Verify a TFTP server has not been installed on the system.\n    Check to see if a TFTP server has been installed with the following command:\n    # yum list installed tftp-server\n    tftp-server-0.49-9.el7.x86_64.rpm\n    If TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding.'\n  desc 'fix', 'Remove the TFTP package from the system with the following command:\n    # yum remove tftp-server'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86925', 'V-72301']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204621'\n  tag rid: 'SV-204621r853996_rule'\n  tag stig_id: 'RHEL-07-040700'\n  tag fix_id: 'F-4745r89056_fix'\n  tag cci: ['CCI-000318', 'CCI-000368', 'CCI-001812', 'CCI-001813', 'CCI-001814']\n  tag nist: ['CM-3 f', 'CM-6 c', 'CM-11 (2)', 'CM-5 (1)', 'CM-5 (1) (a)']\n  tag subsystems: ['tftp']\n  tag 'host'\n  tag 'container'\n\n  describe package('tftp-server') do\n    it { should_not be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204621.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package tftp-server","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package tftp-server","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"tftp-server\"]"}]},{"id":"SV-204622","title":"The Red Hat Enterprise Linux operating system must be configured so that remote X connections are disabled\n    except to fulfill documented and validated mission requirements.","desc":"The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack\n    when the SSH client requests forwarding. A system administrator may have a stance in which they want to protect\n    clients that may expose themselves to attack by unwittingly requesting X11 forwarding, which can warrant a ''no''\n    setting.\n    X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host\n    (for the user's X11 authorization database) can access the local X11 display through the forwarded connection. An\n    attacker may then be able to perform activities such as keystroke monitoring if the ForwardX11Trusted option is also\n    enabled.\n    If X11 services are not required for the system's intended function, they should be disabled or restricted as\n    appropriate to the system’s needs.","descriptions":[{"label":"default","data":"The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack\n    when the SSH client requests forwarding. A system administrator may have a stance in which they want to protect\n    clients that may expose themselves to attack by unwittingly requesting X11 forwarding, which can warrant a ''no''\n    setting.\n    X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host\n    (for the user's X11 authorization database) can access the local X11 display through the forwarded connection. An\n    attacker may then be able to perform activities such as keystroke monitoring if the ForwardX11Trusted option is also\n    enabled.\n    If X11 services are not required for the system's intended function, they should be disabled or restricted as\n    appropriate to the system’s needs."},{"label":"check","data":"Determine if X11Forwarding is disabled with the following command:\n    # grep -i x11forwarding /etc/ssh/sshd_config | grep -v \"^#\"\n    X11Forwarding no\n    If the \"X11Forwarding\" keyword is set to \"yes\" and is not documented with the Information System Security Officer\n    (ISSO) as an operational requirement or is missing, this is a finding."},{"label":"fix","data":"Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"X11Forwarding\" keyword and\n    set its value to \"no\" (this file may be named differently or be in a different location if using a version of SSH\n    that is provided by a third-party vendor):\n    X11Forwarding no\n    The SSH service must be restarted for changes to take effect:\n    # systemctl restart sshd"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86927","V-72303"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204622","rid":"SV-204622r603849_rule","stig_id":"RHEL-07-040710","fix_id":"F-4746r622312_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-204622' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that remote X connections are disabled\n    except to fulfill documented and validated mission requirements.'\n  desc \"The security risk of using X11 forwarding is that the client's X11 display server may be exposed to attack\n    when the SSH client requests forwarding. A system administrator may have a stance in which they want to protect\n    clients that may expose themselves to attack by unwittingly requesting X11 forwarding, which can warrant a ''no''\n    setting.\n    X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host\n    (for the user's X11 authorization database) can access the local X11 display through the forwarded connection. An\n    attacker may then be able to perform activities such as keystroke monitoring if the ForwardX11Trusted option is also\n    enabled.\n    If X11 services are not required for the system's intended function, they should be disabled or restricted as\n    appropriate to the system’s needs.\"\n  desc 'check', 'Determine if X11Forwarding is disabled with the following command:\n    # grep -i x11forwarding /etc/ssh/sshd_config | grep -v \"^#\"\n    X11Forwarding no\n    If the \"X11Forwarding\" keyword is set to \"yes\" and is not documented with the Information System Security Officer\n    (ISSO) as an operational requirement or is missing, this is a finding.'\n  desc 'fix', 'Edit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"X11Forwarding\" keyword and\n    set its value to \"no\" (this file may be named differently or be in a different location if using a version of SSH\n    that is provided by a third-party vendor):\n    X11Forwarding no\n    The SSH service must be restarted for changes to take effect:\n    # systemctl restart sshd'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86927', 'V-72303']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204622'\n  tag rid: 'SV-204622r603849_rule'\n  tag stig_id: 'RHEL-07-040710'\n  tag fix_id: 'F-4746r622312_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('X11Forwarding') { should cmp 'no' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204622.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-204623","title":"The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer\n    Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.","desc":"Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting\n    system files.","descriptions":[{"label":"default","data":"Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting\n    system files."},{"label":"check","data":"Verify the TFTP daemon is configured to operate in secure mode.\n    Check to see if a TFTP server has been installed with the following commands:\n    # yum list installed tftp-server\n    tftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms\n    If a TFTP server is not installed, this is Not Applicable.\n    If a TFTP server is installed, check for the server arguments with the following command:\n    # grep server_args /etc/xinetd.d/tftp\n    server_args = -s /var/lib/tftpboot\n    If the \"server_args\" line does not have a \"-s\" option and a subdirectory is not assigned, this is a finding."},{"label":"fix","data":"Configure the TFTP daemon to operate in secure mode by adding the following line to\n    \"/etc/xinetd.d/tftp\" (or modify the line to have the required value):\n    server_args = -s /var/lib/tftpboot"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86929","V-72305"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204623","rid":"SV-204623r603261_rule","stig_id":"RHEL-07-040720","fix_id":"F-4747r89062_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["tftp"],"host":null,"container":null},"code":"control 'SV-204623' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that if the Trivial File Transfer\n    Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.'\n  desc 'Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting\n    system files.'\n  desc 'check', 'Verify the TFTP daemon is configured to operate in secure mode.\n    Check to see if a TFTP server has been installed with the following commands:\n    # yum list installed tftp-server\n    tftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms\n    If a TFTP server is not installed, this is Not Applicable.\n    If a TFTP server is installed, check for the server arguments with the following command:\n    # grep server_args /etc/xinetd.d/tftp\n    server_args = -s /var/lib/tftpboot\n    If the \"server_args\" line does not have a \"-s\" option and a subdirectory is not assigned, this is a finding.'\n  desc 'fix', 'Configure the TFTP daemon to operate in secure mode by adding the following line to\n    \"/etc/xinetd.d/tftp\" (or modify the line to have the required value):\n    server_args = -s /var/lib/tftpboot'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86929', 'V-72305']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204623'\n  tag rid: 'SV-204623r603261_rule'\n  tag stig_id: 'RHEL-07-040720'\n  tag fix_id: 'F-4747r89062_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['tftp']\n  tag 'host'\n  tag 'container'\n\n  if package('tftp-server').installed?\n    impact 0.5\n    describe command('grep server_args /etc/xinetd.d/tftp') do\n      its('stdout.strip') do\n        should match %r{^\\s*server_args\\s+=\\s+(-s|--secure)\\s(/\\S+)$}\n      end\n    end\n  else\n    impact 0.0\n    describe 'The TFTP package is not installed' do\n      skip 'If a TFTP server is not installed, this is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204623.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The TFTP package is not installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"If a TFTP server is not installed, this is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204624","title":"The Red Hat Enterprise Linux operating system must not have a graphical display manager installed unless\n    approved.","desc":"Internet services that are not required for system or application processes must not be active to decrease\n    the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and\n    must not be used unless approved and documented.","descriptions":[{"label":"default","data":"Internet services that are not required for system or application processes must not be active to decrease\n    the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and\n    must not be used unless approved and documented."},{"label":"check","data":"Verify the system is configured to boot to the command line:\n    $ systemctl get-default\n    multi-user.target\n    If the system default target is not set to \"multi-user.target\" and the Information System Security Officer (ISSO)\n    lacks a documented requirement for a graphical user interface, this is a finding.\n    Verify a graphical user interface is not installed:\n    $ rpm -qa | grep xorg | grep server\n    Ask the System Administrator if use of a graphical user interface is an operational requirement.\n    If the use of a graphical user interface on the system is not documented with the ISSO, this is a finding."},{"label":"fix","data":"Document the requirement for a graphical user interface with the ISSO or reinstall the operating\n    system without the graphical user interface. If reinstallation is not feasible, then continue with the following\n    procedure:\n    Open an SSH session and enter the following commands:\n    $ sudo systemctl set-default multi-user.target\n    $ sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils\n    A reboot is required for the changes to take effect."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86931","V-72307"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204624","rid":"SV-204624r646847_rule","stig_id":"RHEL-07-040730","fix_id":"F-36316r646846_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["gui"],"host":null},"code":"control 'SV-204624' do\n  title 'The Red Hat Enterprise Linux operating system must not have a graphical display manager installed unless\n    approved.'\n  desc 'Internet services that are not required for system or application processes must not be active to decrease\n    the attack surface of the system. Graphical display managers have a long history of security vulnerabilities and\n    must not be used unless approved and documented.'\n  desc 'check', 'Verify the system is configured to boot to the command line:\n    $ systemctl get-default\n    multi-user.target\n    If the system default target is not set to \"multi-user.target\" and the Information System Security Officer (ISSO)\n    lacks a documented requirement for a graphical user interface, this is a finding.\n    Verify a graphical user interface is not installed:\n    $ rpm -qa | grep xorg | grep server\n    Ask the System Administrator if use of a graphical user interface is an operational requirement.\n    If the use of a graphical user interface on the system is not documented with the ISSO, this is a finding.'\n  desc 'fix', 'Document the requirement for a graphical user interface with the ISSO or reinstall the operating\n    system without the graphical user interface. If reinstallation is not feasible, then continue with the following\n    procedure:\n    Open an SSH session and enter the following commands:\n    $ sudo systemctl set-default multi-user.target\n    $ sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils\n    A reboot is required for the changes to take effect.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86931', 'V-72307']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204624'\n  tag rid: 'SV-204624r646847_rule'\n  tag stig_id: 'RHEL-07-040730'\n  tag fix_id: 'F-36316r646846_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['gui']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  elsif input('x11-enabled')\n    describe 'System default target' do\n      subject { command('systemctl get-default').stdout.strip }\n      it { should eq 'multi-user.target' }\n    end\n\n    describe 'No GUI packages should be installed' do\n      subject { packages(/xorg.*server/) }\n      its('statuses') { should_not cmp 'installed' }\n    end\n  else\n    describe 'GUI permitted' do\n      skip 'Not applicable -- GUI packages are allowed to be installed on this system'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204624.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"System default target is expected to eq \"multi-user.target\"","run_time":0.000233,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: \"multi-user.target\"\n     got: \"\"\n\n(compared using ==)\n","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"No GUI packages should be installed statuses is expected not to cmp == \"installed\"","run_time":0.004393,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204625","title":"The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is\n    a router.","desc":"Routing protocol daemons are typically used on routers to exchange network topology information with other\n    routers. If this software is used when not required, system network information may be unnecessarily transmitted\n    across the network.","descriptions":[{"label":"default","data":"Routing protocol daemons are typically used on routers to exchange network topology information with other\n    routers. If this software is used when not required, system network information may be unnecessarily transmitted\n    across the network."},{"label":"check","data":"Verify the system is not performing packet forwarding, unless the system is a router.\n\n     # grep -r net.ipv4.ip_forward /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.ip_forward = 0\n\nIf \"net.ipv4.ip_forward\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system does not implement IP forwarding using the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.ip_forward\n     net.ipv4.ip_forward = 0\n\nIf IP forwarding value is \"1\" and the system is hosting any application, database, or web servers, this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.ip_forward = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86933","V-72309"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204625","rid":"SV-204625r880824_rule","stig_id":"RHEL-07-040740","fix_id":"F-4749r880823_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter"],"host":null},"code":"control 'SV-204625' do\n  title 'The Red Hat Enterprise Linux operating system must not be performing packet forwarding unless the system is\n    a router.'\n  desc 'Routing protocol daemons are typically used on routers to exchange network topology information with other\n    routers. If this software is used when not required, system network information may be unnecessarily transmitted\n    across the network.'\n  desc 'check', 'Verify the system is not performing packet forwarding, unless the system is a router.\n\n     # grep -r net.ipv4.ip_forward /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv4.ip_forward = 0\n\nIf \"net.ipv4.ip_forward\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system does not implement IP forwarding using the following command:\n\n     # /sbin/sysctl -a | grep net.ipv4.ip_forward\n     net.ipv4.ip_forward = 0\n\nIf IP forwarding value is \"1\" and the system is hosting any application, database, or web servers, this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter by adding the following\nline to \"/etc/sysctl.conf\" or a configuration file in the /etc/sysctl.d/\ndirectory (or modify the line to have the required value):\n\n    net.ipv4.ip_forward = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86933', 'V-72309']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204625'\n  tag rid: 'SV-204625r880824_rule'\n  tag stig_id: 'RHEL-07-040740'\n  tag fix_id: 'F-4749r880823_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe kernel_parameter('net.ipv4.ip_forward') do\n      its('value') { should eq 0 }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204625.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Kernel Parameter net.ipv4.ip_forward","run_time":7.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Kernel Parameter net.ipv4.ip_forward","skip_message":"The `kernel_parameter` resource is not supported on your OS.","resource_class":"kernel_parameter","resource_params":"[\"net.ipv4.ip_forward\"]"}]},{"id":"SV-204626","title":"The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is\n    configured to use RPCSEC_GSS.","desc":"When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle\n    requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The\n    RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate\n    the remote mount request.","descriptions":[{"label":"default","data":"When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle\n    requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The\n    RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate\n    the remote mount request."},{"label":"check","data":"Verify \"AUTH_GSS\" is being used to authenticate NFS mounts.\n    To check if the system is importing an NFS file system, look for any entries in the \"/etc/fstab\" file that have a\n    file system type of \"nfs\" with the following command:\n    # cat /etc/fstab | grep nfs\n    192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p\n    If the system is mounting file systems via NFS and has the sec option without the \"krb5:krb5i:krb5p\" settings, the\n    \"sec\" option has the \"sys\" setting, or the \"sec\" option is missing, this is a finding."},{"label":"fix","data":"Update the \"/etc/fstab\" file so the option \"sec\" is defined for each NFS mounted file system and the\n    \"sec\" option does not have the \"sys\" setting.\n    Ensure the \"sec\" option is defined as \"krb5:krb5i:krb5p\"."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86935","V-72311"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204626","rid":"SV-204626r603261_rule","stig_id":"RHEL-07-040750","fix_id":"F-4750r89071_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["nfs","etc_fstab"],"host":null,"container":null},"code":"control 'SV-204626' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the Network File System (NFS) is\n    configured to use RPCSEC_GSS.'\n  desc 'When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle\n    requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The\n    RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate\n    the remote mount request.'\n  desc 'check', 'Verify \"AUTH_GSS\" is being used to authenticate NFS mounts.\n    To check if the system is importing an NFS file system, look for any entries in the \"/etc/fstab\" file that have a\n    file system type of \"nfs\" with the following command:\n    # cat /etc/fstab | grep nfs\n    192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p\n    If the system is mounting file systems via NFS and has the sec option without the \"krb5:krb5i:krb5p\" settings, the\n    \"sec\" option has the \"sys\" setting, or the \"sec\" option is missing, this is a finding.'\n  desc 'fix', 'Update the \"/etc/fstab\" file so the option \"sec\" is defined for each NFS mounted file system and the\n    \"sec\" option does not have the \"sys\" setting.\n    Ensure the \"sec\" option is defined as \"krb5:krb5i:krb5p\".'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86935', 'V-72311']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204626'\n  tag rid: 'SV-204626r603261_rule'\n  tag stig_id: 'RHEL-07-040750'\n  tag fix_id: 'F-4750r89071_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['nfs', 'etc_fstab']\n  tag 'host'\n  tag 'container'\n\n  nfs_systems = etc_fstab.nfs_file_systems.entries\n  if !nfs_systems.nil? and !nfs_systems.empty?\n    nfs_systems.each do |file_system|\n      describe file_system do\n        its('mount_options') { should include 'sec=krb5:krb5i:krb5p' }\n      end\n    end\n  else\n    describe 'No NFS file systems were found.' do\n      subject { nfs_systems.nil? or nfs_systems.empty? }\n      it { should eq true }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204626.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"No NFS file systems were found. is expected to eq true","run_time":0.000168,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204627","title":"SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.","desc":"Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed\n    to maintain security. If the service is running with the default authenticators, anyone can gather data about the\n    system and the network and use the information to potentially compromise the integrity of the system or network(s).\n    It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the\n    version 2 community strings.","descriptions":[{"label":"default","data":"Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed\n    to maintain security. If the service is running with the default authenticators, anyone can gather data about the\n    system and the network and use the information to potentially compromise the integrity of the system or network(s).\n    It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the\n    version 2 community strings."},{"label":"check","data":"Verify that a system using SNMP is not using default community strings.\n    Check to see if the \"/etc/snmp/snmpd.conf\" file exists with the following command:\n    # ls -al /etc/snmp/snmpd.conf\n    -rw-------   1 root root      52640 Mar 12 11:08 snmpd.conf\n    If the file does not exist, this is Not Applicable.\n    If the file does exist, check for the default community strings with the following commands:\n    # grep public /etc/snmp/snmpd.conf\n    # grep private /etc/snmp/snmpd.conf\n    If either of these commands returns any output, this is a finding."},{"label":"fix","data":"If the \"/etc/snmp/snmpd.conf\" file exists, modify any lines that contain a community string value of\n    \"public\" or \"private\" to another string value."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86937","V-72313"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204627","rid":"SV-204627r603261_rule","stig_id":"RHEL-07-040800","fix_id":"F-4751r89074_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["snmp"],"host":null,"container":null},"code":"control 'SV-204627' do\n  title 'SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default.'\n  desc 'Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed\n    to maintain security. If the service is running with the default authenticators, anyone can gather data about the\n    system and the network and use the information to potentially compromise the integrity of the system or network(s).\n    It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the\n    version 2 community strings.'\n  desc 'check', 'Verify that a system using SNMP is not using default community strings.\n    Check to see if the \"/etc/snmp/snmpd.conf\" file exists with the following command:\n    # ls -al /etc/snmp/snmpd.conf\n    -rw-------   1 root root      52640 Mar 12 11:08 snmpd.conf\n    If the file does not exist, this is Not Applicable.\n    If the file does exist, check for the default community strings with the following commands:\n    # grep public /etc/snmp/snmpd.conf\n    # grep private /etc/snmp/snmpd.conf\n    If either of these commands returns any output, this is a finding.'\n  desc 'fix', 'If the \"/etc/snmp/snmpd.conf\" file exists, modify any lines that contain a community string value of\n    \"public\" or \"private\" to another string value.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86937', 'V-72313']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204627'\n  tag rid: 'SV-204627r603261_rule'\n  tag stig_id: 'RHEL-07-040800'\n  tag fix_id: 'F-4751r89074_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['snmp']\n  tag 'host'\n  tag 'container'\n\n  if file('/etc/snmp/snmpd.conf').exist?\n    impact 0.7\n    processed = []\n    to_process = ['/etc/snmp/snmpd.conf']\n\n    until to_process.empty?\n      in_process = to_process.pop\n      next if processed.include? in_process\n\n      processed.push in_process\n\n      if file(in_process).directory?\n        to_process.concat(\n          command(\"find #{in_process} -maxdepth 1 -mindepth 1 -name '*.conf'\")\n            .stdout.strip.split(\"\\n\")\n            .select do |f|\n            file(f).file?\n          end\n        )\n      elsif file(in_process).file?\n        to_process.concat(\n          command(\"grep -E '^\\\\s*includeFile\\\\s+' #{in_process} | sed 's/^[[:space:]]*includeFile[[:space:]]*//g'\")\n            .stdout.strip.split(/\\n+/)\n            .map do |f|\n            if f.start_with?('/')\n              f\n            else\n              File.join(\n                File.dirname(in_process), f\n              )\n            end\n          end\n            .select do |f|\n            file(f).file?\n          end\n        )\n        to_process.concat(\n          command(\"grep -E '^\\\\s*includeDir\\\\s+' #{in_process} | sed 's/^[[:space:]]*includeDir[[:space:]]*//g'\")\n            .stdout.strip.split(/\\n+/)\n            .map { |f|\n            f.start_with?('/') ? f : File.join('/', f)\n          }               # relative dirs are treated as absolute\n            .select do |f|\n            file(f).directory?\n          end\n        )\n      end\n    end\n\n    config_files = processed.select { |f| file(f).file? }\n\n    config_files.each do |config|\n      describe file(config) do\n        its('content') { should_not match(/^[^#]*(public|private)/) }\n      end\n    end\n  else\n    impact 0.0\n    describe 'The `snmpd.conf` does not exist' do\n      skip 'The snmpd.conf file does not exist, this control is Not Applicable'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204627.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The `snmpd.conf` does not exist","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The snmpd.conf file does not exist, this control is Not Applicable","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204628","title":"The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny\n    system access to specific hosts and services.","desc":"If the systems access control program is not configured with appropriate rules for allowing and denying\n    access to system network resources, services may be accessible to unauthorized hosts.","descriptions":[{"label":"default","data":"If the systems access control program is not configured with appropriate rules for allowing and denying\n    access to system network resources, services may be accessible to unauthorized hosts."},{"label":"check","data":"If the \"firewalld\" package is not installed, ask the System Administrator (SA) if another firewall\n    application (such as iptables) is installed. If an application firewall is not installed, this is a finding.\n    Verify the system's access control program is configured to grant or deny system access to specific hosts.\n    Check to see if \"firewalld\" is active with the following command:\n    # systemctl status firewalld\n    firewalld.service - firewalld - dynamic firewall daemon\n    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\n    Active: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago\n    If \"firewalld\" is active, check to see if it is configured to grant or deny access to specific hosts or services\n    with the following commands:\n    # firewall-cmd --get-default-zone\n    public\n    # firewall-cmd --list-all --zone=public\n    public (active)\n    target: default\n    icmp-block-inversion: no\n    interfaces: eth0\n    sources:\n    services: mdns ssh\n    ports:\n    protocols:\n    masquerade: no\n    forward-ports:\n    icmp-blocks:\n    If \"firewalld\" is not active, determine whether \"tcpwrappers\" is being used by checking whether the \"hosts.allow\"\n    and \"hosts.deny\" files are empty with the following commands:\n    # ls -al /etc/hosts.allow\n    rw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow\n    # ls -al /etc/hosts.deny\n    -rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny\n    If \"firewalld\" and \"tcpwrappers\" are not installed, configured, and active, ask the SA if another access control\n    program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or\n    denies access to specific hosts or services.\n    If \"firewalld\" is active and is not configured to grant access to specific hosts or \"tcpwrappers\" is not configured\n    to grant or deny access to specific hosts, this is a finding."},{"label":"fix","data":"If \"firewalld\" is installed and active on the system, configure rules for allowing specific services\n    and hosts.\n    If \"firewalld\" is not \"active\", enable \"tcpwrappers\" by configuring \"/etc/hosts.allow\" and \"/etc/hosts.deny\" to\n    allow or deny access to specific hosts."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86939","V-72315"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204628","rid":"SV-204628r603261_rule","stig_id":"RHEL-07-040810","fix_id":"F-4752r89077_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["iptables","firewall"],"host":null,"container":null},"code":"control 'SV-204628' do\n  title 'The Red Hat Enterprise Linux operating system access control program must be configured to grant or deny\n    system access to specific hosts and services.'\n  desc 'If the systems access control program is not configured with appropriate rules for allowing and denying\n    access to system network resources, services may be accessible to unauthorized hosts.'\n  desc 'check', %q(If the \"firewalld\" package is not installed, ask the System Administrator (SA) if another firewall\n    application (such as iptables) is installed. If an application firewall is not installed, this is a finding.\n    Verify the system's access control program is configured to grant or deny system access to specific hosts.\n    Check to see if \"firewalld\" is active with the following command:\n    # systemctl status firewalld\n    firewalld.service - firewalld - dynamic firewall daemon\n    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)\n    Active: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago\n    If \"firewalld\" is active, check to see if it is configured to grant or deny access to specific hosts or services\n    with the following commands:\n    # firewall-cmd --get-default-zone\n    public\n    # firewall-cmd --list-all --zone=public\n    public (active)\n    target: default\n    icmp-block-inversion: no\n    interfaces: eth0\n    sources:\n    services: mdns ssh\n    ports:\n    protocols:\n    masquerade: no\n    forward-ports:\n    icmp-blocks:\n    If \"firewalld\" is not active, determine whether \"tcpwrappers\" is being used by checking whether the \"hosts.allow\"\n    and \"hosts.deny\" files are empty with the following commands:\n    # ls -al /etc/hosts.allow\n    rw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow\n    # ls -al /etc/hosts.deny\n    -rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny\n    If \"firewalld\" and \"tcpwrappers\" are not installed, configured, and active, ask the SA if another access control\n    program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or\n    denies access to specific hosts or services.\n    If \"firewalld\" is active and is not configured to grant access to specific hosts or \"tcpwrappers\" is not configured\n    to grant or deny access to specific hosts, this is a finding.)\n  desc 'fix', 'If \"firewalld\" is installed and active on the system, configure rules for allowing specific services\n    and hosts.\n    If \"firewalld\" is not \"active\", enable \"tcpwrappers\" by configuring \"/etc/hosts.allow\" and \"/etc/hosts.deny\" to\n    allow or deny access to specific hosts.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86939', 'V-72315']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204628'\n  tag rid: 'SV-204628r603261_rule'\n  tag stig_id: 'RHEL-07-040810'\n  tag fix_id: 'F-4752r89077_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['iptables', 'firewall']\n  tag 'host'\n  tag 'container'\n\n  if input('firewall_application_package') != ''\n    describe 'Manual review of third-party firewall needed' do\n      skip \"A manual review of firewall application \\'#{input('firewall_application_package')}\\' is needed to determine if it is properly configured\"\n    end\n  else\n\n    firewalld_services = input('firewalld_services')\n    firewalld_hosts_allow = input('firewalld_hosts_allow')\n    firewalld_hosts_deny = input('firewalld_hosts_deny')\n    firewalld_ports_allow = input('firewalld_ports_allow')\n    firewalld_ports_deny = input('firewalld_ports_deny')\n    tcpwrappers_allow = input('tcpwrappers_allow')\n    tcpwrappers_deny = input('tcpwrappers_deny')\n    iptable_rules = input('iptables_rules')\n\n    if service('firewalld').running?\n      @default_zone = firewalld.default_zone\n\n      describe firewalld.where { zone = @default_zone } do\n        its('services') { should be_in firewalld_services }\n      end\n\n      describe firewalld do\n        firewalld_hosts_allow.each do |rule|\n          it { should have_rule_enabled(rule) }\n        end\n        firewalld_hosts_deny.each do |rule|\n          it { should_not have_rule_enabled(rule) }\n        end\n        firewalld_ports_allow.each do |port|\n          it { should have_port_enabled_in_zone(port) }\n        end\n        firewalld_ports_deny.each do |port|\n          it { should_not have_port_enabled_in_zone(port) }\n        end\n      end\n    elsif service('iptables').running?\n      describe iptables do\n        iptable_rules.each do |rule|\n          it { should have_rule(rule) }\n        end\n      end\n    else\n      describe package('tcp_wrappers') do\n        it { should be_installed }\n      end\n      tcpwrappers_allow.each do |rule|\n        describe etc_hosts_allow.where { daemon == rule['daemon'] } do\n          its('client_list') { should be rule['client_list'] }\n          its('options') { should be rule['options'] }\n        end\n      end\n      tcpwrappers_deny.each do |rule|\n        describe etc_hosts_deny.where { daemon == rule['daemon'] } do\n          its('client_list') { should be rule['client_list'] }\n          its('options') { should be rule['options'] }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204628.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package tcp_wrappers","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package tcp_wrappers","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"tcp_wrappers\"]"}]},{"id":"SV-204629","title":"The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.","desc":"IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be\n    documented with the Information System Security Officer (ISSO).","descriptions":[{"label":"default","data":"IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be\n    documented with the Information System Security Officer (ISSO)."},{"label":"check","data":"Verify the system does not have unauthorized IP tunnels configured.\n    Check to see if \"libreswan\" is installed with the following command:\n    # yum list installed libreswan\n    libreswan.x86-64 3.20-5.el7_4\n    If \"libreswan\" is installed, check to see if the \"IPsec\" service is active with the following command:\n    # systemctl status ipsec\n    ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec\n    Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)\n    Active: inactive (dead)\n    If the \"IPsec\" service is active, check to see if any tunnels are configured in \"/etc/ipsec.conf\" and\n    \"/etc/ipsec.d/\" with the following commands:\n    # grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf\n    If there are indications that a \"conn\" parameter is configured for a tunnel, ask the System Administrator if the\n    tunnel is documented with the ISSO.\n    If \"libreswan\" is installed, \"IPsec\" is active, and an undocumented tunnel is active, this is a finding."},{"label":"fix","data":"Remove all unapproved tunnels from the system, or document them with the ISSO."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72317","SV-86941"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204629","rid":"SV-204629r603261_rule","stig_id":"RHEL-07-040820","fix_id":"F-4753r89080_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["libreswan","ipsec"],"host":null,"container":null},"code":"control 'SV-204629' do\n  title 'The Red Hat Enterprise Linux operating system must not have unauthorized IP tunnels configured.'\n  desc 'IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be\n    documented with the Information System Security Officer (ISSO).'\n  desc 'check', 'Verify the system does not have unauthorized IP tunnels configured.\n    Check to see if \"libreswan\" is installed with the following command:\n    # yum list installed libreswan\n    libreswan.x86-64 3.20-5.el7_4\n    If \"libreswan\" is installed, check to see if the \"IPsec\" service is active with the following command:\n    # systemctl status ipsec\n    ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec\n    Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled)\n    Active: inactive (dead)\n    If the \"IPsec\" service is active, check to see if any tunnels are configured in \"/etc/ipsec.conf\" and\n    \"/etc/ipsec.d/\" with the following commands:\n    # grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf\n    If there are indications that a \"conn\" parameter is configured for a tunnel, ask the System Administrator if the\n    tunnel is documented with the ISSO.\n    If \"libreswan\" is installed, \"IPsec\" is active, and an undocumented tunnel is active, this is a finding.'\n  desc 'fix', 'Remove all unapproved tunnels from the system, or document them with the ISSO.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72317', 'SV-86941']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204629'\n  tag rid: 'SV-204629r603261_rule'\n  tag stig_id: 'RHEL-07-040820'\n  tag fix_id: 'F-4753r89080_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['libreswan', 'ipsec']\n  tag 'host'\n  tag 'container'\n\n  approved_tunnels = input('approved_tunnels')\n\n  if package('libreswan').installed? && service('ipsec.service').running?\n    impact 0.5\n    processed = []\n    to_process = ['/etc/ipsec.conf']\n\n    until to_process.empty?\n      in_process = to_process.pop\n      next if processed.include? in_process\n\n      processed.push in_process\n\n      to_process.concat(\n        command(\"grep -E '^\\\\s*include\\\\s+' #{in_process} | sed 's/^[[:space:]]*include[[:space:]]*//g'\")\n          .stdout.strip.split(/\\s*\\n+\\s*/)\n          .map do |f|\n          if f.start_with?('/')\n            f\n          else\n            File.join(\n              File.dirname(in_process), f\n            )\n          end\n        end\n          .map do |f|\n            dir = f.sub(%r{[^/]*[*?\\[].*$}, '') # gets the longest ancestor path which doesn't contain wildcards\n            command(\"find #{dir} -wholename '#{f}'\").stdout.strip.split(\"\\n\")\n          end\n          .flatten\n          .select do |f|\n          file(f).file?\n        end\n      )\n    end\n\n    conn_grep = processed.map do |conf|\n      command(\"grep -E '^\\\\s*conn\\\\s+' #{conf}\")\n        .stdout.strip.split(/\\s*\\n\\s*/)\n    end.flatten\n\n    describe conn_grep do\n      it { should all(be_in(approved_tunnels)) }\n    end\n  else\n    impact 0.0\n    describe \"The system does not have libreswan installed or the ipsec.service isn't running\" do\n      skip \"The system does not have libreswan installed or the ipsec.service isn't running, this requirement is Not Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204629.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have libreswan installed or the ipsec.service isn't running","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have libreswan installed or the ipsec.service isn't running, this requirement is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204630","title":"The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.","desc":"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the\n    system is functioning as a router.","descriptions":[{"label":"default","data":"Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the\n    system is functioning as a router."},{"label":"check","data":"If IPv6 is not enabled, the key will not exist, and this is Not Applicable.\n\nVerify the system does not accept IPv6 source-routed packets.\n\n     # grep -r net.ipv6.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv6.conf.all.accept_source_route = 0\n\nIf \"net.ipv6.conf.all.accept_source_route\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route\n     net.ipv6.conf.all.accept_source_route = 0\n\nIf the returned lines do not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Set the system to the required kernel parameter, if IPv6 is enabled, by\nadding the following line to \"/etc/sysctl.conf\" or a configuration file in\nthe /etc/sysctl.d/ directory (or modify the line to have the required value):\n\n    net.ipv6.conf.all.accept_source_route = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72319","SV-86943"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-204630","rid":"SV-204630r880827_rule","stig_id":"RHEL-07-040830","fix_id":"F-4754r880826_fix","cci":["CCI-000366"],"nist":["CM-6 b"],"subsystems":["kernel_parameter","ipv6"],"host":null,"container":null},"code":"control 'SV-204630' do\n  title 'The Red Hat Enterprise Linux operating system must not forward IPv6 source-routed packets.'\n  desc 'Source-routed packets allow the source of the packet to suggest that routers forward the packet along a\n    different path than configured on the router, which can be used to bypass network security measures. This\n    requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the\n    system is functioning as a router.'\n  desc 'check', 'If IPv6 is not enabled, the key will not exist, and this is Not Applicable.\n\nVerify the system does not accept IPv6 source-routed packets.\n\n     # grep -r net.ipv6.conf.all.accept_source_route /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     net.ipv6.conf.all.accept_source_route = 0\n\nIf \"net.ipv6.conf.all.accept_source_route\" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out or does not have a value of \"0\", this is a finding.\n\nCheck that the operating system implements the accept source route variable with the following command:\n\n     # /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route\n     net.ipv6.conf.all.accept_source_route = 0\n\nIf the returned lines do not have a value of \"0\", this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Set the system to the required kernel parameter, if IPv6 is enabled, by\nadding the following line to \"/etc/sysctl.conf\" or a configuration file in\nthe /etc/sysctl.d/ directory (or modify the line to have the required value):\n\n    net.ipv6.conf.all.accept_source_route = 0\n\n    Issue the following command to make the changes take effect:\n\n    # sysctl --system'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72319', 'SV-86943']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-204630'\n  tag rid: 'SV-204630r880827_rule'\n  tag stig_id: 'RHEL-07-040830'\n  tag fix_id: 'F-4754r880826_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n  tag subsystems: ['kernel_parameter', 'ipv6']\n  tag 'host'\n  tag 'container'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - Kernel config must be done on the host' do\n      skip 'Control not applicable - Kernel config must be done on the host'\n    end\n  else\n    describe.one do\n      describe kernel_parameter('net.ipv6.conf.all.accept_source_route') do\n        its('value') { should eq 0 }\n      end\n      # If IPv6 is disabled in the kernel it will return NIL\n      describe kernel_parameter('net.ipv6.conf.all.accept_source_route') do\n        its('value') { should eq nil }\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204630.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Kernel Parameter net.ipv6.conf.all.accept_source_route value is expected to eq nil","run_time":0.000204,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"kernel_parameter","resource_params":"[\"net.ipv6.conf.all.accept_source_route\"]"}]},{"id":"SV-204631","title":"The Red Hat Enterprise Linux operating system must have the required packages for multifactor\n    authentication installed.","desc":"Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management).","descriptions":[{"label":"default","data":"Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management)."},{"label":"check","data":"Verify the operating system has the packages required for multifactor authentication installed.\n    Check for the presence of the packages required to support multifactor authentication with the following commands:\n    # yum list installed pam_pkcs11\n    pam_pkcs11-0.6.2-14.el7.noarch.rpm\n    If the \"pam_pkcs11\" package is not installed, this is a finding."},{"label":"fix","data":"Configure the operating system to implement multifactor authentication by installing the required packages.\n\nInstall the pam_pkcs11 package with the following command:\n\n# yum install pam_pkcs11"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-87041","V-72417"],"severity":"medium","gtitle":"SRG-OS-000375-GPOS-00160","satisfies":["SRG-OS-000375-GPOS-00160","SRG-OS-000375-GPOS-00161","SRG-OS-000375-GPOS-00162"],"gid":"V-204631","rid":"SV-204631r853997_rule","stig_id":"RHEL-07-041001","fix_id":"F-4755r462473_fix","cci":["CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (11)","IA-2 (12)","IA-2 (12)"],"subsystems":["MFA","smartcard"],"host":null},"code":"control 'SV-204631' do\n  title 'The Red Hat Enterprise Linux operating system must have the required packages for multifactor\n    authentication installed.'\n  desc 'Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management).'\n  desc 'check', 'Verify the operating system has the packages required for multifactor authentication installed.\n    Check for the presence of the packages required to support multifactor authentication with the following commands:\n    # yum list installed pam_pkcs11\n    pam_pkcs11-0.6.2-14.el7.noarch.rpm\n    If the \"pam_pkcs11\" package is not installed, this is a finding.'\n  desc 'fix', 'Configure the operating system to implement multifactor authentication by installing the required packages.\n\nInstall the pam_pkcs11 package with the following command:\n\n# yum install pam_pkcs11'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-87041', 'V-72417']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000375-GPOS-00160'\n  tag satisfies: ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']\n  tag gid: 'V-204631'\n  tag rid: 'SV-204631r853997_rule'\n  tag stig_id: 'RHEL-07-041001'\n  tag fix_id: 'F-4755r462473_fix'\n  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']\n  tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']\n  tag subsystems: ['MFA', 'smartcard']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    mfa_pkg_list = input('mfa_pkg_list')\n    smart_card_status = input('smart_card_status')\n\n    if smart_card_status.eql?('disabled')\n      impact 0.5\n      describe 'The system is not smartcard enabled thus this control is Not Applicable' do\n        skip 'The system is not using Smartcards / PIVs to fulfil the MFA requirement, this control is Not Applicable.'\n      end\n    elsif mfa_pkg_list.empty?\n      describe 'The required Smartcard packages have not beed defined, plese define them in your `inputs`.' do\n        subject { mfa_pkg_list }\n        it { should_not be_empty }\n      end\n    else\n      mfa_pkg_list.each do |pkg|\n        describe 'The package' do\n          subject { package(pkg.to_s) }\n          it { should be_installed }\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204631.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000313,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package nss-tools` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000243,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package nss-pam-ldapd` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000449,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package esc` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000227,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package pam_pkcs11` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000223,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package pam_krb5` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000222,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package opensc` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000238,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package pcsc-lite-ccid` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000236,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package gdm` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000459,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package authconfig` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000342,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package authconfig-gtk` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000421,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package krb5-libs` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.00069,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package krb5-workstation` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000469,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package krb5-pkinit` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000559,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package pcsc-lite` is installed","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"The package is expected to be installed","run_time":0.000334,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `System Package pcsc-lite-libs` is installed","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204632","title":"The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to\n    privileged accounts via pluggable authentication modules (PAM).","desc":"Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management).","descriptions":[{"label":"default","data":"Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management)."},{"label":"check","data":"Verify the operating system implements multifactor authentication for remote access to privileged\n    accounts via pluggable authentication modules (PAM).\n    Check the \"/etc/sssd/sssd.conf\" file for the authentication services that are being used with the following command:\n    # grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf\n    services = nss, pam\n    If the \"pam\" service is not present on all \"services\" lines, this is a finding."},{"label":"fix","data":"Configure the operating system to implement multifactor authentication for remote access to privileged\n    accounts via pluggable authentication modules (PAM).\n    Modify all of the services lines in \"/etc/sssd/sssd.conf\" or in configuration files found under \"/etc/sssd/conf.d\"\n    to include pam."}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72427","SV-87051"],"severity":"medium","gtitle":"SRG-OS-000375-GPOS-00160","satisfies":["SRG-OS-000375-GPOS-00160","SRG-OS-000375-GPOS-00161","SRG-OS-000375-GPOS-00162"],"gid":"V-204632","rid":"SV-204632r853998_rule","stig_id":"RHEL-07-041002","fix_id":"F-4756r89089_fix","cci":["CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (11)","IA-2 (12)","IA-2 (12)"],"subsystems":["sssd"],"host":null},"code":"control 'SV-204632' do\n  title 'The Red Hat Enterprise Linux operating system must implement multifactor authentication for access to\n    privileged accounts via pluggable authentication modules (PAM).'\n  desc 'Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management).'\n  desc 'check', 'Verify the operating system implements multifactor authentication for remote access to privileged\n    accounts via pluggable authentication modules (PAM).\n    Check the \"/etc/sssd/sssd.conf\" file for the authentication services that are being used with the following command:\n    # grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf\n    services = nss, pam\n    If the \"pam\" service is not present on all \"services\" lines, this is a finding.'\n  desc 'fix', 'Configure the operating system to implement multifactor authentication for remote access to privileged\n    accounts via pluggable authentication modules (PAM).\n    Modify all of the services lines in \"/etc/sssd/sssd.conf\" or in configuration files found under \"/etc/sssd/conf.d\"\n    to include pam.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72427', 'SV-87051']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000375-GPOS-00160'\n  tag satisfies: ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']\n  tag gid: 'V-204632'\n  tag rid: 'SV-204632r853998_rule'\n  tag stig_id: 'RHEL-07-041002'\n  tag fix_id: 'F-4756r89089_fix'\n  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']\n  tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']\n  tag subsystems: ['sssd']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  elsif package('sssd').installed?\n    if !(sssd_files = command('find /etc/sssd -name *.conf').stdout.split(\"\\n\")).empty?\n      sssd_files.each do |file|\n        next unless package('sssd').installed?\n\n        describe.one do\n          if package('sssd').installed?\n            describe parse_config_file(file) do\n              its('services') { should include 'pam' }\n            end\n          end\n          if package('sssd').installed?\n            describe command(\"grep -i -E 'services(\\s)*=(\\s)*(.+*)pam' #{file}\") do\n              its('stdout.strip') { should include 'pam' }\n            end\n          end\n        end\n      end\n    else\n      describe 'The set of SSSD configuration files' do\n        subject { sssd_files.to_a }\n        it { should_not be_empty }\n      end\n    end\n  else\n    impact 0.0\n    describe 'The SSSD Package is not installed on the system' do\n      skip 'This control is Not Appliciable without the SSSD Package installed.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204632.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The SSSD Package is not installed on the system","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"This control is Not Appliciable without the SSSD Package installed.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-204633","title":"The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI\n    authentication.","desc":"Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management).","descriptions":[{"label":"default","data":"Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management)."},{"label":"check","data":"Verify the operating system implements certificate status checking for PKI\nauthentication.\n\n    Check to see if Online Certificate Status Protocol (OCSP) is enabled on the\nsystem with the following command:\n\n    # grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \"^#\"\n\n    cert_policy = ca, ocsp_on, signature;\n    cert_policy = ca, ocsp_on, signature;\n    cert_policy = ca, ocsp_on, signature;\n\n    There should be at least three lines returned.\n\n    If \"ocsp_on\" is not present in all uncommented \"cert_policy\" lines in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\", this is a finding."},{"label":"fix","data":"Configure the operating system to do certificate status checking for PKI\nauthentication.\n\n    Modify all of the \"cert_policy\" lines in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\" to include \"ocsp_on\"."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72433","SV-87057"],"severity":"medium","gtitle":"SRG-OS-000375-GPOS-00160","satisfies":["SRG-OS-000375-GPOS-00160","SRG-OS-000375-GPOS-00161","SRG-OS-000375-GPOS-00162"],"gid":"V-204633","rid":"SV-204633r853999_rule","stig_id":"RHEL-07-041003","fix_id":"F-4757r89092_fix","cci":["CCI-001948","CCI-001953","CCI-001954"],"nist":["IA-2 (11)","IA-2 (12)","IA-2 (12)"],"subsystems":["pam_pkcs11","pam","pkcs11"],"host":null},"code":"control 'SV-204633' do\n  title 'The Red Hat Enterprise Linux operating system must implement certificate status checking for PKI\n    authentication.'\n  desc 'Using an authentication device, such as a CAC or token that is separate from the information system, ensures\n    that even if the information system is compromised, that compromise will not affect credentials stored on the\n    authentication device.\n    Multifactor solutions that require devices separate from information systems gaining access include, for example,\n    hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S.\n    Government Personal Identity Verification card and the DoD Common Access Card.\n    A privileged account is defined as an information system account with authorizations of a privileged user.\n    Remote access is access to DoD nonpublic information systems by an authorized user (or an information system)\n    communicating through an external, non-organization-controlled network. Remote access methods include, for example,\n    dial-up, broadband, and wireless.\n    This requirement only applies to components where this is specific to the function of the device or has the concept\n    of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of\n    configuring the device itself (management).'\n  desc 'check', 'Verify the operating system implements certificate status checking for PKI\nauthentication.\n\n    Check to see if Online Certificate Status Protocol (OCSP) is enabled on the\nsystem with the following command:\n\n    # grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v \"^#\"\n\n    cert_policy = ca, ocsp_on, signature;\n    cert_policy = ca, ocsp_on, signature;\n    cert_policy = ca, ocsp_on, signature;\n\n    There should be at least three lines returned.\n\n    If \"ocsp_on\" is not present in all uncommented \"cert_policy\" lines in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\", this is a finding.'\n  desc 'fix', 'Configure the operating system to do certificate status checking for PKI\nauthentication.\n\n    Modify all of the \"cert_policy\" lines in\n\"/etc/pam_pkcs11/pam_pkcs11.conf\" to include \"ocsp_on\".'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72433', 'SV-87057']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000375-GPOS-00160'\n  tag satisfies: ['SRG-OS-000375-GPOS-00160', 'SRG-OS-000375-GPOS-00161', 'SRG-OS-000375-GPOS-00162']\n  tag gid: 'V-204633'\n  tag rid: 'SV-204633r853999_rule'\n  tag stig_id: 'RHEL-07-041003'\n  tag fix_id: 'F-4757r89092_fix'\n  tag cci: ['CCI-001948', 'CCI-001953', 'CCI-001954']\n  tag nist: ['IA-2 (11)', 'IA-2 (12)', 'IA-2 (12)']\n  tag subsystems: ['pam_pkcs11', 'pam', 'pkcs11']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n\n    smart_card_status = input('smart_card_status')\n\n    if smart_card_status.eql?('enabled')\n      impact 0.5\n      if (pam_file = file('/etc/pam_pkcs11/pam_pkcs11.conf')).exist?\n        cert_policy_lines = if pam_file.content.nil?\n                              []\n                            else\n                              pam_file.content.lines.grep(/^(?!.+#).*cert_policy/i)\n                            end\n        if cert_policy_lines.length < 3\n          describe 'should contain at least 3 cert policy lines' do\n            subject { cert_policy_lines.length }\n            it { should >= 3 }\n          end\n        else\n          describe 'each cert policy line should include oscp_on' do\n            cert_policy_lines.each do |line|\n              subject { line }\n              it { should match(/ocsp_on/i) }\n            end\n          end\n        end\n      else\n        describe pam_file do\n          it { should exist }\n        end\n      end\n    else\n      impact 0.0\n      describe 'The system is not smartcard enabled' do\n        skip 'The system is not using Smartcards / PIVs to fulfil the MFA requirement, this control is Not Applicable.'\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204633.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"File /etc/pam_pkcs11/pam_pkcs11.conf ","run_time":8.4e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `file` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"file","resource_params":"[\"/etc/pam_pkcs11/pam_pkcs11.conf\"]"}]},{"id":"SV-204634","title":"The Red Hat Enterprise Linux operating system must be configured so that all wireless network adapters are\n    disabled.","desc":"The use of wireless networking can introduce many different attack vectors into the organization's network.\n    Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless\n    access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor\n    and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to\n    create a denial of service to valid network resources.","descriptions":[{"label":"default","data":"The use of wireless networking can introduce many different attack vectors into the organization's network.\n    Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless\n    access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor\n    and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to\n    create a denial of service to valid network resources."},{"label":"check","data":"Verify that there are no wireless interfaces configured on the system.\n    This is N/A for systems that do not have wireless network adapters.\n    Check for the presence of active wireless interfaces with the following command:\n    # nmcli device\n    DEVICE TYPE STATE\n    eth0 ethernet connected\n    wlp3s0 wifi disconnected\n    lo loopback unmanaged\n    If a wireless interface is configured and its use on the system is not documented with the Information System\n    Security Officer (ISSO), this is a finding."},{"label":"fix","data":"Configure the system to disable all wireless network interfaces with the following command:\n    #nmcli radio wifi off"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-73177","SV-87829"],"severity":"medium","gtitle":"SRG-OS-000424-GPOS-00188","gid":"V-204634","rid":"SV-204634r877465_rule","stig_id":"RHEL-07-041010","fix_id":"F-4758r89095_fix","cci":["CCI-001443","CCI-001444","CCI-002418"],"nist":["AC-18 (1)","AC-18 (1)","SC-8"],"subsystems":["network","wifi","nmcli"],"host":null,"container":null},"code":"control 'SV-204634' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all wireless network adapters are\n    disabled.'\n  desc \"The use of wireless networking can introduce many different attack vectors into the organization's network.\n    Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless\n    access point (AP), allowing validated systems to connect to the malicious AP and enabling the attacker to monitor\n    and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack or be used to\n    create a denial of service to valid network resources.\"\n  desc 'check', 'Verify that there are no wireless interfaces configured on the system.\n    This is N/A for systems that do not have wireless network adapters.\n    Check for the presence of active wireless interfaces with the following command:\n    # nmcli device\n    DEVICE TYPE STATE\n    eth0 ethernet connected\n    wlp3s0 wifi disconnected\n    lo loopback unmanaged\n    If a wireless interface is configured and its use on the system is not documented with the Information System\n    Security Officer (ISSO), this is a finding.'\n  desc 'fix', 'Configure the system to disable all wireless network interfaces with the following command:\n    #nmcli radio wifi off'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-73177', 'SV-87829']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000424-GPOS-00188'\n  tag gid: 'V-204634'\n  tag rid: 'SV-204634r877465_rule'\n  tag stig_id: 'RHEL-07-041010'\n  tag fix_id: 'F-4758r89095_fix'\n  tag cci: ['CCI-001443', 'CCI-001444', 'CCI-002418']\n  tag nist: ['AC-18 (1)', 'AC-18 (1)', 'SC-8']\n  tag subsystems: ['network', 'wifi', 'nmcli']\n  tag 'host'\n  tag 'container'\n\n  describe command('nmcli device') do\n    its('stdout.strip') { should_not match(/wifi connected/) }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-204634.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Command: `nmcli device` ","run_time":7.5e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"nmcli device\"]"}]},{"id":"SV-214799","title":"The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system\n    files and commands matches vendor values.","desc":"Without cryptographic integrity protections, system command and files can be altered by unauthorized users\n    without detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.","descriptions":[{"label":"default","data":"Without cryptographic integrity protections, system command and files can be altered by unauthorized users\n    without detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash."},{"label":"check","data":"Verify the cryptographic hash of system files and commands match the vendor values.\n    Check the cryptographic hash of system files and commands with the following command:\n    Note: System configuration files (indicated by a \"c\" in the second column) are expected to change over time. Unusual\n    modifications should be investigated through the system audit log.\n    # rpm -Va --noconfig | grep '^..5'\n    If there is any output from the command for system files or binaries, this is a finding."},{"label":"fix","data":"Run the following command to determine which package owns the file:\n\n    # rpm -qf <filename>\n\n    The package can be reinstalled from a yum repository using the command:\n\n    # sudo yum reinstall <packagename>\n\n    Alternatively, the package can be reinstalled from trusted media using the\ncommand:\n\n    # sudo rpm -Uvh <packagename>"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["SV-86479","V-71855"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-214799","rid":"SV-214799r854001_rule","stig_id":"RHEL-07-010020","fix_id":"F-15997r192363_fix","cci":["CCI-001749"],"nist":["CM-5 (3)"],"subsystems":["rpm","package"],"host":null,"container":null},"code":"control 'SV-214799' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that the cryptographic hash of system\n    files and commands matches vendor values.'\n  desc 'Without cryptographic integrity protections, system command and files can be altered by unauthorized users\n    without detection.\n    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash\n    functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while\n    maintaining the confidentiality of the key used to generate the hash.'\n  desc 'check', %q(Verify the cryptographic hash of system files and commands match the vendor values.\n    Check the cryptographic hash of system files and commands with the following command:\n    Note: System configuration files (indicated by a \"c\" in the second column) are expected to change over time. Unusual\n    modifications should be investigated through the system audit log.\n    # rpm -Va --noconfig | grep '^..5'\n    If there is any output from the command for system files or binaries, this is a finding.)\n  desc 'fix', 'Run the following command to determine which package owns the file:\n\n    # rpm -qf <filename>\n\n    The package can be reinstalled from a yum repository using the command:\n\n    # sudo yum reinstall <packagename>\n\n    Alternatively, the package can be reinstalled from trusted media using the\ncommand:\n\n    # sudo rpm -Uvh <packagename>'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['SV-86479', 'V-71855']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-214799'\n  tag rid: 'SV-214799r854001_rule'\n  tag stig_id: 'RHEL-07-010020'\n  tag fix_id: 'F-15997r192363_fix'\n  tag cci: ['CCI-001749']\n  tag nist: ['CM-5 (3)']\n  tag subsystems: ['rpm', 'package']\n  tag 'host'\n  tag 'container'\n\n  if input('disable_slow_controls')\n    describe \"This control consistently takes a long to run and has been disabled\n    using the disable_slow_controls attribute.\" do\n      skip \"This control consistently takes a long to run and has been disabled\n      using the disable_slow_controls attribute. You must enable this control for a\n      full accredidation for production.\"\n    end\n  else\n    allowlist = input('rpm_verify_integrity_except')\n\n    misconfigured_packages = command('rpm -Va --noconfig').stdout.split(\"\\n\")\n                                                          .select { |package| package[0..7].match(/5/) }\n                                                          .map { |package| package.match(/\\S+$/)[0] }\n\n    if misconfigured_packages.empty?\n      describe 'The list of rpm packages with hashes changed from the vendor values' do\n        subject { misconfigured_packages }\n        it { should be_empty }\n      end\n    else\n      describe 'The list of rpm packages with hashes changed from the vendor values' do\n        fail_msg = \"Files with hashes that are changed from vendor values but are not in the allowlist: #{(misconfigured_packages - allowlist).join(', ')}\"\n        it 'should all appear in the allowlist' do\n          expect(misconfigured_packages).to all(be_in allowlist), fail_msg\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-214799.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"The list of rpm packages with hashes changed from the vendor values is expected to be empty","run_time":0.012514,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-214800","title":"The Red Hat Enterprise Linux operating system must implement the Endpoint Security for Linux Threat\n    Prevention tool.","desc":"Adding endpoint security tools can provide the capability to automatically take actions in response to\n    malicious behavior, which can provide additional agility in reacting to network threats. These tools also often\n    include a reporting capability to provide network awareness of the system, which may not otherwise exist in an\n    organization's systems management regime.","descriptions":[{"label":"default","data":"Adding endpoint security tools can provide the capability to automatically take actions in response to\n    malicious behavior, which can provide additional agility in reacting to network threats. These tools also often\n    include a reporting capability to provide network awareness of the system, which may not otherwise exist in an\n    organization's systems management regime."},{"label":"check","data":"Per OPORD 16-0080, the preferred endpoint security tool is McAfee Endpoint Security for Linux (ENSL)\n    in conjunction with SELinux.\n    Procedure:\n    Check that the following package has been installed:\n    # rpm -qa | grep -i mcafeetp\n    If the \"mcafeetp\" package is not installed, this is a finding.\n    Verify that the daemon is running:\n    # ps -ef | grep -i mfetpd\n    If the daemon is not running, this is a finding."},{"label":"fix","data":"Install and enable the latest McAfee ENSLTP package."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-92255","SV-102357"],"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-214800","rid":"SV-214800r854323_rule","stig_id":"RHEL-07-020019","fix_id":"F-36317r754750_fix","cci":["CCI-001263","CCI-000366"],"nist":["SI-4 (5)","CM-6 b"],"subsystems":["endpoint_security"],"host":null,"container":null},"code":"control 'SV-214800' do\n  title 'The Red Hat Enterprise Linux operating system must implement the Endpoint Security for Linux Threat\n    Prevention tool.'\n  desc \"Adding endpoint security tools can provide the capability to automatically take actions in response to\n    malicious behavior, which can provide additional agility in reacting to network threats. These tools also often\n    include a reporting capability to provide network awareness of the system, which may not otherwise exist in an\n    organization's systems management regime.\"\n  desc 'check', 'Per OPORD 16-0080, the preferred endpoint security tool is McAfee Endpoint Security for Linux (ENSL)\n    in conjunction with SELinux.\n    Procedure:\n    Check that the following package has been installed:\n    # rpm -qa | grep -i mcafeetp\n    If the \"mcafeetp\" package is not installed, this is a finding.\n    Verify that the daemon is running:\n    # ps -ef | grep -i mfetpd\n    If the daemon is not running, this is a finding.'\n  desc 'fix', 'Install and enable the latest McAfee ENSLTP package.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-92255', 'SV-102357']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-214800'\n  tag rid: 'SV-214800r854323_rule'\n  tag stig_id: 'RHEL-07-020019'\n  tag fix_id: 'F-36317r754750_fix'\n  tag cci: ['CCI-001263', 'CCI-000366']\n  tag nist: ['SI-4 (5)', 'CM-6 b']\n  tag subsystems: ['endpoint_security']\n  tag 'host'\n  tag 'container'\n\n  describe package('mcafeetp') do\n    it { should be_installed }\n  end\n  describe service('mfetpd') do\n    it { should be_installed }\n    it { should be_enabled }\n    it { should be_running }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-214800.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package mcafeetp","run_time":7.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package mcafeetp","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"mcafeetp\"]"},{"status":"skipped","code_desc":"Service mfetpd","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Service mfetpd","skip_message":"The `service` resource is not supported on your OS yet.","resource_class":"service","resource_params":"[\"mfetpd\"]"}]},{"id":"SV-214801","title":"The Red Hat Enterprise Linux operating system must use a virus scan program.","desc":"Virus scanning software can be used to protect a system from penetration from computer viruses and to limit\n    their spread through intermediate systems.\n    The virus scanning software should be configured to perform scans dynamically on accessed files. If this capability\n    is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily\n    basis.\n    If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.","descriptions":[{"label":"default","data":"Virus scanning software can be used to protect a system from penetration from computer viruses and to limit\n    their spread through intermediate systems.\n    The virus scanning software should be configured to perform scans dynamically on accessed files. If this capability\n    is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily\n    basis.\n    If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail."},{"label":"check","data":"Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled\n    with an approved host-based security solution.\n    If there is no anti-virus solution installed on the system, this is a finding."},{"label":"fix","data":"Install an antivirus solution on the system."}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-72213","SV-86837"],"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","gid":"V-214801","rid":"SV-214801r854324_rule","stig_id":"RHEL-07-032000","fix_id":"F-15999r192369_fix","cci":["CCI-001668","CCI-000366"],"nist":["SI-3 a","CM-6 b"],"subsystems":["clamav","nails","virus_scan"],"host":null,"container":null},"code":"control 'SV-214801' do\n  title 'The Red Hat Enterprise Linux operating system must use a virus scan program.'\n  desc 'Virus scanning software can be used to protect a system from penetration from computer viruses and to limit\n    their spread through intermediate systems.\n    The virus scanning software should be configured to perform scans dynamically on accessed files. If this capability\n    is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily\n    basis.\n    If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.'\n  desc 'check', 'Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled\n    with an approved host-based security solution.\n    If there is no anti-virus solution installed on the system, this is a finding.'\n  desc 'fix', 'Install an antivirus solution on the system.'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-72213', 'SV-86837']\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag gid: 'V-214801'\n  tag rid: 'SV-214801r854324_rule'\n  tag stig_id: 'RHEL-07-032000'\n  tag fix_id: 'F-15999r192369_fix'\n  tag cci: ['CCI-001668', 'CCI-000366']\n  tag nist: ['SI-3 a', 'CM-6 b']\n  tag subsystems: ['clamav', 'nails', 'virus_scan']\n  tag 'host'\n  tag 'container'\n\n  custom_antivirus = input('custom_antivirus')\n\n  if !custom_antivirus\n    describe.one do\n      describe service('nails') do\n        it { should be_running }\n      end\n      describe service('clamav-daemon.socket') do\n        it { should be_running }\n      end\n      describe service('ds_agent') do\n        it { should be_running }\n      end\n    end\n  else\n    # Allow user to provide a description of their AV solution\n    # for documentation.\n    custom_antivirus_description = input('custom_antivirus_description')\n    describe \"Antivirus: #{custom_antivirus_description}\" do\n      subject { custom_antivirus_description }\n      it { should_not cmp 'None' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-214801.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"Service nails is expected to be running","run_time":0.000224,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service nails` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"nails\"]"},{"status":"failed","code_desc":"Service clamav-daemon.socket is expected to be running","run_time":0.000148,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service clamav-daemon.socket` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"clamav-daemon.socket\"]"},{"status":"failed","code_desc":"Service ds_agent is expected to be running","run_time":0.000166,"start_time":"2023-04-18T13:20:14-04:00","message":"expected that `Service ds_agent` is running","exception":"RSpec::Core::MultipleExceptionError","resource_class":"service","resource_params":"[\"ds_agent\"]"}]},{"id":"SV-214937","title":"The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver\n    lock-enabled setting for the graphical user interface.","desc":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    The ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to\n    disengage the graphical user interface session lock provides the assurance that all sessions will lock after the\n    specified period of time.","descriptions":[{"label":"default","data":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    The ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to\n    disengage the graphical user interface session lock provides the assurance that all sessions will lock after the\n    specified period of time."},{"label":"check","data":"Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n     system-db:local\n\nCheck for the lock-enabled setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i lock-enabled /etc/dconf/db/local.d/locks/*\n     /org/gnome/desktop/screensaver/lock-enabled\n\nIf the command does not return a result, this is a finding."},{"label":"fix","data":"Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the screensaver lock-enabled setting:\n    /org/gnome/desktop/screensaver/lock-enabled"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"legacy":["V-78995","SV-93701"],"severity":"medium","gtitle":"SRG-OS-000029-GPOS-00010","gid":"V-214937","rid":"SV-214937r880767_rule","stig_id":"RHEL-07-010062","fix_id":"F-16135r880766_fix","cci":["CCI-000057"],"nist":["AC-11 a"],"subsystems":["gui"],"host":null},"code":"control 'SV-214937' do\n  title 'The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver\n    lock-enabled setting for the graphical user interface.'\n  desc 'A session lock is a temporary action taken when a user stops work and moves away from the immediate physical\n    vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n    The session lock is implemented at the point where session activity can be determined.\n    The ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to\n    disengage the graphical user interface session lock provides the assurance that all sessions will lock after the\n    specified period of time.'\n  desc 'check', 'Verify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. \n\nNote: If the system does not have GNOME installed, this requirement is Not Applicable.\n\nDetermine which profile the system database is using with the following command:\n     # grep system-db /etc/dconf/profile/user\n     system-db:local\n\nCheck for the lock-enabled setting with the following command:\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\n     # grep -i lock-enabled /etc/dconf/db/local.d/locks/*\n     /org/gnome/desktop/screensaver/lock-enabled\n\nIf the command does not return a result, this is a finding.'\n  desc 'fix', 'Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute\n    period of inactivity for graphical user interfaces.\n    Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following\n    command:\n    Note: The example below is using the database \"local\" for the system, so if the system is using another database in\n    \"/etc/dconf/profile/user\", the file should be created under the appropriate subdirectory.\n    # touch /etc/dconf/db/local.d/locks/session\n    Add the setting to lock the screensaver lock-enabled setting:\n    /org/gnome/desktop/screensaver/lock-enabled'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag legacy: ['V-78995', 'SV-93701']\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag gid: 'V-214937'\n  tag rid: 'SV-214937r880767_rule'\n  tag stig_id: 'RHEL-07-010062'\n  tag fix_id: 'F-16135r880766_fix'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\n  tag subsystems: ['gui']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n    describe command('gsettings writable org.gnome.desktop.screensaver lock-enabled') do\n      its('stdout.strip') { should cmp 'false' }\n    end\n  else\n    impact 0.0\n    describe 'The GNOME desktop is not installed' do\n      skip 'The GNOME desktop is not installed, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-214937.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The GNOME desktop is not installed","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The GNOME desktop is not installed, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-219059","title":"The Red Hat Enterprise Linux operating system must disable the graphical user interface automounter unless required.","desc":"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.","descriptions":[{"label":"default","data":"Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity."},{"label":"check","data":"Note: If the operating system does not have a graphical user interface installed, this requirement is Not Applicable.\n\nVerify the operating system disables the ability to automount devices in a graphical user interface.\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\nCheck to see if automounter service is disabled with the following commands:\n# cat /etc/dconf/db/local.d/00-No-Automount\n\n[org/gnome/desktop/media-handling]\n\nautomount=false\n\nautomount-open=false\n\nautorun-never=true\n\nIf the output does not match the example above, this is a finding.\n\n# cat /etc/dconf/db/local.d/locks/00-No-Automount\n\n/org/gnome/desktop/media-handling/automount\n\n/org/gnome/desktop/media-handling/automount-open\n\n/org/gnome/desktop/media-handling/autorun-never\n\nIf the output does not match the example, this is a finding."},{"label":"fix","data":"Configure the graphical user interface to disable the ability to automount devices.\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\nCreate or edit the /etc/dconf/db/local.d/00-No-Automount file and add the following:  \n\n[org/gnome/desktop/media-handling]\n\nautomount=false\n\nautomount-open=false\n\nautorun-never=true\n\nCreate or edit the /etc/dconf/db/local.d/locks/00-No-Automount file and add the following:\n/org/gnome/desktop/media-handling/automount\n\n/org/gnome/desktop/media-handling/automount-open\n\n/org/gnome/desktop/media-handling/autorun-never\n\nRun the following command to update the database:\n\n# dconf update"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000114-GPOS-00059","satisfies":["SRG-OS-000114-GPOS-00059","SRG-OS-000378-GPOS-00163","SRG-OS-000480-GPOS-00227"],"gid":"V-219059","rid":"SV-219059r854002_rule","stig_id":"RHEL-07-020111","fix_id":"F-36318r602663_fix","cci":["CCI-000366","CCI-000778","CCI-001958"],"legacy":["V-100023","SV-109127"],"nist":["CM-6 b","IA-3"],"subsystems":["gui","automount"],"host":null},"code":"control 'SV-219059' do\n  title 'The Red Hat Enterprise Linux operating system must disable the graphical user interface automounter unless required.'\n  desc 'Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity.'\n  desc 'check', 'Note: If the operating system does not have a graphical user interface installed, this requirement is Not Applicable.\n\nVerify the operating system disables the ability to automount devices in a graphical user interface.\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\nCheck to see if automounter service is disabled with the following commands:\n# cat /etc/dconf/db/local.d/00-No-Automount\n\n[org/gnome/desktop/media-handling]\n\nautomount=false\n\nautomount-open=false\n\nautorun-never=true\n\nIf the output does not match the example above, this is a finding.\n\n# cat /etc/dconf/db/local.d/locks/00-No-Automount\n\n/org/gnome/desktop/media-handling/automount\n\n/org/gnome/desktop/media-handling/automount-open\n\n/org/gnome/desktop/media-handling/autorun-never\n\nIf the output does not match the example, this is a finding.'\n  desc 'fix', 'Configure the graphical user interface to disable the ability to automount devices.\n\nNote: The example below is using the database \"local\" for the system, so the path is \"/etc/dconf/db/local.d\". This path must be modified if a database other than \"local\" is being used.\n\nCreate or edit the /etc/dconf/db/local.d/00-No-Automount file and add the following:  \n\n[org/gnome/desktop/media-handling]\n\nautomount=false\n\nautomount-open=false\n\nautorun-never=true\n\nCreate or edit the /etc/dconf/db/local.d/locks/00-No-Automount file and add the following:\n/org/gnome/desktop/media-handling/automount\n\n/org/gnome/desktop/media-handling/automount-open\n\n/org/gnome/desktop/media-handling/autorun-never\n\nRun the following command to update the database:\n\n# dconf update'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000114-GPOS-00059'\n  tag satisfies: ['SRG-OS-000114-GPOS-00059', 'SRG-OS-000378-GPOS-00163', 'SRG-OS-000480-GPOS-00227']\n  tag gid: 'V-219059'\n  tag rid: 'SV-219059r854002_rule'\n  tag stig_id: 'RHEL-07-020111'\n  tag fix_id: 'F-36318r602663_fix'\n  tag cci: ['CCI-000366', 'CCI-000778', 'CCI-001958']\n  tag legacy: ['V-100023', 'SV-109127']\n  tag nist: ['CM-6 b', 'IA-3']\n  tag subsystems: ['gui', 'automount']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container' do\n      skip 'Control not applicable within a container'\n    end\n  elsif package('gnome-desktop3').installed?\n    options = {\n        assignment_regex: /^\\s*([^=]*?)\\s*=\\s*(.*?)\\s*$/\n      }\n\n    describe parse_config_file(input('automount_config'), options) do\n      its('automount') { should cmp 'false' }\n      its('automount-open') { should cmp 'false' }\n      its('autorun-never') { should cmp 'true' }\n    end\n    describe file(input('automount_locks_config')) do\n      its('content') { should match /automount$/ }\n      its('content') { should match /automount-open$/ }\n      its('content') { should match /autorun-never$/ }\n    end\n\n  else\n    impact 0.0\n    describe 'The system does not have GNOME installed' do\n      skip \"The system does not have GNOME installed, this requirement is Not\n        Applicable.\"\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-219059.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"The system does not have GNOME installed","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The system does not have GNOME installed, this requirement is Not\n        Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-228563","title":"The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are owned by root, sys, bin, or an application user.","desc":"If a world-writable directory is not owned by root, sys, bin, or an application User Identifier (UID), unauthorized users may be able to modify files created by others.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.","descriptions":[{"label":"default","data":"If a world-writable directory is not owned by root, sys, bin, or an application User Identifier (UID), unauthorized users may be able to modify files created by others.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access."},{"label":"check","data":"The following command will discover and print world-writable directories that are not owned by a system account, assuming only system accounts have a UID lower than 1000. Run it once for each local partition [PART]:\n\n# find [PART] -xdev -type d -perm -0002 -uid +999 -print\n\nIf there is output, this is a finding."},{"label":"fix","data":"All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":null,"gid":"V-228563","rid":"SV-228563r744119_rule","stig_id":"RHEL-07-021031","fix_id":"F-19547r377220_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"],"subsystems":["world_writable","ww_dirs"],"host":null},"code":"control 'SV-228563' do\n  title 'The Red Hat Enterprise Linux operating system must be configured so that all world-writable directories are owned by root, sys, bin, or an application user.'\n  desc 'If a world-writable directory is not owned by root, sys, bin, or an application User Identifier (UID), unauthorized users may be able to modify files created by others.\n\nThe only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.'\n  desc 'check', 'The following command will discover and print world-writable directories that are not owned by a system account, assuming only system accounts have a UID lower than 1000. Run it once for each local partition [PART]:\n\n# find [PART] -xdev -type d -perm -0002 -uid +999 -print\n\nIf there is output, this is a finding.'\n  desc 'fix', 'All directories in local partitions which are world-writable should be owned by root or another system account. If any world-writable directories are not owned by a system account, this should be investigated. Following this, the files should be deleted or assigned to an appropriate group.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: nil\n  tag gid: 'V-228563'\n  tag rid: 'SV-228563r744119_rule'\n  tag stig_id: 'RHEL-07-021031'\n  tag fix_id: 'F-19547r377220_fix'\n  tag cci: ['CCI-000366']\n  tag legacy: []\n  tag nist: ['CM-6 b']\n  tag subsystems: ['world_writable', 'ww_dirs']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  else\n    ww_dirs = Set[]\n    partitions = etc_fstab.params.map { |partition| partition['mount_point'] }.uniq\n    partitions.each do |part|\n      cmd = \"find #{part} -xdev -type d -perm -0002 -uid +999 -print\"\n      ww_dirs += command(cmd).stdout.split(\"\\n\")\n    end\n\n    describe 'List of world-writeable directories which are not owned by system accounts across all partitions' do\n      subject { ww_dirs.to_a }\n      it { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-228563.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"List of world-writeable directories which are not owned by system accounts across all partitions is expected to be empty","run_time":0.012508,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-228564","title":"The Red Hat Enterprise Linux operating system must protect audit information from unauthorized read, modification, or deletion.","desc":"If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nTo ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification.\n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.","descriptions":[{"label":"default","data":"If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nTo ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification.\n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity."},{"label":"check","data":"Verify the operating system audit records have proper permissions and ownership.\n\nList the full permissions and ownership of the audit log files with the following command.\n\n# ls -la /var/log/audit \ntotal 4512\ndrwx------. 2 root root 23 Apr 25 16:53 .\ndrwxr-xr-x. 17 root root 4096 Aug 9 13:09 ..\n-rw-------. 1 root root 8675309 Aug 9 12:54 audit.log\n\nAudit logs must be mode 0600 or less permissive. \nIf any are more permissive, this is a finding.\n\nThe owner and group owner of all audit log files must both be \"root\". If any other owner or group owner is listed, this is a finding."},{"label":"fix","data":"Change the mode of the audit log files with the following command: \n\n# chmod 0600 [audit_file]\n\nChange the owner and group owner of the audit log files with the following command: \n\n# chown root:root [audit_file]"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000057-GPOS-00027","satisfies":["SRG-OS-000057-GPOS-00027","SRG-OS-000058-GPOS-00028","SRG-OS-000059-GPOS-00029","SRG-OS-000206-GPOS-00084"],"gid":"V-228564","rid":"SV-228564r606407_rule","stig_id":"RHEL-07-910055","fix_id":"F-23603r419770_fix","cci":["CCI-000162","CCI-000163","CCI-000164","CCI-001314"],"legacy":[],"nist":["AU-9","SI-11 c","AU-9 a","SI-11 b"],"subsystems":["audit"],"host":null},"code":"control 'SV-228564' do\n  title 'The Red Hat Enterprise Linux operating system must protect audit information from unauthorized read, modification, or deletion.'\n  desc 'If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.\n\nTo ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification.\n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.'\n  desc 'check', 'Verify the operating system audit records have proper permissions and ownership.\n\nList the full permissions and ownership of the audit log files with the following command.\n\n# ls -la /var/log/audit \ntotal 4512\ndrwx------. 2 root root 23 Apr 25 16:53 .\ndrwxr-xr-x. 17 root root 4096 Aug 9 13:09 ..\n-rw-------. 1 root root 8675309 Aug 9 12:54 audit.log\n\nAudit logs must be mode 0600 or less permissive. \nIf any are more permissive, this is a finding.\n\nThe owner and group owner of all audit log files must both be \"root\". If any other owner or group owner is listed, this is a finding.'\n  desc 'fix', 'Change the mode of the audit log files with the following command: \n\n# chmod 0600 [audit_file]\n\nChange the owner and group owner of the audit log files with the following command: \n\n# chown root:root [audit_file]'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000057-GPOS-00027'\n  tag satisfies: ['SRG-OS-000057-GPOS-00027', 'SRG-OS-000058-GPOS-00028', 'SRG-OS-000059-GPOS-00029', 'SRG-OS-000206-GPOS-00084']\n  tag gid: 'V-228564'\n  tag rid: 'SV-228564r606407_rule'\n  tag stig_id: 'RHEL-07-910055'\n  tag fix_id: 'F-23603r419770_fix'\n  tag cci: ['CCI-000162', 'CCI-000163', 'CCI-000164', 'CCI-001314']\n  tag legacy: []\n  tag nist: ['AU-9', 'SI-11 c', 'AU-9 a', 'SI-11 b']\n  tag subsystems: ['audit']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable - audit config must be done on the host' do\n      skip 'Control not applicable - audit config must be done on the host'\n    end\n  else\n    describe file(auditd_conf.log_file) do\n      its('mode') { should cmp input('expected_audit_file_mode') }\n      it { should_not be_more_permissive_than(input('max_audit_file_mode')) }\n      its('group') { should cmp 'root' }\n      its('owner') { should cmp 'root' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-228564.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"File  ","run_time":0.000103,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `file` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"file","resource_params":"[nil]"}]},{"id":"SV-233307","title":"The Red Hat Enterprise Linux operating system SSH daemon must prevent remote hosts from connecting to the proxy display.","desc":"When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DIPSLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display.","descriptions":[{"label":"default","data":"When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DIPSLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display."},{"label":"check","data":"Verify the SSH daemon prevents remote hosts from connecting to the proxy display.\n\nCheck the SSH X11UseLocalhost setting with the following command:\n\n# sudo grep -i x11uselocalhost /etc/ssh/sshd_config\nX11UseLocalhost yes\n\nIf the \"X11UseLocalhost\" keyword is set to \"no\", is missing, or is commented out, this is a finding."},{"label":"fix","data":"Configure the SSH daemon to prevent remote hosts from connecting to the proxy display.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"X11UseLocalhost\" keyword and set its value to \"yes\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nX11UseLocalhost yes"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":null,"gid":"V-233307","rid":"SV-233307r603301_rule","stig_id":"RHEL-07-040711","fix_id":"F-36466r622234_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"],"subsystems":["ssh"],"host":null},"code":"control 'SV-233307' do\n  title 'The Red Hat Enterprise Linux operating system SSH daemon must prevent remote hosts from connecting to the proxy display.'\n  desc 'When X11 forwarding is enabled, there may be additional exposure to the server and client displays if the sshd proxy display is configured to listen on the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DIPSLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display.'\n  desc 'check', 'Verify the SSH daemon prevents remote hosts from connecting to the proxy display.\n\nCheck the SSH X11UseLocalhost setting with the following command:\n\n# sudo grep -i x11uselocalhost /etc/ssh/sshd_config\nX11UseLocalhost yes\n\nIf the \"X11UseLocalhost\" keyword is set to \"no\", is missing, or is commented out, this is a finding.'\n  desc 'fix', 'Configure the SSH daemon to prevent remote hosts from connecting to the proxy display.\n\nEdit the \"/etc/ssh/sshd_config\" file to uncomment or add the line for the \"X11UseLocalhost\" keyword and set its value to \"yes\" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor):\n\nX11UseLocalhost yes'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: nil\n  tag gid: 'V-233307'\n  tag rid: 'SV-233307r603301_rule'\n  tag stig_id: 'RHEL-07-040711'\n  tag fix_id: 'F-36466r622234_fix'\n  tag cci: ['CCI-000366']\n  tag legacy: []\n  tag nist: ['CM-6 b']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !file('/etc/sysconfig/sshd').exist?\n    impact 0.0\n    describe 'Control not applicable - SSH is not installed within containerized RHEL' do\n      skip 'Control not applicable - SSH is not installed within containerized RHEL'\n    end\n  else\n    describe sshd_config do\n      its('X11UseLocalhost') { should eq 'yes' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-233307.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"SSHD Configuration","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"SSHD Configuration","skip_message":"Can't find file: /etc/ssh/sshd_config","resource_class":"sshd_config","resource_params":"[]"}]},{"id":"SV-237633","title":"The Red Hat Enterprise Linux operating system must restrict privilege elevation to authorized personnel.","desc":"The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. If the \"sudoers\" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.","descriptions":[{"label":"default","data":"The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. If the \"sudoers\" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system."},{"label":"check","data":"Verify the \"sudoers\" file restricts sudo access to authorized personnel.\n$ sudo grep -iw 'ALL' /etc/sudoers /etc/sudoers.d/*\n\nIf the either of the following entries are returned, this is a finding:\nALL     ALL=(ALL) ALL\nALL     ALL=(ALL:ALL) ALL"},{"label":"fix","data":"Remove the following entries from the sudoers file:\nALL     ALL=(ALL) ALL\nALL     ALL=(ALL:ALL) ALL"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":null,"gid":"V-237633","rid":"SV-237633r646850_rule","stig_id":"RHEL-07-010341","fix_id":"F-40815r646849_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"],"subsystems":["sudo"],"host":null},"code":"control 'SV-237633' do\n  title 'The Red Hat Enterprise Linux operating system must restrict privilege elevation to authorized personnel.'\n  desc 'The sudo command allows a user to execute programs with elevated (administrator) privileges. It prompts the user for their password and confirms your request to execute a command by checking a file, called sudoers. If the \"sudoers\" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.'\n  desc 'check', %q(Verify the \"sudoers\" file restricts sudo access to authorized personnel.\n$ sudo grep -iw 'ALL' /etc/sudoers /etc/sudoers.d/*\n\nIf the either of the following entries are returned, this is a finding:\nALL     ALL=(ALL) ALL\nALL     ALL=(ALL:ALL) ALL)\n  desc 'fix', 'Remove the following entries from the sudoers file:\nALL     ALL=(ALL) ALL\nALL     ALL=(ALL:ALL) ALL'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: nil\n  tag gid: 'V-237633'\n  tag rid: 'SV-237633r646850_rule'\n  tag stig_id: 'RHEL-07-010341'\n  tag fix_id: 'F-40815r646849_fix'\n  tag cci: ['CCI-000366']\n  tag legacy: []\n  tag nist: ['CM-6 b']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    sudoers = command(\"grep -iw 'ALL' /etc/sudoers /etc/sudoers.d/*\").stdout\n    describe 'Sudoers file' do\n      it 'should restrict access to privilege escalation' do\n        expect(sudoers).not_to match(/ALL\\s+ALL=\\(ALL[:ALL]?\\)\\s+ALL/)\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-237633.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Sudoers file should restrict access to privilege escalation","run_time":0.000116,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-237634","title":"The Red Hat Enterprise Linux operating system must use the invoking user's password for privilege escalation when using \"sudo\".","desc":"The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the \"root\" user password. \nFor more information on each of the listed configurations, reference the sudoers(5) manual page.","descriptions":[{"label":"default","data":"The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the \"root\" user password. \nFor more information on each of the listed configurations, reference the sudoers(5) manual page."},{"label":"check","data":"Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.\n\n     $ sudo grep -Eir '(rootpw|targetpw|runaspw)' /etc/sudoers /etc/sudoers.d* | grep -v '#'\n\n     /etc/sudoers:Defaults !targetpw\n     /etc/sudoers:Defaults !rootpw\n     /etc/sudoers:Defaults !runaspw\n\nIf conflicting results are returned, this is a finding.\nIf \"Defaults !targetpw\" is not defined, this is a finding.\nIf \"Defaults !rootpw\" is not defined, this is a finding.\nIf \"Defaults !runaspw\" is not defined, this is a finding."},{"label":"fix","data":"Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:\n     Defaults !targetpw\n     Defaults !rootpw\n     Defaults !runaspw\n\nRemove any configurations that conflict with the above from the following locations: \n     /etc/sudoers\n     /etc/sudoers.d/"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":null,"gid":"V-237634","rid":"SV-237634r880755_rule","stig_id":"RHEL-07-010342","fix_id":"F-40816r880754_fix","cci":["CCI-002227"],"legacy":[],"nist":["AC-6 (5)"],"subsystems":["sudo"],"host":null},"code":"control 'SV-237634' do\n  title %q(The Red Hat Enterprise Linux operating system must use the invoking user's password for privilege escalation when using \"sudo\".)\n  desc %q(The sudoers security policy requires that users authenticate themselves before they can use sudo. When sudoers requires authentication, it validates the invoking user's credentials. If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt the invoking user for the \"root\" user password. \nFor more information on each of the listed configurations, reference the sudoers(5) manual page.)\n  desc 'check', %q(Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.\n\n     $ sudo grep -Eir '(rootpw|targetpw|runaspw)' /etc/sudoers /etc/sudoers.d* | grep -v '#'\n\n     /etc/sudoers:Defaults !targetpw\n     /etc/sudoers:Defaults !rootpw\n     /etc/sudoers:Defaults !runaspw\n\nIf conflicting results are returned, this is a finding.\nIf \"Defaults !targetpw\" is not defined, this is a finding.\nIf \"Defaults !rootpw\" is not defined, this is a finding.\nIf \"Defaults !runaspw\" is not defined, this is a finding.)\n  desc 'fix', 'Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:\n     Defaults !targetpw\n     Defaults !rootpw\n     Defaults !runaspw\n\nRemove any configurations that conflict with the above from the following locations: \n     /etc/sudoers\n     /etc/sudoers.d/'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: nil\n  tag gid: 'V-237634'\n  tag rid: 'SV-237634r880755_rule'\n  tag stig_id: 'RHEL-07-010342'\n  tag fix_id: 'F-40816r880754_fix'\n  tag cci: ['CCI-002227']\n  tag legacy: []\n  tag nist: ['AC-6 (5)']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    sudoers_settings = command(\"egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'\").stdout.strip\n\n    target_match = sudoers_settings.scan(/^([^:]+):Defaults\\s+!targetpw$/).flatten\n    root_match = sudoers_settings.scan(/^([^:]+):Defaults\\s+!rootpw$/).flatten\n    runas_match = sudoers_settings.scan(/^([^:]+):Defaults\\s+!runaspw$/).flatten\n\n    target_match_file = target_match.empty? ? nil : target_match.first\n\n    describe '!targetpw flag' do\n      it 'should be set' do\n        expect(target_match).not_to be_empty\n      end\n      it 'should be set in exactly one file' do\n        expect(target_match.count).to cmp 1\n      end\n    end\n\n    describe '!rootpw flag' do\n      it 'should be set' do\n        expect(root_match).not_to be_empty\n      end\n      it 'should be set in the same file as targetpw' do\n        expect(root_match.first).to cmp target_match_file\n      end\n      it 'should be set in exactly one file' do\n        expect(root_match.count).to cmp 1\n      end\n    end\n\n    describe '!runaspw flag' do\n      it 'should be set' do\n        expect(runas_match).not_to be_empty\n      end\n      it 'should be set in the same file as targetpw' do\n        expect(runas_match.first).to cmp target_match_file\n      end\n      it 'should be set in exactly one file' do\n        expect(runas_match.count).to cmp 1\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-237634.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"!targetpw flag should be set","run_time":0.011165,"start_time":"2023-04-18T13:20:14-04:00","message":"expected `[].empty?` to be falsey, got true","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"!targetpw flag should be set in exactly one file","run_time":0.000223,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: 1\n     got: 0\n\n(compared using `cmp` matcher)\n","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"!rootpw flag should be set","run_time":0.010902,"start_time":"2023-04-18T13:20:14-04:00","message":"expected `[].empty?` to be falsey, got true","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"!rootpw flag should be set in the same file as targetpw","run_time":0.000166,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"!rootpw flag should be set in exactly one file","run_time":0.000289,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: 1\n     got: 0\n\n(compared using `cmp` matcher)\n","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"!runaspw flag should be set","run_time":0.011279,"start_time":"2023-04-18T13:20:14-04:00","message":"expected `[].empty?` to be falsey, got true","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"!runaspw flag should be set in the same file as targetpw","run_time":0.000177,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"!runaspw flag should be set in exactly one file","run_time":0.000174,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: 1\n     got: 0\n\n(compared using `cmp` matcher)\n","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-237635","title":"The Red Hat Enterprise Linux operating system must require re-authentication when using the \"sudo\" command.","desc":"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to re-authenticate when using the \"sudo\" command.\n\nIf the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.","descriptions":[{"label":"default","data":"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to re-authenticate when using the \"sudo\" command.\n\nIf the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated."},{"label":"check","data":"Verify the operating system requires re-authentication when using the \"sudo\" command to elevate privileges.\n\n$ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d\n/etc/sudoers:Defaults timestamp_timeout=0\n\nIf conflicting results are returned, this is a finding.\n\nIf \"timestamp_timeout\" is set to a negative number, is commented out, or no results are returned, this is a finding."},{"label":"fix","data":"Configure the \"sudo\" command to require re-authentication.\nEdit the /etc/sudoers file:\n$ sudo visudo\n\nAdd or modify the following line:\nDefaults timestamp_timeout=[value]\nNote: The \"[value]\" must be a number that is greater than or equal to \"0\".\n\nRemove any duplicate or conflicting lines from /etc/sudoers and /etc/sudoers.d/ files."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000373-GPOS-00156","satisfies":null,"gid":"V-237635","rid":"SV-237635r861075_rule","stig_id":"RHEL-07-010343","fix_id":"F-40817r858491_fix","cci":["CCI-002038"],"legacy":[],"nist":["IA-11"],"subsystems":["sudo"],"host":null},"code":"control 'SV-237635' do\n  title 'The Red Hat Enterprise Linux operating system must require re-authentication when using the \"sudo\" command.'\n  desc %q(Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the organization requires the user to re-authenticate when using the \"sudo\" command.\n\nIf the value is set to an integer less than 0, the user's time stamp will not expire and the user will not have to re-authenticate for privileged actions until the user's session is terminated.)\n  desc 'check', %q(Verify the operating system requires re-authentication when using the \"sudo\" command to elevate privileges.\n\n$ sudo grep -ir 'timestamp_timeout' /etc/sudoers /etc/sudoers.d\n/etc/sudoers:Defaults timestamp_timeout=0\n\nIf conflicting results are returned, this is a finding.\n\nIf \"timestamp_timeout\" is set to a negative number, is commented out, or no results are returned, this is a finding.)\n  desc 'fix', 'Configure the \"sudo\" command to require re-authentication.\nEdit the /etc/sudoers file:\n$ sudo visudo\n\nAdd or modify the following line:\nDefaults timestamp_timeout=[value]\nNote: The \"[value]\" must be a number that is greater than or equal to \"0\".\n\nRemove any duplicate or conflicting lines from /etc/sudoers and /etc/sudoers.d/ files.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000373-GPOS-00156'\n  tag satisfies: nil\n  tag gid: 'V-237635'\n  tag rid: 'SV-237635r861075_rule'\n  tag stig_id: 'RHEL-07-010343'\n  tag fix_id: 'F-40817r858491_fix'\n  tag cci: ['CCI-002038']\n  tag legacy: []\n  tag nist: ['IA-11']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    describe command(\"grep -i 'timestamp_timeout' /etc/sudoers /etc/sudoers.d/*\").stdout.strip do\n      it { should match /^[^#].*Defaults timestamp_timeout=\\d/ }\n      it { should_not match /\\n/ }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-237635.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"is expected to match /^[^#].*Defaults timestamp_timeout=\\d/","run_time":0.000333,"start_time":"2023-04-18T13:20:14-04:00","message":"expected \"\" to match /^[^#].*Defaults timestamp_timeout=\\d/\nDiff:\n@@ -1,2 +1,2 @@\n-/^[^#].*Defaults timestamp_timeout=\\d/\n+\"\"\n","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"is expected not to match /\\n/","run_time":0.000101,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-244557","title":"Red Hat Enterprise Linux operating systems version 7.2 or newer booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.","desc":"If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc.","descriptions":[{"label":"default","data":"If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc."},{"label":"check","data":"For systems that use UEFI, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nVerify that a unique name is set as the \"superusers\" account:\n\n# grep -iw \"superusers\" /boot/grub2/grub.cfg\n    set superusers=\"[someuniquestringhere]\"\n    export superusers\n\nIf \"superusers\" is identical to any OS account name or is missing a name, this is a finding."},{"label":"fix","data":"Configure the system to have a unique name for the grub superusers account.\n\nEdit the /etc/grub.d/01_users file and add or modify the following lines:\n\nset superusers=\"[someuniquestringhere]\"\nexport superusers\npassword_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}\n\nGenerate a new grub.cfg file with the following command:\n\n$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000080-GPOS-00048","satisfies":null,"gid":"V-244557","rid":"SV-244557r833185_rule","stig_id":"RHEL-07-010483","fix_id":"F-47789r833184_fix","cci":["CCI-000213"],"legacy":[],"nist":["AC-3"],"subsystems":["grub"],"host":null},"code":"control 'SV-244557' do\n  title 'Red Hat Enterprise Linux operating systems version 7.2 or newer booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.'\n  desc 'If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc.'\n  desc 'check', 'For systems that use UEFI, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nVerify that a unique name is set as the \"superusers\" account:\n\n# grep -iw \"superusers\" /boot/grub2/grub.cfg\n    set superusers=\"[someuniquestringhere]\"\n    export superusers\n\nIf \"superusers\" is identical to any OS account name or is missing a name, this is a finding.'\n  desc 'fix', 'Configure the system to have a unique name for the grub superusers account.\n\nEdit the /etc/grub.d/01_users file and add or modify the following lines:\n\nset superusers=\"[someuniquestringhere]\"\nexport superusers\npassword_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}\n\nGenerate a new grub.cfg file with the following command:\n\n$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000080-GPOS-00048'\n  tag satisfies: nil\n  tag gid: 'V-244557'\n  tag rid: 'SV-244557r833185_rule'\n  tag stig_id: 'RHEL-07-010483'\n  tag fix_id: 'F-47789r833184_fix'\n  tag cci: ['CCI-000213']\n  tag legacy: []\n  tag nist: ['AC-3']\n  tag subsystems: ['grub']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  elsif file('/sys/firmware/efi').exist?\n    impact 0.0\n    describe 'System running UEFI' do\n      skip 'The System is running UEFI, this control is Not Applicable.'\n    end\n  elsif os[:release] >= '7.2'\n    options = {\n        assignment_regex: /^\\s*(.*)=\\\"?([^\\\"]+)\\\"?$/\n      }\n\n    describe parse_config_file(input('grub_main_cfg'), options) do\n      its('set superusers') { should_not be nil }\n      its('set superusers') { should_not be_in users.usernames }\n    end\n\n  else\n    impact 0.0\n    describe 'System running version of RHEL prior to 7.2' do\n      skip 'The System is running an outdated version of RHEL, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-244557.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /boot/grub2/grub.cfg","run_time":6.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /boot/grub2/grub.cfg","skip_message":"Can't find file: /boot/grub2/grub.cfg","resource_class":"parse_config_file","resource_params":"[\"/boot/grub2/grub.cfg\", {:assignment_regex=>/^\\s*(.*)=\\\"?([^\\\"]+)\\\"?$/}]"}]},{"id":"SV-244558","title":"Red Hat Enterprise Linux operating systems version 7.2 or newer booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.","desc":"If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc.","descriptions":[{"label":"default","data":"If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc."},{"label":"check","data":"For systems that use BIOS, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nVerify that a unique name is set as the \"superusers\" account:\n\n$ sudo grep -iw \"superusers\" /boot/efi/EFI/redhat/grub.cfg\n    set superusers=\"[someuniquestringhere]\"\n    export superusers\n\nIf \"superusers\" is identical to any OS account name or is missing a name, this is a finding."},{"label":"fix","data":"Configure the system to have a unique name for the grub superusers account.\n\nEdit the /etc/grub.d/01_users file and add or modify the following lines:\n\nset superusers=\"[someuniquestringhere]\"\nexport superusers\npassword_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}\n\nGenerate a new grub.cfg file with the following command:\n\n$ sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg"}],"impact":0.0,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000080-GPOS-00048","satisfies":null,"gid":"V-244558","rid":"SV-244558r833187_rule","stig_id":"RHEL-07-010492","fix_id":"F-47790r833186_fix","cci":["CCI-000213"],"legacy":[],"nist":["AC-3"],"subsystems":["grub"],"host":null,"container":null},"code":"control 'SV-244558' do\n  title 'Red Hat Enterprise Linux operating systems version 7.2 or newer booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance.'\n  desc 'If the system does not require valid authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for RHEL 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.\nThe GRUB 2 superuser account is an account of last resort. Establishing a unique username for this account hardens the boot loader against brute force attacks. Due to the nature of the superuser account database being distinct from the OS account database, this allows the use of a username that is not among those within the OS account database. Examples of non-unique superusers names are root, superuser, unlock, etc.'\n  desc 'check', 'For systems that use BIOS, this is Not Applicable.\n\nFor systems that are running a version of RHEL prior to 7.2, this is Not Applicable.\n\nVerify that a unique name is set as the \"superusers\" account:\n\n$ sudo grep -iw \"superusers\" /boot/efi/EFI/redhat/grub.cfg\n    set superusers=\"[someuniquestringhere]\"\n    export superusers\n\nIf \"superusers\" is identical to any OS account name or is missing a name, this is a finding.'\n  desc 'fix', 'Configure the system to have a unique name for the grub superusers account.\n\nEdit the /etc/grub.d/01_users file and add or modify the following lines:\n\nset superusers=\"[someuniquestringhere]\"\nexport superusers\npassword_pbkdf2 [someuniquestringhere] ${GRUB2_PASSWORD}\n\nGenerate a new grub.cfg file with the following command:\n\n$ sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000080-GPOS-00048'\n  tag satisfies: nil\n  tag gid: 'V-244558'\n  tag rid: 'SV-244558r833187_rule'\n  tag stig_id: 'RHEL-07-010492'\n  tag fix_id: 'F-47790r833186_fix'\n  tag cci: ['CCI-000213']\n  tag legacy: []\n  tag nist: ['AC-3']\n  tag subsystems: ['grub']\n  tag 'host'\n  tag 'container'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable to a container' do\n      skip 'Control not applicable to a container'\n    end\n  elsif file('/sys/firmware/efi').exist?\n    if os[:release] >= '7.2'\n      describe parse_config_file(input('grub_uefi_main_cfg')) do\n        its('set superusers') { should exist }\n        its('set superusers') { should_not be_in users.usernames }\n      end\n    else\n      impact 0.0\n      describe 'System running version of RHEL prior to 7.2' do\n        skip 'The System is running an outdated version of RHEL, this control is Not Applicable.'\n      end\n    end\n  else\n    impact 0.0\n    describe 'System running BIOS' do\n      skip 'The System is running BIOS, this control is Not Applicable.'\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-244558.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System running BIOS","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"","skip_message":"The System is running BIOS, this control is Not Applicable.","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-250312","title":"The Red Hat Enterprise Linux operating system must confine SELinux users to roles that conform to least privilege.","desc":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.","descriptions":[{"label":"default","data":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users."},{"label":"check","data":"Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system confines SELinux users to roles that conform to least privilege.\n\nCheck the SELinux User list to SELinux Roles mapping by using the following command:\n\n$ sudo semanage user -l\nSELinuxUser LabelingPrefix MLS/MCSLevel MLS/MCSRange SELinuxRoles\nguest_u            user  s0  s0  guest_r\nroot                   user  s0  s0-s0:c0.c1023  staff_r sysadm_r system_r unconfined_r\nstaff_u              user  s0  s0-s0:c0.c1023  staff_r sysadm_r\nsysadm_u         user  s0  s0-s0:c0.c1023  sysadm_r \nsystem_u          user  s0  s0-s0:c0.c1023  system_r unconfined_r\nunconfined_u  user  s0  s0-s0:c0.c1023  system_r unconfined_r\nuser_u               user  s0  s0  user_r\nxguest_u           user  s0  s0  xguest_r\n\nIf the output differs from the above example, ask the SA to demonstrate how the SELinux User mappings are exercising least privilege. If deviations from the example are not documented with the ISSO and do not demonstrate least privilege, this is a finding."},{"label":"fix","data":"Configure the operating system to confine SELinux users to roles that conform to least privilege.\n\nUse the following command to map the \"staff_u\" SELinux user to the \"staff_r\" and \"sysadm_r\" roles:\n\n$ sudo semanage user -m staff_u -R staff_r -R sysadm_r\n\nUse the following command to map the \"user_u\" SELinux user to the \"user_r\" role:\n\n$ sudo semanage -m user_u -R user_r"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000324-GPOS-00125","satisfies":null,"gid":"V-250312","rid":"SV-250312r877392_rule","stig_id":"RHEL-07-020021","fix_id":"F-53700r792842_fix","cci":["CCI-002165","CCI-002235"],"legacy":[],"nist":["AC-3 (4)","AC-6 (10)"],"subsystems":["selinux"],"host":null},"code":"control 'SV-250312' do\n  title 'The Red Hat Enterprise Linux operating system must confine SELinux users to roles that conform to least privilege.'\n  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.'\n  desc 'check', 'Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system confines SELinux users to roles that conform to least privilege.\n\nCheck the SELinux User list to SELinux Roles mapping by using the following command:\n\n$ sudo semanage user -l\nSELinuxUser LabelingPrefix MLS/MCSLevel MLS/MCSRange SELinuxRoles\nguest_u            user  s0  s0  guest_r\nroot                   user  s0  s0-s0:c0.c1023  staff_r sysadm_r system_r unconfined_r\nstaff_u              user  s0  s0-s0:c0.c1023  staff_r sysadm_r\nsysadm_u         user  s0  s0-s0:c0.c1023  sysadm_r \nsystem_u          user  s0  s0-s0:c0.c1023  system_r unconfined_r\nunconfined_u  user  s0  s0-s0:c0.c1023  system_r unconfined_r\nuser_u               user  s0  s0  user_r\nxguest_u           user  s0  s0  xguest_r\n\nIf the output differs from the above example, ask the SA to demonstrate how the SELinux User mappings are exercising least privilege. If deviations from the example are not documented with the ISSO and do not demonstrate least privilege, this is a finding.'\n  desc 'fix', 'Configure the operating system to confine SELinux users to roles that conform to least privilege.\n\nUse the following command to map the \"staff_u\" SELinux user to the \"staff_r\" and \"sysadm_r\" roles:\n\n$ sudo semanage user -m staff_u -R staff_r -R sysadm_r\n\nUse the following command to map the \"user_u\" SELinux user to the \"user_r\" role:\n\n$ sudo semanage -m user_u -R user_r'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000324-GPOS-00125'\n  tag satisfies: nil\n  tag gid: 'V-250312'\n  tag rid: 'SV-250312r877392_rule'\n  tag stig_id: 'RHEL-07-020021'\n  tag fix_id: 'F-53700r792842_fix'\n  tag cci: ['CCI-002165', 'CCI-002235']\n  tag legacy: []\n  tag nist: ['AC-3 (4)', 'AC-6 (10)']\n  tag subsystems: ['selinux']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container -- kernel config' do\n      skip 'Control not applicable within a container -- kernel config'\n    end\n  else\n\n    expected_mapping = {\n      'staff_u' => ['staff_r', 'sysadm_r'],\n      'user_u' => ['user_r']\n    }\n\n    selinux_users = command('semanage user -l').stdout.strip\n\n    describe 'SELinux user-role mappings' do\n      expected_mapping.keys.each do |user|\n        staff_user_mapping = selinux_users.match(/^#{user}.+\\d+\\s+(?<roles>.*)$/)\n        staff_user_roles = staff_user_mapping['roles'].split.to_set unless staff_user_mapping.nil?\n\n        it \"should set SELinux user \\'#{user}\\' to only have roles: #{expected_mapping[user].join(' ')}\" do\n          expect(staff_user_mapping).not_to be_nil, \"No user \\'#{user}\\'found\"\n          expect(staff_user_roles).to eq expected_mapping[user].to_set\n        end\n      end\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-250312.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"SELinux user-role mappings should set SELinux user 'staff_u' to only have roles: staff_r sysadm_r","run_time":0.000109,"start_time":"2023-04-18T13:20:14-04:00","message":"No user 'staff_u'found","resource_class":"Object","resource_params":"[]"},{"status":"failed","code_desc":"SELinux user-role mappings should set SELinux user 'user_u' to only have roles: user_r","run_time":8.8e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"No user 'user_u'found","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-250313","title":"The Red Hat Enterprise Linux operating system must not allow privileged accounts to utilize SSH.","desc":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.","descriptions":[{"label":"default","data":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users."},{"label":"check","data":"Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system prevents privileged accounts from utilizing SSH.\nCheck the SELinux ssh_sysadm_login boolean with the following command:\n\n$ sudo getsebool ssh_sysadm_login\nssh_sysadm_login --> off\n\nIf the \"ssh_sysadm_login\" boolean is not \"off\" and is not documented with the ISSO as an operational requirement, this is a finding."},{"label":"fix","data":"Configure the operating system to prevent privileged accounts from utilizing SSH.\nUse the following command to set the \"ssh_sysadm_login\" boolean to \"off\":\n\n$ sudo setsebool -P ssh_sysadm_login off\n\nNote: SELinux confined users mapped to sysadm_u are not allowed to login to the system over SSH, by default. If this is a required function, it can be configured by setting the ssh_sysadm_login SELinux boolean to \"on\" with the following command:\n\n$ sudo setsebool -P ssh_sysadm_login on\n\nThis must be documented with the ISSO as an operational requirement."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000324-GPOS-00125","satisfies":null,"gid":"V-250313","rid":"SV-250313r877392_rule","stig_id":"RHEL-07-020022","fix_id":"F-53701r792845_fix","cci":["CCI-002165","CCI-002235"],"legacy":[],"nist":["AC-3 (4)","AC-6 (10)"],"subsystems":["ssh"],"host":null},"code":"control 'SV-250313' do\n  title 'The Red Hat Enterprise Linux operating system must not allow privileged accounts to utilize SSH.'\n  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.'\n  desc 'check', 'Note: Per OPORD 16-0080, the preferred endpoint security tool is Endpoint Security for Linux (ENSL) in conjunction with SELinux.\n\nVerify the operating system prevents privileged accounts from utilizing SSH.\nCheck the SELinux ssh_sysadm_login boolean with the following command:\n\n$ sudo getsebool ssh_sysadm_login\nssh_sysadm_login --> off\n\nIf the \"ssh_sysadm_login\" boolean is not \"off\" and is not documented with the ISSO as an operational requirement, this is a finding.'\n  desc 'fix', 'Configure the operating system to prevent privileged accounts from utilizing SSH.\nUse the following command to set the \"ssh_sysadm_login\" boolean to \"off\":\n\n$ sudo setsebool -P ssh_sysadm_login off\n\nNote: SELinux confined users mapped to sysadm_u are not allowed to login to the system over SSH, by default. If this is a required function, it can be configured by setting the ssh_sysadm_login SELinux boolean to \"on\" with the following command:\n\n$ sudo setsebool -P ssh_sysadm_login on\n\nThis must be documented with the ISSO as an operational requirement.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000324-GPOS-00125'\n  tag satisfies: nil\n  tag gid: 'V-250313'\n  tag rid: 'SV-250313r877392_rule'\n  tag stig_id: 'RHEL-07-020022'\n  tag fix_id: 'F-53701r792845_fix'\n  tag cci: ['CCI-002165', 'CCI-002235']\n  tag legacy: []\n  tag nist: ['AC-3 (4)', 'AC-6 (10)']\n  tag subsystems: ['ssh']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container -- kernel config' do\n      skip 'Control not applicable within a container -- kernel config'\n    end\n  else\n    describe command('getsebool ssh_sysadm_login').stdout.strip do\n      it { should eq 'ssh_sysadm_login --> off' }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-250313.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"is expected to eq \"ssh_sysadm_login --> off\"","run_time":0.000155,"start_time":"2023-04-18T13:20:14-04:00","message":"\nexpected: \"ssh_sysadm_login --> off\"\n     got: \"\"\n\n(compared using ==)\n","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-250314","title":"The Red Hat Enterprise Linux operating system must elevate the SELinux context when an administrator calls the sudo command.","desc":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.","descriptions":[{"label":"default","data":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users."},{"label":"check","data":"Verify the operating system elevates the SELinux context when an administrator calls the sudo command with the following command:\n\nThis command must be ran as root:\n# grep -r sysadm_r /etc/sudoers /etc/sudoers.d\n%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL\n\nIf conflicting results are returned, this is a finding.\n\nIf a designated sudoers administrator group or account(s) is not configured to elevate the SELinux type and role to \"sysadm_t\" and \"sysadm_r\" with the use of the sudo command, this is a finding."},{"label":"fix","data":"Configure the operating system to elevate the SELinux context when an administrator calls the sudo command.\nEdit a file in the /etc/sudoers.d directory with the following command:\n$ sudo visudo -f /etc/sudoers.d/<customfile>\n\nUse the following example to build the <customfile> in the /etc/sudoers.d directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command:\n%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL\n\nRemove any configurations that conflict with the above from the following locations: \n/etc/sudoers\n/etc/sudoers.d/"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000324-GPOS-00125","satisfies":null,"gid":"V-250314","rid":"SV-250314r877392_rule","stig_id":"RHEL-07-020023","fix_id":"F-53702r858494_fix","cci":["CCI-002165","CCI-002235"],"legacy":[],"nist":["AC-3 (4)","AC-6 (10)"],"subsystems":["selinux"],"host":null},"code":"control 'SV-250314' do\n  title 'The Red Hat Enterprise Linux operating system must elevate the SELinux context when an administrator calls the sudo command.'\n  desc 'Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.'\n  desc 'check', 'Verify the operating system elevates the SELinux context when an administrator calls the sudo command with the following command:\n\nThis command must be ran as root:\n# grep -r sysadm_r /etc/sudoers /etc/sudoers.d\n%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL\n\nIf conflicting results are returned, this is a finding.\n\nIf a designated sudoers administrator group or account(s) is not configured to elevate the SELinux type and role to \"sysadm_t\" and \"sysadm_r\" with the use of the sudo command, this is a finding.'\n  desc 'fix', 'Configure the operating system to elevate the SELinux context when an administrator calls the sudo command.\nEdit a file in the /etc/sudoers.d directory with the following command:\n$ sudo visudo -f /etc/sudoers.d/<customfile>\n\nUse the following example to build the <customfile> in the /etc/sudoers.d directory to allow any administrator belonging to a designated sudoers admin group to elevate their SELinux context with the use of the sudo command:\n%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL\n\nRemove any configurations that conflict with the above from the following locations: \n/etc/sudoers\n/etc/sudoers.d/'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000324-GPOS-00125'\n  tag satisfies: nil\n  tag gid: 'V-250314'\n  tag rid: 'SV-250314r877392_rule'\n  tag stig_id: 'RHEL-07-020023'\n  tag fix_id: 'F-53702r858494_fix'\n  tag cci: ['CCI-002165', 'CCI-002235']\n  tag legacy: []\n  tag nist: ['AC-3 (4)', 'AC-6 (10)']\n  tag subsystems: ['selinux']\n  tag 'host'\n\n  if virtualization.system.eql?('docker')\n    impact 0.0\n    describe 'Control not applicable within a container -- kernel config' do\n      skip 'Control not applicable within a container -- kernel config'\n    end\n  else\n    describe command('grep sysadm_r /etc/sudoers /etc/sudoers.d/*').stdout.strip do\n      it { should match /TYPE=sysadm_t\\s+ROLE=sysadm_r/ }\n      it { should_not match /\\n/ }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-250314.rb"},"waiver_data":{},"results":[{"status":"failed","code_desc":"is expected to match /TYPE=sysadm_t\\s+ROLE=sysadm_r/","run_time":0.000234,"start_time":"2023-04-18T13:20:14-04:00","message":"expected \"\" to match /TYPE=sysadm_t\\s+ROLE=sysadm_r/\nDiff:\n@@ -1,2 +1,2 @@\n-/TYPE=sysadm_t\\s+ROLE=sysadm_r/\n+\"\"\n","resource_class":"Object","resource_params":"[]"},{"status":"passed","code_desc":"is expected not to match /\\n/","run_time":9.6e-05,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-251702","title":"The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.","desc":"If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.","descriptions":[{"label":"default","data":"If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments."},{"label":"check","data":"Check the \"/etc/shadow\" file for blank passwords with the following command:\n\n$ sudo awk -F: '!$2 {print $1}' /etc/shadow\n\nIf the command returns any results, this is a finding."},{"label":"fix","data":"Configure all accounts on the system to have a password or lock the account with the following commands:\n\nPerform a password reset:\n$ sudo passwd [username]\nLock an account:\n$ sudo passwd -l [username]"}],"impact":0.7,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"high","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":null,"gid":"V-251702","rid":"SV-251702r809220_rule","stig_id":"RHEL-07-010291","fix_id":"F-55093r809219_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"],"subsystems":["password","/etc/shadow"],"host":null,"container":null},"code":"control 'SV-251702' do\n  title 'The Red Hat Enterprise Linux operating system must not have accounts configured with blank or null passwords.'\n  desc 'If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.'\n  desc 'check', %q(Check the \"/etc/shadow\" file for blank passwords with the following command:\n\n$ sudo awk -F: '!$2 {print $1}' /etc/shadow\n\nIf the command returns any results, this is a finding.)\n  desc 'fix', 'Configure all accounts on the system to have a password or lock the account with the following commands:\n\nPerform a password reset:\n$ sudo passwd [username]\nLock an account:\n$ sudo passwd -l [username]'\n  impact 0.7\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'high'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: nil\n  tag gid: 'V-251702'\n  tag rid: 'SV-251702r809220_rule'\n  tag stig_id: 'RHEL-07-010291'\n  tag fix_id: 'F-55093r809219_fix'\n  tag cci: ['CCI-000366']\n  tag legacy: []\n  tag nist: ['CM-6 b']\n  tag subsystems: ['password', '/etc/shadow']\n  tag 'host'\n  tag 'container'\n\n  empty_pw_users = shadow.where { password == '' }.users\n\n  describe 'Passwords in /etc/shadow' do\n    it 'should not be empty' do\n      message = \"Users with empty passwords: #{empty_pw_users.join(', ')}\"\n      expect(empty_pw_users).to be_empty, message\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-251702.rb"},"waiver_data":{},"results":[{"status":"passed","code_desc":"Passwords in /etc/shadow should not be empty","run_time":0.011061,"start_time":"2023-04-18T13:20:14-04:00","resource_class":"Object","resource_params":"[]"}]},{"id":"SV-251703","title":"The Red Hat Enterprise Linux operating system must specify the default \"include\" directory for the /etc/sudoers file.","desc":"The \"sudo\" command allows authorized users to run programs (including shells) as other users, system users, and root. The \"/etc/sudoers\" file is used to configure authorized \"sudo\" users as well as the programs they are allowed to run. Some configuration options in the \"/etc/sudoers\" file allow configured users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.\n\nIt is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives. When sudo reaches this line it will suspend processing of the current file (/etc/sudoers) and switch to the specified file/directory. Once the end of the included file(s) is reached, the rest of /etc/sudoers will be processed. Files that are included may themselves include other files. A hard limit of 128 nested include files is enforced to prevent include file loops.","descriptions":[{"label":"default","data":"The \"sudo\" command allows authorized users to run programs (including shells) as other users, system users, and root. The \"/etc/sudoers\" file is used to configure authorized \"sudo\" users as well as the programs they are allowed to run. Some configuration options in the \"/etc/sudoers\" file allow configured users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.\n\nIt is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives. When sudo reaches this line it will suspend processing of the current file (/etc/sudoers) and switch to the specified file/directory. Once the end of the included file(s) is reached, the rest of /etc/sudoers will be processed. Files that are included may themselves include other files. A hard limit of 128 nested include files is enforced to prevent include file loops."},{"label":"check","data":"Note: If the \"include\" and \"includedir\" directives are not present in the /etc/sudoers file, this requirement is not applicable.\n\nVerify the operating system specifies only the default \"include\" directory for the /etc/sudoers file with the following command:\n\n$ sudo grep include /etc/sudoers\n\n#includedir /etc/sudoers.d\n\nIf the results are not \"/etc/sudoers.d\" or additional files or directories are specified, this is a finding.\n\nVerify the operating system does not have nested \"include\" files or directories within the /etc/sudoers.d directory with the following command:\n\n$ sudo grep -r include /etc/sudoers.d\n\nIf results are returned, this is a finding."},{"label":"fix","data":"Configure the /etc/sudoers file to only include the /etc/sudoers.d directory.\n\nEdit the /etc/sudoers file with the following command:\n\n$ sudo visudo\n\nAdd or modify the following line:\n#includedir /etc/sudoers.d"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000480-GPOS-00227","satisfies":null,"gid":"V-251703","rid":"SV-251703r833183_rule","stig_id":"RHEL-07-010339","fix_id":"F-55094r809222_fix","cci":["CCI-000366"],"legacy":[],"nist":["CM-6 b"],"subsystems":["sudo"],"host":null},"code":"control 'SV-251703' do\n  title 'The Red Hat Enterprise Linux operating system must specify the default \"include\" directory for the /etc/sudoers file.'\n  desc 'The \"sudo\" command allows authorized users to run programs (including shells) as other users, system users, and root. The \"/etc/sudoers\" file is used to configure authorized \"sudo\" users as well as the programs they are allowed to run. Some configuration options in the \"/etc/sudoers\" file allow configured users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts.\n\nIt is possible to include other sudoers files from within the sudoers file currently being parsed using the #include and #includedir directives. When sudo reaches this line it will suspend processing of the current file (/etc/sudoers) and switch to the specified file/directory. Once the end of the included file(s) is reached, the rest of /etc/sudoers will be processed. Files that are included may themselves include other files. A hard limit of 128 nested include files is enforced to prevent include file loops.'\n  desc 'check', 'Note: If the \"include\" and \"includedir\" directives are not present in the /etc/sudoers file, this requirement is not applicable.\n\nVerify the operating system specifies only the default \"include\" directory for the /etc/sudoers file with the following command:\n\n$ sudo grep include /etc/sudoers\n\n#includedir /etc/sudoers.d\n\nIf the results are not \"/etc/sudoers.d\" or additional files or directories are specified, this is a finding.\n\nVerify the operating system does not have nested \"include\" files or directories within the /etc/sudoers.d directory with the following command:\n\n$ sudo grep -r include /etc/sudoers.d\n\nIf results are returned, this is a finding.'\n  desc 'fix', 'Configure the /etc/sudoers file to only include the /etc/sudoers.d directory.\n\nEdit the /etc/sudoers file with the following command:\n\n$ sudo visudo\n\nAdd or modify the following line:\n#includedir /etc/sudoers.d'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000480-GPOS-00227'\n  tag satisfies: nil\n  tag gid: 'V-251703'\n  tag rid: 'SV-251703r833183_rule'\n  tag stig_id: 'RHEL-07-010339'\n  tag fix_id: 'F-55094r809222_fix'\n  tag cci: ['CCI-000366']\n  tag legacy: []\n  tag nist: ['CM-6 b']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    options = {\n      assignment_regex: /^(#includedirs?)\\s*(.*?)\\s*$/\n    }\n    describe parse_config_file('/etc/sudoers', options) do\n      its('#includedirs') { should cmp '/etc/sudoers.d' }\n    end\n    describe command('grep include /etc/sudoers.d') do\n      its('stdout') { should be_empty }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-251703.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/sudoers","run_time":5.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/sudoers","skip_message":"Can't find file: /etc/sudoers","resource_class":"parse_config_file","resource_params":"[\"/etc/sudoers\", {:assignment_regex=>/^(#includedirs?)\\s*(.*?)\\s*$/}]"},{"status":"failed","code_desc":"Command: `grep include /etc/sudoers.d` ","run_time":8.4e-05,"start_time":"2023-04-18T13:20:14-04:00","message":"Resource `command` is not supported on platform mock/unknown.","exception":"Inspec::Exceptions::ResourceFailed","backtrace":["/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:310:in `block (2 levels) in rspec_failed_block'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `instance_exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:263:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `block in with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `block in with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `block in run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:624:in `run_around_example_hooks_for'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/hooks.rb:486:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:468:in `with_around_example_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:511:in `with_around_and_singleton_context_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example.rb:259:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:646:in `block in run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:642:in `run_examples'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/example_group.rb:607:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (3 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `map'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:121:in `block (2 levels) in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/configuration.rb:2068:in `with_suite_hooks'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:116:in `block in run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/reporter.rb:74:in `report'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/rspec-core-3.11.0/lib/rspec/core/runner.rb:115:in `run_specs'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner_rspec.rb:82:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:166:in `run_tests'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/runner.rb:137:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/cli.rb:306:in `exec'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/command.rb:27:in `run'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/invocation.rb:127:in `invoke_command'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor.rb:392:in `dispatch'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/thor-1.2.1/lib/thor/base.rb:485:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-core-4.56.20/lib/inspec/base_cli.rb:35:in `start'","/opt/chef-workstation/embedded/lib/ruby/gems/3.0.0/gems/inspec-bin-4.56.20/bin/inspec:11:in `<top (required)>'","/usr/local/bin/inspec:389:in `load'","/usr/local/bin/inspec:389:in `<main>'"],"resource_class":"command","resource_params":"[\"grep include /etc/sudoers.d\"]"}]},{"id":"SV-251704","title":"The Red Hat Enterprise Linux operating system must not be configured to bypass password requirements for privilege escalation.","desc":"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.","descriptions":[{"label":"default","data":"Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate."},{"label":"check","data":"Verify the operating system is not be configured to bypass password requirements for privilege escalation.\n\nCheck the configuration of the \"/etc/pam.d/sudo\" file with the following command:\n\n$ sudo grep pam_succeed_if /etc/pam.d/sudo\n\nIf any occurrences of \"pam_succeed_if\" is returned from the command, this is a finding."},{"label":"fix","data":"Configure the operating system to require users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/ pam.d/sudo\" file with the following command:\n$ sudo vi /etc/pam.d/sudo\n\nRemove any occurrences of \"pam_succeed_if\" in the file."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000373-GPOS-00156","satisfies":["SRG-OS-000373-GPOS-00156","SRG-OS-000373-GPOS-00157","SRG-OS-000373-GPOS-00158"],"gid":"V-251704","rid":"SV-251704r854012_rule","stig_id":"RHEL-07-010344","fix_id":"F-55095r854011_fix","cci":["CCI-002038"],"legacy":[],"nist":["IA-11"],"subsystems":["sudo"],"host":null},"code":"control 'SV-251704' do\n  title 'The Red Hat Enterprise Linux operating system must not be configured to bypass password requirements for privilege escalation.'\n  desc 'Without re-authentication, users may access resources or perform tasks for which they do not have authorization. \n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.'\n  desc 'check', 'Verify the operating system is not be configured to bypass password requirements for privilege escalation.\n\nCheck the configuration of the \"/etc/pam.d/sudo\" file with the following command:\n\n$ sudo grep pam_succeed_if /etc/pam.d/sudo\n\nIf any occurrences of \"pam_succeed_if\" is returned from the command, this is a finding.'\n  desc 'fix', 'Configure the operating system to require users to supply a password for privilege escalation.\n\nCheck the configuration of the \"/etc/ pam.d/sudo\" file with the following command:\n$ sudo vi /etc/pam.d/sudo\n\nRemove any occurrences of \"pam_succeed_if\" in the file.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000373-GPOS-00156'\n  tag satisfies: ['SRG-OS-000373-GPOS-00156', 'SRG-OS-000373-GPOS-00157', 'SRG-OS-000373-GPOS-00158']\n  tag gid: 'V-251704'\n  tag rid: 'SV-251704r854012_rule'\n  tag stig_id: 'RHEL-07-010344'\n  tag fix_id: 'F-55095r854011_fix'\n  tag cci: ['CCI-002038']\n  tag legacy: []\n  tag nist: ['IA-11']\n  tag subsystems: ['sudo']\n  tag 'host'\n\n  if virtualization.system.eql?('docker') && !command('sudo').exist?\n    impact 0.0\n    describe 'Control not applicable within a container without sudo enabled' do\n      skip 'Control not applicable within a container without sudo enabled'\n    end\n  else\n    describe parse_config_file('/etc/pam.d/sudo') do\n      its('content') { should_not match /pam_succeed_if/ }\n    end\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-251704.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"Parse Config File /etc/pam.d/sudo","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"Parse Config File /etc/pam.d/sudo","skip_message":"Can't find file: /etc/pam.d/sudo","resource_class":"parse_config_file","resource_params":"[\"/etc/pam.d/sudo\"]"}]},{"id":"SV-251705","title":"The Red Hat Enterprise Linux operating system must use a file integrity tool to verify correct operation of all security functions.","desc":"Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to the Red Hat Enterprise Linux operating system performing security function verification/testing and/or systems and environments that require this functionality.","descriptions":[{"label":"default","data":"Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to the Red Hat Enterprise Linux operating system performing security function verification/testing and/or systems and environments that require this functionality."},{"label":"check","data":"Verify that Advanced Intrusion Detection Environment (AIDE) is installed and verifies the correct operation of all security functions.\n\nCheck that the AIDE package is installed with the following command:\n     $ sudo rpm -q aide\n\n     aide-0.15.1-13.el7.x86_64\n\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \n\nIf there is no application installed to perform integrity checks, this is a finding.\n\nIf AIDE is installed, check if it has been initialized with the following command:\n     $ sudo /usr/sbin/aide --check\n\nIf the output is \"Couldn't open file /var/lib/aide/aide.db.gz for reading\", this is a finding."},{"label":"fix","data":"Install AIDE, initialize it, and perform a manual check.\n\nInstall AIDE:\n     $ sudo yum install aide\n\nInitialize it:\n     $ sudo /usr/sbin/aide --init\n\n     AIDE, version 0.15.1\n     ### AIDE database at /var/lib/aide/aide.db.new.gz initialized.\n\nThe new database will need to be renamed to be read by AIDE:\n     $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz\n\nPerform a manual check:\n     $ sudo /usr/sbin/aide --check\n\n     AIDE, version 0.15.1\n     ### All files match AIDE database. Looks okay!\n\nDone."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"severity":"medium","gtitle":"SRG-OS-000445-GPOS-00199","satisfies":null,"gid":"V-251705","rid":"SV-251705r880854_rule","stig_id":"RHEL-07-020029","fix_id":"F-55096r880853_fix","cci":["CCI-002696"],"legacy":[],"nist":["SI-6 a"],"subsystems":["file_integrity_tool"],"host":null,"container":null},"code":"control 'SV-251705' do\n  title 'The Red Hat Enterprise Linux operating system must use a file integrity tool to verify correct operation of all security functions.'\n  desc 'Without verification of the security functions, security functions may not operate correctly, and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nThis requirement applies to the Red Hat Enterprise Linux operating system performing security function verification/testing and/or systems and environments that require this functionality.'\n  desc 'check', %q(Verify that Advanced Intrusion Detection Environment (AIDE) is installed and verifies the correct operation of all security functions.\n\nCheck that the AIDE package is installed with the following command:\n     $ sudo rpm -q aide\n\n     aide-0.15.1-13.el7.x86_64\n\nIf AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. \n\nIf there is no application installed to perform integrity checks, this is a finding.\n\nIf AIDE is installed, check if it has been initialized with the following command:\n     $ sudo /usr/sbin/aide --check\n\nIf the output is \"Couldn't open file /var/lib/aide/aide.db.gz for reading\", this is a finding.)\n  desc 'fix', 'Install AIDE, initialize it, and perform a manual check.\n\nInstall AIDE:\n     $ sudo yum install aide\n\nInitialize it:\n     $ sudo /usr/sbin/aide --init\n\n     AIDE, version 0.15.1\n     ### AIDE database at /var/lib/aide/aide.db.new.gz initialized.\n\nThe new database will need to be renamed to be read by AIDE:\n     $ sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz\n\nPerform a manual check:\n     $ sudo /usr/sbin/aide --check\n\n     AIDE, version 0.15.1\n     ### All files match AIDE database. Looks okay!\n\nDone.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag severity: 'medium'\n  tag gtitle: 'SRG-OS-000445-GPOS-00199'\n  tag satisfies: nil\n  tag gid: 'V-251705'\n  tag rid: 'SV-251705r880854_rule'\n  tag stig_id: 'RHEL-07-020029'\n  tag fix_id: 'F-55096r880853_fix'\n  tag cci: ['CCI-002696']\n  tag legacy: []\n  tag nist: ['SI-6 a']\n  tag subsystems: ['file_integrity_tool']\n  tag 'host'\n  tag 'container'\n\n  describe package(input('file_integrity_tool')) do\n    it { should be_installed }\n  end\nend\n","source_location":{"line":1,"ref":"./controls/SV-251705.rb"},"waiver_data":{},"results":[{"status":"skipped","code_desc":"System Package aide","run_time":4.0e-06,"start_time":"2023-04-18T13:20:14-04:00","resource":"System Package aide","skip_message":"The `package` resource is not supported on your OS yet.","resource_class":"package","resource_params":"[\"aide\"]"}]},{"id":"SV-254523","title":"The Red Hat Enterprise Linux operating system emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours.","desc":"Emergency accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.\n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.\n\nTo address access requirements, many RHEL systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.","descriptions":[{"label":"default","data":"Emergency accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.\n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.\n\nTo address access requirements, many RHEL systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements."},{"label":"check","data":"Verify emergency accounts have been provisioned with an expiration date of 72 hours.\n\nFor every existing emergency account, run the following command to obtain its account expiration information.\n\n$ sudo chage -l system_account_name\n\nVerify each of these accounts has an expiration date set within 72 hours.\nIf any emergency accounts have no expiration date set or do not expire within 72 hours, this is a finding."},{"label":"fix","data":"If an emergency account must be created, configure the system to terminate the account after 72 hours with the following command to set an expiration date for the account. Substitute \"system_account_name\" with the account to be created.\n\n$ sudo chage -E `date -d \"+3 days\" +%Y-%m-%d` system_account_name\n\nThe automatic expiration or disabling time period may be extended as needed until the crisis is resolved."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"check_id":"C-58007r858499_chk","severity":"medium","gid":"V-254523","rid":"SV-254523r858501_rule","stig_id":"RHEL-07-010271","gtitle":"SRG-OS-000123-GPOS-00064","fix_id":"F-57956r858500_fix","documentable":null,"cci":["CCI-001682"],"nist":["AC-2 (2)"]},"code":"control 'SV-254523' do\n  title 'The Red Hat Enterprise Linux operating system emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours.'\n  desc \"Emergency accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability.\n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.\n\nTo address access requirements, many RHEL systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.\"\n  desc 'check', 'Verify emergency accounts have been provisioned with an expiration date of 72 hours.\n\nFor every existing emergency account, run the following command to obtain its account expiration information.\n\n$ sudo chage -l system_account_name\n\nVerify each of these accounts has an expiration date set within 72 hours.\nIf any emergency accounts have no expiration date set or do not expire within 72 hours, this is a finding.'\n  desc 'fix', 'If an emergency account must be created, configure the system to terminate the account after 72 hours with the following command to set an expiration date for the account. Substitute \"system_account_name\" with the account to be created.\n\n$ sudo chage -E `date -d \"+3 days\" +%Y-%m-%d` system_account_name\n\nThe automatic expiration or disabling time period may be extended as needed until the crisis is resolved.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag check_id: 'C-58007r858499_chk'\n  tag severity: 'medium'\n  tag gid: 'V-254523'\n  tag rid: 'SV-254523r858501_rule'\n  tag stig_id: 'RHEL-07-010271'\n  tag gtitle: 'SRG-OS-000123-GPOS-00064'\n  tag fix_id: 'F-57956r858500_fix'\n  tag 'documentable'\n  tag cci: ['CCI-001682']\n  tag nist: ['AC-2 (2)']\nend\n","source_location":{"line":1,"ref":"./controls/SV-254523.rb"},"waiver_data":{},"results":[]},{"id":"SV-255925","title":"The Red Hat Enterprise Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.","desc":"The use of FIPS-validated cryptographic algorithms is enforced by enabling kernel FIPS mode. In the event that kernel FIPS mode is disabled, the use of nonvalidated cryptographic algorithms will be permitted systemwide. The SSH server configuration must manually define only FIPS-validated key exchange algorithms to prevent the use of nonvalidated algorithms.","descriptions":[{"label":"default","data":"The use of FIPS-validated cryptographic algorithms is enforced by enabling kernel FIPS mode. In the event that kernel FIPS mode is disabled, the use of nonvalidated cryptographic algorithms will be permitted systemwide. The SSH server configuration must manually define only FIPS-validated key exchange algorithms to prevent the use of nonvalidated algorithms."},{"label":"check","data":"Verify that the SSH server is configured to use only FIPS-validated key exchange algorithms:\n\n     $ sudo grep -i kexalgorithms /etc/ssh/sshd_config\n     KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256\n \nIf \"KexAlgorithms\" is not configured, is commented out, or does not contain only the algorithms \"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256\" in exact order, this is a finding."},{"label":"fix","data":"Configure the SSH server to use only FIPS-validated key exchange algorithms by adding or modifying the following line in \"/etc/ssh/sshd_config\":\n\n     KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256\n\nRestart the \"sshd\" service for changes to take effect:\n\n     $ sudo systemctl restart sshd"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"check_id":"C-59602r880747_chk","severity":"medium","gid":"V-255925","rid":"SV-255925r880749_rule","stig_id":"RHEL-07-040712","gtitle":"SRG-OS-000033-GPOS-00014","fix_id":"F-59545r880748_fix","documentable":null,"cci":["CCI-001453"],"nist":["AC-17 (2)"]},"code":"control 'SV-255925' do\n  title 'The Red Hat Enterprise Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.'\n  desc 'The use of FIPS-validated cryptographic algorithms is enforced by enabling kernel FIPS mode. In the event that kernel FIPS mode is disabled, the use of nonvalidated cryptographic algorithms will be permitted systemwide. The SSH server configuration must manually define only FIPS-validated key exchange algorithms to prevent the use of nonvalidated algorithms.'\n  desc 'check', 'Verify that the SSH server is configured to use only FIPS-validated key exchange algorithms:\n\n     $ sudo grep -i kexalgorithms /etc/ssh/sshd_config\n     KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256\n \nIf \"KexAlgorithms\" is not configured, is commented out, or does not contain only the algorithms \"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256\" in exact order, this is a finding.'\n  desc 'fix', 'Configure the SSH server to use only FIPS-validated key exchange algorithms by adding or modifying the following line in \"/etc/ssh/sshd_config\":\n\n     KexAlgorithms ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256\n\nRestart the \"sshd\" service for changes to take effect:\n\n     $ sudo systemctl restart sshd'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag check_id: 'C-59602r880747_chk'\n  tag severity: 'medium'\n  tag gid: 'V-255925'\n  tag rid: 'SV-255925r880749_rule'\n  tag stig_id: 'RHEL-07-040712'\n  tag gtitle: 'SRG-OS-000033-GPOS-00014'\n  tag fix_id: 'F-59545r880748_fix'\n  tag 'documentable'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\nend\n","source_location":{"line":1,"ref":"./controls/SV-255925.rb"},"waiver_data":{},"results":[]},{"id":"SV-255926","title":"The Red Hat Enterprise Linux operating system must have the screen package installed.","desc":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe screen and tmux packages allow for a session lock to be implemented and configured.","descriptions":[{"label":"default","data":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe screen and tmux packages allow for a session lock to be implemented and configured."},{"label":"check","data":"Verify the operating system has the screen package installed.\n\nCheck to see if the screen package is installed with the following command:\n\n     # yum list installed screen\n     screen-4.3.1-3-x86_64.rpm\n\nIf the screen package is not installed, check to see if the tmux package is installed with the following command:\n\n     # yum list installed tmux\n     tmux-1.8-4.el7.x86_64.rpm\n\nIf either the screen package or the tmux package is not installed, this is a finding."},{"label":"fix","data":"Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.\n\nInstall the screen program (if it is not on the system) with the following command:\n\n     # yum install screen\n\nOR\n\nInstall the tmux program (if it is not on the system) with the following command:\n\n     # yum install tmux"}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"check_id":"C-59603r880777_chk","severity":"medium","gid":"V-255926","rid":"SV-255926r880779_rule","stig_id":"RHEL-07-010090","gtitle":"SRG-OS-000029-GPOS-00010","fix_id":"F-59546r880778_fix","documentable":null,"cci":["CCI-000057"],"nist":["AC-11 a"]},"code":"control 'SV-255926' do\n  title 'The Red Hat Enterprise Linux operating system must have the screen package installed.'\n  desc \"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.\n\nThe screen and tmux packages allow for a session lock to be implemented and configured.\"\n  desc 'check', 'Verify the operating system has the screen package installed.\n\nCheck to see if the screen package is installed with the following command:\n\n     # yum list installed screen\n     screen-4.3.1-3-x86_64.rpm\n\nIf the screen package is not installed, check to see if the tmux package is installed with the following command:\n\n     # yum list installed tmux\n     tmux-1.8-4.el7.x86_64.rpm\n\nIf either the screen package or the tmux package is not installed, this is a finding.'\n  desc 'fix', 'Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity.\n\nInstall the screen program (if it is not on the system) with the following command:\n\n     # yum install screen\n\nOR\n\nInstall the tmux program (if it is not on the system) with the following command:\n\n     # yum install tmux'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag check_id: 'C-59603r880777_chk'\n  tag severity: 'medium'\n  tag gid: 'V-255926'\n  tag rid: 'SV-255926r880779_rule'\n  tag stig_id: 'RHEL-07-010090'\n  tag gtitle: 'SRG-OS-000029-GPOS-00010'\n  tag fix_id: 'F-59546r880778_fix'\n  tag 'documentable'\n  tag cci: ['CCI-000057']\n  tag nist: ['AC-11 a']\nend\n","source_location":{"line":1,"ref":"./controls/SV-255926.rb"},"waiver_data":{},"results":[]},{"id":"SV-255927","title":"The Red Hat Enterprise Linux operating system must restrict access to the kernel message buffer.","desc":"Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a non-privileged user.","descriptions":[{"label":"default","data":"Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a non-privileged user."},{"label":"check","data":"Verify the operating system is configured to restrict access to the kernel message buffer with the following commands:\n\n     $ sudo sysctl kernel.dmesg_restrict\n     kernel.dmesg_restrict = 1\n\nIf \"kernel.dmesg_restrict\" is not set to \"1\" or is missing, this is a finding.\n\nCheck that the configuration files are present to enable this kernel parameter:\n\n     $ sudo grep -r kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     /etc/sysctl.conf:kernel.dmesg_restrict = 1\n     /etc/sysctl.d/99-sysctl.conf:kernel.dmesg_restrict = 1\n\nIf \"kernel.dmesg_restrict\" is not set to \"1\", is missing or commented out, this is a finding.\n\nIf conflicting results are returned, this is a finding."},{"label":"fix","data":"Configure the operating system to restrict access to the kernel message buffer.\n\nSet the system to the required kernel parameter by adding or modifying the following line in /etc/sysctl.conf or a config file in the /etc/sysctl.d/ directory:\n\n     kernel.dmesg_restrict = 1\n\nRemove any configurations that conflict with the above from the following locations: \n     /run/sysctl.d/\n     /etc/sysctl.d/\n     /usr/local/lib/sysctl.d/\n     /usr/lib/sysctl.d/\n     /lib/sysctl.d/\n     /etc/sysctl.conf\n\nReload settings from all system configuration files with the following command:\n\n     $ sudo sysctl --system"}],"impact":0.3,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"check_id":"C-59604r880789_chk","severity":"low","gid":"V-255927","rid":"SV-255927r880791_rule","stig_id":"RHEL-07-010375","gtitle":"SRG-OS-000138-GPOS-00069","fix_id":"F-59547r880790_fix","documentable":null,"cci":["CCI-001090"],"nist":["SC-4"]},"code":"control 'SV-255927' do\n  title 'The Red Hat Enterprise Linux operating system must restrict access to the kernel message buffer.'\n  desc 'Restricting access to the kernel message buffer limits access only to root. This prevents attackers from gaining additional system information as a non-privileged user.'\n  desc 'check', 'Verify the operating system is configured to restrict access to the kernel message buffer with the following commands:\n\n     $ sudo sysctl kernel.dmesg_restrict\n     kernel.dmesg_restrict = 1\n\nIf \"kernel.dmesg_restrict\" is not set to \"1\" or is missing, this is a finding.\n\nCheck that the configuration files are present to enable this kernel parameter:\n\n     $ sudo grep -r kernel.dmesg_restrict /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null\n     /etc/sysctl.conf:kernel.dmesg_restrict = 1\n     /etc/sysctl.d/99-sysctl.conf:kernel.dmesg_restrict = 1\n\nIf \"kernel.dmesg_restrict\" is not set to \"1\", is missing or commented out, this is a finding.\n\nIf conflicting results are returned, this is a finding.'\n  desc 'fix', 'Configure the operating system to restrict access to the kernel message buffer.\n\nSet the system to the required kernel parameter by adding or modifying the following line in /etc/sysctl.conf or a config file in the /etc/sysctl.d/ directory:\n\n     kernel.dmesg_restrict = 1\n\nRemove any configurations that conflict with the above from the following locations: \n     /run/sysctl.d/\n     /etc/sysctl.d/\n     /usr/local/lib/sysctl.d/\n     /usr/lib/sysctl.d/\n     /lib/sysctl.d/\n     /etc/sysctl.conf\n\nReload settings from all system configuration files with the following command:\n\n     $ sudo sysctl --system'\n  impact 0.3\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag check_id: 'C-59604r880789_chk'\n  tag severity: 'low'\n  tag gid: 'V-255927'\n  tag rid: 'SV-255927r880791_rule'\n  tag stig_id: 'RHEL-07-010375'\n  tag gtitle: 'SRG-OS-000138-GPOS-00069'\n  tag fix_id: 'F-59547r880790_fix'\n  tag 'documentable'\n  tag cci: ['CCI-001090']\n  tag nist: ['SC-4']\nend\n","source_location":{"line":1,"ref":"./controls/SV-255927.rb"},"waiver_data":{},"results":[]},{"id":"SV-255928","title":"The Red Hat Enterprise Linux operating system must be configured to prevent overwriting of custom authentication configuration settings by the authconfig utility.","desc":"When using the authconfig utility to modify authentication configuration settings, the \"system-auth\" and \"password-auth\" files and any custom settings that they may contain are overwritten. This can be avoided by creating new local configuration files and creating new or moving existing symbolic links to them. The authconfig utility will recognize the local configuration files and not overwrite them, while writing its own settings to the original configuration files.","descriptions":[{"label":"default","data":"When using the authconfig utility to modify authentication configuration settings, the \"system-auth\" and \"password-auth\" files and any custom settings that they may contain are overwritten. This can be avoided by creating new local configuration files and creating new or moving existing symbolic links to them. The authconfig utility will recognize the local configuration files and not overwrite them, while writing its own settings to the original configuration files."},{"label":"check","data":"Verify \"system-auth\" and \"password-auth\" files are symbolic links pointing to \"system-auth-local\" and \"password-auth-local\":\n     $ sudo ls -l /etc/pam.d/{password,system}-auth\n\n     lrwxrwxrwx. 1 root root 30 Apr 1 11:59 /etc/pam.d/password-auth -> /etc/pam.d/password-auth-local\n     lrwxrwxrwx. 1 root root 28 Apr 1 11:59 /etc/pam.d/system-auth -> /etc/pam.d/system-auth-local\n\t\nIf system-auth and password-auth files are not symbolic links, this is a finding.\n\nIf system-auth and password-auth are symbolic links but do not point to \"system-auth-local\" and \"password-auth-local\", this is a finding."},{"label":"fix","data":"Create custom configuration files and their corresponding symbolic links:\n\nRename the existing configuration files (skip this step if symbolic links are already present):\n     $ sudo mv /etc/pam.d/system-auth /etc/pam.d/system-auth-ac\n     $ sudo mv /etc/pam.d/password-auth /etc/pam.d/password-auth-ac\n\t\nCreate custom system-auth configuration file:\n     $ sudo vi /etc/pam.d/system-auth-local\n\t\nThe new file, at minimum, must contain the following lines:\n\t\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        include       system-auth-ac\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n\naccount     required      pam_faillock.so\naccount     include       system-auth-ac\n\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\npassword    include       system-auth-ac\npassword    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n\nsession     include       system-auth-ac\n\nCreate custom password-auth configuration file:\n     $ sudo vi /etc/pam.d/password-auth-local\n\t\nThe new file, at minimum, must contain the following lines:\n\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        include       password-auth-ac\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n\naccount     required      pam_faillock.so\naccount     include       password-auth-ac\n\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\npassword    include       password-auth-ac\npassword    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n\nsession     include       password-auth-ac\n\t\nCreate new or move existing symbolic links to the new custom configuration files:\n     $ sudo ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth\n     $ sudo ln -sf /etc/pam.d/password-auth-local /etc/pam.d/password-auth\n\nOnce finished you should have the following file structure:\n    $ sudo ls -1 /etc/pam.d/{password,system}-auth*\n\n    /etc/pam.d/password-auth\n    /etc/pam.d/password-auth-ac\n    /etc/pam.d/password-auth-local\n    /etc/pam.d/system-auth\n    /etc/pam.d/system-auth-ac\n    /etc/pam.d/system-auth-local\n\nDone.\n\nNote: With this solution in place any custom settings to \"system-auth\" and \"password-auth\" will be retained and not overwritten by the use of the authconfig utility.  The authconfig utility will write its settings to \"system-auth-ac\" and \"password-auth-ac\" and continue to function as expected."}],"impact":0.5,"refs":[{"ref":"DPMS Target Red Hat Enterprise Linux 7"}],"tags":{"check_id":"C-59605r880828_chk","severity":"medium","gid":"V-255928","rid":"SV-255928r880830_rule","stig_id":"RHEL-07-010199","gtitle":"SRG-OS-000073-GPOS-00041","fix_id":"F-59548r880829_fix","documentable":null,"cci":["CCI-000196"],"nist":["IA-5 (1) (c)"]},"code":"control 'SV-255928' do\n  title 'The Red Hat Enterprise Linux operating system must be configured to prevent overwriting of custom authentication configuration settings by the authconfig utility.'\n  desc 'When using the authconfig utility to modify authentication configuration settings, the \"system-auth\" and \"password-auth\" files and any custom settings that they may contain are overwritten. This can be avoided by creating new local configuration files and creating new or moving existing symbolic links to them. The authconfig utility will recognize the local configuration files and not overwrite them, while writing its own settings to the original configuration files.'\n  desc 'check', 'Verify \"system-auth\" and \"password-auth\" files are symbolic links pointing to \"system-auth-local\" and \"password-auth-local\":\n     $ sudo ls -l /etc/pam.d/{password,system}-auth\n\n     lrwxrwxrwx. 1 root root 30 Apr 1 11:59 /etc/pam.d/password-auth -> /etc/pam.d/password-auth-local\n     lrwxrwxrwx. 1 root root 28 Apr 1 11:59 /etc/pam.d/system-auth -> /etc/pam.d/system-auth-local\n\t\nIf system-auth and password-auth files are not symbolic links, this is a finding.\n\nIf system-auth and password-auth are symbolic links but do not point to \"system-auth-local\" and \"password-auth-local\", this is a finding.'\n  desc 'fix', 'Create custom configuration files and their corresponding symbolic links:\n\nRename the existing configuration files (skip this step if symbolic links are already present):\n     $ sudo mv /etc/pam.d/system-auth /etc/pam.d/system-auth-ac\n     $ sudo mv /etc/pam.d/password-auth /etc/pam.d/password-auth-ac\n\t\nCreate custom system-auth configuration file:\n     $ sudo vi /etc/pam.d/system-auth-local\n\t\nThe new file, at minimum, must contain the following lines:\n\t\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        include       system-auth-ac\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n\naccount     required      pam_faillock.so\naccount     include       system-auth-ac\n\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\npassword    include       system-auth-ac\npassword    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n\nsession     include       system-auth-ac\n\nCreate custom password-auth configuration file:\n     $ sudo vi /etc/pam.d/password-auth-local\n\t\nThe new file, at minimum, must contain the following lines:\n\nauth        required      pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900\nauth        include       password-auth-ac\nauth        sufficient    pam_unix.so try_first_pass\nauth        [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900\n\naccount     required      pam_faillock.so\naccount     include       password-auth-ac\n\npassword    requisite     pam_pwhistory.so use_authtok remember=5 retry=3\npassword    include       password-auth-ac\npassword    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok\n\nsession     include       password-auth-ac\n\t\nCreate new or move existing symbolic links to the new custom configuration files:\n     $ sudo ln -sf /etc/pam.d/system-auth-local /etc/pam.d/system-auth\n     $ sudo ln -sf /etc/pam.d/password-auth-local /etc/pam.d/password-auth\n\nOnce finished you should have the following file structure:\n    $ sudo ls -1 /etc/pam.d/{password,system}-auth*\n\n    /etc/pam.d/password-auth\n    /etc/pam.d/password-auth-ac\n    /etc/pam.d/password-auth-local\n    /etc/pam.d/system-auth\n    /etc/pam.d/system-auth-ac\n    /etc/pam.d/system-auth-local\n\nDone.\n\nNote: With this solution in place any custom settings to \"system-auth\" and \"password-auth\" will be retained and not overwritten by the use of the authconfig utility.  The authconfig utility will write its settings to \"system-auth-ac\" and \"password-auth-ac\" and continue to function as expected.'\n  impact 0.5\n  ref 'DPMS Target Red Hat Enterprise Linux 7'\n  tag check_id: 'C-59605r880828_chk'\n  tag severity: 'medium'\n  tag gid: 'V-255928'\n  tag rid: 'SV-255928r880830_rule'\n  tag stig_id: 'RHEL-07-010199'\n  tag gtitle: 'SRG-OS-000073-GPOS-00041'\n  tag fix_id: 'F-59548r880829_fix'\n  tag 'documentable'\n  tag cci: ['CCI-000196']\n  tag nist: ['IA-5 (1) (c)']\nend\n","source_location":{"line":1,"ref":"./controls/SV-255928.rb"},"waiver_data":{},"results":[]}],"status":"loaded","status_message":""}],"statistics":{"duration":0.413177},"version":"4.56.20"}
\ No newline at end of file