<commit_before>pkg:
  blacklist:

    telnet:
      data:
        'CentOS Linux-7':
          - 'telnet-server': 'CIS-2.1.1'
          - 'telnet': 'CIS-2.1.2'
      description: 'Remove telnet and telnet-server (Scored)'
      alert: email
      trigger: state

    rsh:
      data:
        'CentOS Linux-7':
          - 'rsh-server': 'CIS-2.1.3'
          - 'rsh': 'CIS-2.1.4'
      description: 'Remove rsh and rsh-server (Scored)'
      alert: email
      trigger: state

    nis:
      data:
        'CentOS Linux-7':
          - 'ypbind': 'CIS-2.1.5'
          - 'ypserv': 'CIS-2.1.6'
      description: 'Remove nis client and nis server (Scored)'
      alert: email
      trigger: state

    tftp:
      data:
        'CentOS Linux-7':
          - 'tftp': 'CIS-2.1.7'
          - 'tftp-server': 'CIS-2.1.8'
      description: 'Remove tftp and tftp-server (Scored)'
      alert: email
      trigger: state

    talk:
      data:
        'CentOS Linux-7':
          - 'talk': 'CIS-2.1.9'
          - 'talk-server': 'CIS-2.1.10'
      description: 'Remove talk and talk-server (Scored)'
      alert: email
      trigger: state

    xinetd:
      data:
        'CentOS Linux-7':
          - 'xinetd': 'CIS-2.1.11'
      description: 'Remove xinetd (Scored)'
      alert: email
      trigger: state

    dhcp:
      data:
        'CentOS Linux-7':
          - 'dhcp': 'CIS-3.5'
      description: 'Remove DHCP server (Scored)'
      alert: email
      trigger: state

    xorg-x11-server-common:
      data:
        'CentOS Linux-7':
          - 'xorg-x11-server-common': 'CIS-3.2'
      description: 'Remove the X Window System (Scored)'

    avahi-daemon:
      data:
        'CentOS Linux-7':
         - 'avahi-daemon' : 'CIS-3.3'
      description: 'Disable Avahi Server (Scored)'

  whitelist:

    aide:
      data:
        'CentOS Linux-7':
          - 'aide': 'CIS-1.3.1'
      description: 'Install AIDE (Scored)'

    firewalld:
      data:
        'CentOS Linux-7':
          - 'firewalld': 'CIS-4.7'
      description: 'Enable firewalld (Scored)'

    rsyslog:
      data:
        'CentOS Linux-7':
          - 'rsyslog': 'CIS-5.1.1'
      description: 'Install rsyslog (Scored)'
      alert: email
      trigger: state

    anacron:
      data:
        'CentOS Linux-7':
          - 'cronie-anacron': 'CIS-6.1.1'
      description: 'Enable anacron Daemon (Scored)'
      alert: email
      trigger: state

stat:
  grub_conf_own:
    data:
      'CentOS-6':
        - '/etc/grub.conf':
            tag: 'CIS-1.5.1'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
      'CentOS Linux-7':
        - '/etc/grub2/grub.cfg':
            tag: 'CIS-1.5.1'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: 'Grub must be owned by root (Scored)'
    alert: email
    trigger: state

  grub_conf_perm:
    data:
      'CentOS-6':
        - '/etc/grub.conf':
            tag: 'CIS-1.5.2'
            mode: 600
      'CentOS Linux-7':
        - '/etc/grub2/grub.cfg':
            tag: 'CIS-1.5.2'
            mode: 600
    description: 'Grub must have permissions 600 (Scored)'
    alert: email
    trigger: state

  hosts_allow:
    data:
      'CentOS Linux-7':
        - '/etc/hosts.allow':
            tag: 'CIS-4.5.3'
            mode: 644
    description: '/etc/hosts.allow must have permissions 644 (Scored)'
    alert: email
    trigger: state

  hosts_deny:
    data:
      'CentOS Linux-7':
        - '/etc/hosts.deny':
            tag: 'CIS-4.5.5'
            mode: 644
    description: '/etc/hosts.deny must have persmissions 644 (Scored)'
    alert: email
    trigger: state

  anacrontab:
    data:
      'CentOS Linux-7':
        - '/etc/anacrontab':
            tag: 'CIS-6.1.3'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/anacrontab file be owned by root and must have permissions 600 (Scored)'
    alert: email
    trigger: state

  crontab:
    data:
      'CentOS Linux-7':
        - '/etc/crontab':
            tag: 'CIS-6.1.4'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/crontab must be owned by root and have persmissions 600 (Scored)'
    alert: email
    trigger: state

  cron_hourly:
    data:
      'CentOS Linux-7':
        - 'etc/cron.hourly':
            tag: 'CIS-6.1.5'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.hourly must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_daily:
    data:
      'CentOS Linux-7':
        - '/etc/cron.daily':
            tag: 'CIS-6.1.6'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.daily must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_weekly:
    data:
      'CentOS Linux-7':
        - '/etc/cron.weekly':
            tag: 'CIS-6.1.7'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.weekly must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_monthly:
    data:
      'CentOS Linux-7':
        - '/etc/cron.monthly':
            tag: 'CIS-6.1.8'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.monthly must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_d:
    data:
      'CentOS Linux-7':
        - '/etc/cron.d':
            tag: 'CIS-6.1.9'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.d must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  at_allow:
    data:
      'CentOS Linux-7':
        - '/etc/at.allow':
            tag: 'CIS-6.1.10'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/at.allow must be owned by root and have persmissions 600 (Scored)'
    alert: email
    trigger: state

  at_cron_allow:
    data:
      'CentOS Linux-7':
        - '/etc/cron.deny':
            tag: 'CIS-6.1.11'
            mode: null
            user: null
            uid: null
            group: null
            gid: null
        - '/etc/at.deny':
            tag: 'CIS-6.1.11'
            mode: null
            user: null
            uid: null
            group: null
            gid: null
        - '/etc/cron.allow':
            tag: 'CIS-6.1.11'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
        - '/etc/at/allow':
            tag: 'CIS-6.1.11'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: 'Restrict at/cron to authorized users (Scored)'
    alert: email
    trigger: state

  sshd_config:
    data:
      'CentOS Linux-7':
        - '/etc/ssh/sshd_config':
            tag: 'CIS-6.2.3'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/ssh/sshd_config must be owned by root and must have permissions 600 (Scored)'
    alert: email
    trigger: state

  warning_banner:
    data:
      'CentOS Linux-7':
        - '/etc/motd':
            tag: 'CIS-8.1'
            mode: 644
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
        - '/etc/issue':
            tag: 'CIS-8.1'
            mode: 644
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
        - '/etc/issue.net':
            tag: 'CIS-8.1'
            mode: 644
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: 'Files containing the warning banners must be owned by root and must have permissions 644 (Scored)'
    alert: email
    trigger: state

  passwd_perm:
    data:
      'CentOS Linux-7':
        - '/etc/passwd':
            tag: 'CIS-9.1.2'
            mode: 644
    description: '/etc/passwd must have permissions 644 (Scored)'
    alert: email
    trigger: state

  passwd_own:
    data:
      'CentOS Linux-7':
        - '/etc/passwd':
            tag: 'CIS-9.1.6'
            user: 'root'
            uid: 0
            group: 'root'
            uid: 0
    description: '/etc/passwd must be owned by root (Scored)'
    alert: email
    trigger: state

  shadow_perm:
    data:
      'CentOS Linux-7':
        - '/etc/shadow':
            tag: 'CIS-9.1.3'
            mode: 0
    description: '/etc/shadow must have permissions 000 (Scored)'
    alert: email
    trigger: state

  shadow_own:
    data:
      'CentOS Linux-7':
        - '/etc/shadow':
            tag: 'CIS-9.1.7'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/shadow must be owned by root (Scored)'
    alert: email
    trigger: state

  gshadow_perm:
    data:
      'CentOS Linux-7':
        - '/etc/gshadow':
            tag: 'CIS-9.1.4'
            mode: 0
    description: '/etc/gshadow must have permissions 000 (Scored)'
    alert: email
    trigger: state

  gshadow_own:
    data:
      'CentOS Linux-7':
        - '/etc/gshadow':
            tag: 'CIS-9.1.8'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/gshadow must be owned by root (Scored)'
    alert: email
    trigger: state

  group_perm:
    data:
      'CentOS Linux-7':
        - '/etc/group':
            tag: 'CIS-9.1.5'
            mode: 644
    description: '/etc/group must have permissions 000 (Scored)'
    alert: email
    trigger: state

  group_own:
    data:
      'CentOS Linux-7':
        - '/etc/group':
            tag: 'CIS-9.1.9'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/group must be owned by root (Scored)'
    alert: email
    trigger: state

grep:
  whitelist:

    fstab_tmp_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.1'
              pattern: '/tmp'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.1'
              pattern: '/tmp'
      description: 'Create Separate Partition for /tmp (Scored)'

    fstab_tmp_partition_nodev:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.2'
              pattern: '/tmp'
              match_output: 'nodev'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.2'
              pattern: '/tmp'
              match_output: 'nodev'
      description: 'Set nodev option for /tmp Partition (Scored)'

    fstab_tmp_partition_nosuid:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.3'
              pattern: '/tmp'
              match_output: 'nosuid'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.3'
              pattern: '/tmp'
              match_output: 'nosuid'
      description: 'Set nosuid option for /tmp Partition (Scored)'

    fstab_tmp_partition_noexec:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.4'
              pattern: '/tmp'
              match_output: 'noexec'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.4'
              pattern: '/tmp'
              match_output: 'nosuid'
      description: 'Set noexec option for /tmp Partition (Scored)'

    fstab_var_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.5'
              pattern: '/var'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.5'
              pattern: '/var'
      description: 'Create Separate Partition for /var (Scored)'

    fstab_var_tmp_bind_mount:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.6'
              pattern: '/tmp'
              match_output: '/var/tmp'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.6'
              pattern: '/var'
              match_output: '/var/tmp'
      description: 'Bind Mount the /var/tmp directory to /tmp (Scored)'

    fstab_var_log_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.7'
              pattern: '/var/log'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.7'
              pattern: '/var/log'
      description: 'Create Separate Partition for /var/log (Scored)'

    fstab_var_log_audit_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.8'
              pattern: '/var/log/audit'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.8'
              pattern: '/var/log/audit'
      description: 'Create Separate Partition for /var/log/audit (Scored)'

    fstab_home_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.9'
              pattern: '/home'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.9'
              pattern: '/home'
      description: 'Create Separate Partition for /home (Scored)'

    fstab_home_partition_nodev:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.10'
              pattern: '/home'
              match_output: 'nodev'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.10'
              pattern: '/home'
              match_output: 'nodev'
      description: 'Add nodev Option to /home (Scored)'

    fstab_dev_shm_partition_nodev:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.14'
              pattern: '/dev/shm'
              match_output: 'nodev'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.14'
              pattern: '/dev/shm'
              match_output: 'nodev'
      description: 'Add nodev Option to /dev/shm Partition (Scored)'

    fstab_dev_shm_partition_nosuid:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.15'
              pattern: '/dev/shm'
              match_output: 'nosuid'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.15'
              pattern: '/dev/shm'
              match_output: 'nosuid'
      description: 'Add nosuid Option to /dev/shm Partition (Scored)'

    fstab_dev_shm_partition_noexec:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.16'
              pattern: '/dev/shm'
              match_output: 'noexec'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.16'
              pattern: '/dev/shm'
              match_output: 'noexec'
      description: 'Add noexec Option to /dev/shm Partition (Scored)'

    activate_gpg_check:
      data:
        CentOS Linux-7:
          - '/etc/yum.conf':
              tag: 'CIS-1.1.16'
              pattern: 'gpgcheck'
              match_output: 'gpgcheck=1'
      description: 'Verify that gpgcheck is Globally Activated (Scored)'

    boot_loader_passwd:
      data:
        CentOS Linux-7:
          - '/boot/grub2/grub.cfg':
              tag: 'CIS-1.5.3'
              pattern: '^password'
      description: 'Set Boot Loader Password (Scored)'

    restrict_core_dumps:
      data:
        CentOS Linux-7:
          - '/etc/security/limits.conf':
              tag: 'CIS-1.6.1'
              pattern: 'hard core'
      description: 'Restrict Core Dumps (Scored)'

    set_daemon_umask:
      data:
        CentOS Linux-7:
          - '/etc/sysconfig/init':
              tag: 'CIS-3.1'
              pattern: 'umask'
              match_output: 'umask 027'
      description: 'Set Daemon umask (Scored)'

    configure_ntp:
      data:
        CentOS Linux-7:
          - '/etc/ntp.conf':
              tag: 'CIS-3.6'
              pattern: 'restrict default'
          - '/etc/ntp.conf':
              tag: 'CIS-3.6'
              pattern: 'restrict -6 default'
      description: 'Configure Network Time Protocol (NTP) (Scored)'

    rsyslog_remote_logging:
      data:
        CentOS Linux-7:
          - '/etc/rsyslog.conf':
              tag: 'CIS-5.1.5'
              pattern: "^*.*[^I][^I]*@"
      description: 'Configure rsyslog to Send Logs to a Remote Log Host (Scored)'

    sshd_protocol_2:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.1'
              pattern: "^Protocol"
              match_output: 'Protocol 2'
      description: 'Set SSH Protocol to 2 (Scored)'

    sshd_loglevel_info:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.2'
              pattern: "^LogLevel"
              match_output: 'LogLevel INFO'
      description: 'Set LogLevel to INFO (Scored)'

    sshd_x11_forwarding:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.4'
              pattern: "^X11Forwarding"
              match_output: 'X11Forwarding no'
      description: 'Disable SSH X11 Forwarding (Scored)'

    sshd_max_auth_retries:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.5'
              pattern: "^MaxAuthTries"
              match_output: "MaxAuthTries 4"
      description: 'Set SSH MaxAuthTries to 4 or Less (Scored)'

    sshd_ignore_rhosts:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.6'
              pattern: "^IgnoreRhosts"
              match_output: "IgnoreRhosts yes"
      description: 'Set SSH IgnoreRhosts to Yes (Scored)'

    sshd_hostbased_auth:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.7'
              pattern: "^HostbasedAuthentication"
              match_output: "HostbasedAuthentication no"
      description: 'Set SSH HostbasedAuthentication to No (Scored)'

    sshd_disable_root_login:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.8'
              pattern: "^PermitRootLogin"
              match_output: "PermitRootLogin no"
      description: 'Set SSH HostbasedAuthentication to No (Scored)'

    sshd_permit_empty_passwords:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.9'
              pattern: "^PermitEmptyPasswords"
              match_output: "PermitEmptyPasswords no"
      description: 'Set SSH PermitEmptyPasswords to No (Scored)'

    sshd_permit_user_environment:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.10'
              pattern: "^PermitUserEnvironment"
              match_output: "PermitUserEnvironment no"
      description: 'Do Not Allow Users to Set Environment Options (Scored)'

    sshd_approved_cipher:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.11'
              pattern: "Ciphers"
              match_output: "Ciphers aes128-ctr,aes192-ctr,aes256-ctr "
      description: 'Use Only Approved Cipher in Counter Mode (Scored)'

    sshd_idle_timeout:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.12'
              pattern: "^ClientAliveInterval"
              match_output: "ClientAliveInterval 300"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.12'
              pattern: "^ClientAliveCountMatch"
              match_output: "ClientAliveCountMatch 0"
      description: 'Set Idle Timeout Interval for User Login (Scored)'

    sshd_limit_access:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^AllowUsers"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^AllowGroups"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^DenyUsers"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^DenyGroups"
      description: 'Limit Access via SSH (Scored)'

    sshd_banner:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.14'
              pattern: "^Banner"
      description: 'Set SSH Banner (Scored)'

    passwd_expiration_days:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-7.1.1'
              pattern: "PASS_MAX_DAYS"
              match_output: "90"
      description: 'Set Password Expiration Days (Scored)'

    passwd_change_min_days:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-7.1.2'
              pattern: "PASS_MIN_DAYS"
              match_output: "7"
      description: 'Set Password Change Minimum Number of Days (Scored)'

    passwd_expiry_warning:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-7.1.3'
              pattern: "PASS_WARN_DAYS"
              match_output: "7"
      description: 'Set Password Expiring Warning Days (Scored)'

    default_umask:
      data:
        CentOS Linux-7:
          - '/etc/bashrc':
              tag: 'CIS-7.4'
              pattern: "^umask 077"
          - '/etc/profile.d/*':
              tag: 'CIS-7.4'
              pattern: "^umask 077"
      description: 'Set Default umask for Users (Scored)'

  blacklist:
    legacy_passwd_entries:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-9.2.2'
              pattern: "^+:"
      description: 'Set Password Expiring Warning Days (Scored)'
<commit_msg>CIS profile additions for CentOS 6 chapter 6<commit_after>pkg:
  blacklist:

    telnet:
      data:
        'CentOS Linux-7':
          - 'telnet-server': 'CIS-2.1.1'
          - 'telnet': 'CIS-2.1.2'
      description: 'Remove telnet and telnet-server (Scored)'
      alert: email
      trigger: state

    rsh:
      data:
        'CentOS Linux-7':
          - 'rsh-server': 'CIS-2.1.3'
          - 'rsh': 'CIS-2.1.4'
      description: 'Remove rsh and rsh-server (Scored)'
      alert: email
      trigger: state

    nis:
      data:
        'CentOS Linux-7':
          - 'ypbind': 'CIS-2.1.5'
          - 'ypserv': 'CIS-2.1.6'
      description: 'Remove nis client and nis server (Scored)'
      alert: email
      trigger: state

    tftp:
      data:
        'CentOS Linux-7':
          - 'tftp': 'CIS-2.1.7'
          - 'tftp-server': 'CIS-2.1.8'
      description: 'Remove tftp and tftp-server (Scored)'
      alert: email
      trigger: state

    talk:
      data:
        'CentOS Linux-7':
          - 'talk': 'CIS-2.1.9'
          - 'talk-server': 'CIS-2.1.10'
      description: 'Remove talk and talk-server (Scored)'
      alert: email
      trigger: state

    xinetd:
      data:
        'CentOS Linux-7':
          - 'xinetd': 'CIS-2.1.11'
      description: 'Remove xinetd (Scored)'
      alert: email
      trigger: state

    dhcp:
      data:
        'CentOS Linux-7':
          - 'dhcp': 'CIS-3.5'
      description: 'Remove DHCP server (Scored)'
      alert: email
      trigger: state

    xorg-x11-server-common:
      data:
        'CentOS Linux-7':
          - 'xorg-x11-server-common': 'CIS-3.2'
      description: 'Remove the X Window System (Scored)'

    avahi-daemon:
      data:
        'CentOS Linux-7':
         - 'avahi-daemon' : 'CIS-3.3'
      description: 'Disable Avahi Server (Scored)'

  whitelist:

    aide:
      data:
        'CentOS Linux-7':
          - 'aide': 'CIS-1.3.1'
      description: 'Install AIDE (Scored)'

    firewalld:
      data:
        'CentOS Linux-7':
          - 'firewalld': 'CIS-4.7'
      description: 'Enable firewalld (Scored)'

    rsyslog:
      data:
        'CentOS Linux-7':
          - 'rsyslog': 'CIS-5.1.1'
      description: 'Install rsyslog (Scored)'
      alert: email
      trigger: state

    anacron:
      data:
        'CentOS Linux-7':
          - 'cronie-anacron': 'CIS-6.1.1'
      description: 'Enable anacron Daemon (Scored)'
      alert: email
      trigger: state

stat:
  grub_conf_own:
    data:
      'CentOS-6':
        - '/etc/grub.conf':
            tag: 'CIS-1.5.1'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
      'CentOS Linux-7':
        - '/etc/grub2/grub.cfg':
            tag: 'CIS-1.5.1'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: 'Grub must be owned by root (Scored)'
    alert: email
    trigger: state

  grub_conf_perm:
    data:
      'CentOS-6':
        - '/etc/grub.conf':
            tag: 'CIS-1.5.2'
            mode: 600
      'CentOS Linux-7':
        - '/etc/grub2/grub.cfg':
            tag: 'CIS-1.5.2'
            mode: 600
    description: 'Grub must have permissions 600 (Scored)'
    alert: email
    trigger: state

  hosts_allow:
    data:
      'CentOS Linux-7':
        - '/etc/hosts.allow':
            tag: 'CIS-4.5.3'
            mode: 644
    description: '/etc/hosts.allow must have permissions 644 (Scored)'
    alert: email
    trigger: state

  hosts_deny:
    data:
      'CentOS Linux-7':
        - '/etc/hosts.deny':
            tag: 'CIS-4.5.5'
            mode: 644
    description: '/etc/hosts.deny must have persmissions 644 (Scored)'
    alert: email
    trigger: state

  anacrontab:
    data:
      'CentOS Linux-7':
        - '/etc/anacrontab':
            tag: 'CIS-6.1.3'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/anacrontab file be owned by root and must have permissions 600 (Scored)'
    alert: email
    trigger: state

  crontab:
    data:
      'CentOS Linux-7':
        - '/etc/crontab':
            tag: 'CIS-6.1.4'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/crontab must be owned by root and have persmissions 600 (Scored)'
    alert: email
    trigger: state

  cron_hourly:
    data:
      'CentOS Linux-7':
        - 'etc/cron.hourly':
            tag: 'CIS-6.1.5'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.hourly must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_daily:
    data:
      'CentOS Linux-7':
        - '/etc/cron.daily':
            tag: 'CIS-6.1.6'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.daily must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_weekly:
    data:
      'CentOS Linux-7':
        - '/etc/cron.weekly':
            tag: 'CIS-6.1.7'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.weekly must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_monthly:
    data:
      'CentOS Linux-7':
        - '/etc/cron.monthly':
            tag: 'CIS-6.1.8'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.monthly must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  cron_d:
    data:
      'CentOS Linux-7':
        - '/etc/cron.d':
            tag: 'CIS-6.1.9'
            mode: 700
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/cron.d must be owned by root and must have permissions 700 (Scored)'
    alert: email
    trigger: state

  at_allow:
    data:
      'CentOS Linux-7':
        - '/etc/at.allow':
            tag: 'CIS-6.1.10'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/at.allow must be owned by root and have persmissions 600 (Scored)'
    alert: email
    trigger: state

  at_cron_allow:
    data:
      'CentOS Linux-7':
        - '/etc/cron.deny':
            tag: 'CIS-6.1.11'
            mode: null
            user: null
            uid: null
            group: null
            gid: null
        - '/etc/at.deny':
            tag: 'CIS-6.1.11'
            mode: null
            user: null
            uid: null
            group: null
            gid: null
        - '/etc/cron.allow':
            tag: 'CIS-6.1.11'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
        - '/etc/at/allow':
            tag: 'CIS-6.1.11'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: 'Restrict at/cron to authorized users (Scored)'
    alert: email
    trigger: state

  sshd_config:
    data:
      'CentOS Linux-7':
        - '/etc/ssh/sshd_config':
            tag: 'CIS-6.2.3'
            mode: 600
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/ssh/sshd_config must be owned by root and must have permissions 600 (Scored)'
    alert: email
    trigger: state

  warning_banner:
    data:
      'CentOS Linux-7':
        - '/etc/motd':
            tag: 'CIS-8.1'
            mode: 644
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
        - '/etc/issue':
            tag: 'CIS-8.1'
            mode: 644
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
        - '/etc/issue.net':
            tag: 'CIS-8.1'
            mode: 644
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: 'Files containing the warning banners must be owned by root and must have permissions 644 (Scored)'
    alert: email
    trigger: state

  passwd_perm:
    data:
      'CentOS Linux-7':
        - '/etc/passwd':
            tag: 'CIS-9.1.2'
            mode: 644
    description: '/etc/passwd must have permissions 644 (Scored)'
    alert: email
    trigger: state

  passwd_own:
    data:
      'CentOS Linux-7':
        - '/etc/passwd':
            tag: 'CIS-9.1.6'
            user: 'root'
            uid: 0
            group: 'root'
            uid: 0
    description: '/etc/passwd must be owned by root (Scored)'
    alert: email
    trigger: state

  shadow_perm:
    data:
      'CentOS Linux-7':
        - '/etc/shadow':
            tag: 'CIS-9.1.3'
            mode: 0
    description: '/etc/shadow must have permissions 000 (Scored)'
    alert: email
    trigger: state

  shadow_own:
    data:
      'CentOS Linux-7':
        - '/etc/shadow':
            tag: 'CIS-9.1.7'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/shadow must be owned by root (Scored)'
    alert: email
    trigger: state

  gshadow_perm:
    data:
      'CentOS Linux-7':
        - '/etc/gshadow':
            tag: 'CIS-9.1.4'
            mode: 0
    description: '/etc/gshadow must have permissions 000 (Scored)'
    alert: email
    trigger: state

  gshadow_own:
    data:
      'CentOS Linux-7':
        - '/etc/gshadow':
            tag: 'CIS-9.1.8'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/gshadow must be owned by root (Scored)'
    alert: email
    trigger: state

  group_perm:
    data:
      'CentOS Linux-7':
        - '/etc/group':
            tag: 'CIS-9.1.5'
            mode: 644
    description: '/etc/group must have permissions 000 (Scored)'
    alert: email
    trigger: state

  group_own:
    data:
      'CentOS Linux-7':
        - '/etc/group':
            tag: 'CIS-9.1.9'
            user: 'root'
            uid: 0
            group: 'root'
            gid: 0
    description: '/etc/group must be owned by root (Scored)'
    alert: email
    trigger: state

grep:
  whitelist:

    fstab_tmp_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.1'
              pattern: '/tmp'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.1'
              pattern: '/tmp'
      description: 'Create Separate Partition for /tmp (Scored)'

    fstab_tmp_partition_nodev:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.2'
              pattern: '/tmp'
              match_output: 'nodev'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.2'
              pattern: '/tmp'
              match_output: 'nodev'
      description: 'Set nodev option for /tmp Partition (Scored)'

    fstab_tmp_partition_nosuid:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.3'
              pattern: '/tmp'
              match_output: 'nosuid'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.3'
              pattern: '/tmp'
              match_output: 'nosuid'
      description: 'Set nosuid option for /tmp Partition (Scored)'

    fstab_tmp_partition_noexec:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.4'
              pattern: '/tmp'
              match_output: 'noexec'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.4'
              pattern: '/tmp'
              match_output: 'nosuid'
      description: 'Set noexec option for /tmp Partition (Scored)'

    fstab_var_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.5'
              pattern: '/var'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.5'
              pattern: '/var'
      description: 'Create Separate Partition for /var (Scored)'

    fstab_var_tmp_bind_mount:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.6'
              pattern: '/tmp'
              match_output: '/var/tmp'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.6'
              pattern: '/var'
              match_output: '/var/tmp'
      description: 'Bind Mount the /var/tmp directory to /tmp (Scored)'

    fstab_var_log_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.7'
              pattern: '/var/log'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.7'
              pattern: '/var/log'
      description: 'Create Separate Partition for /var/log (Scored)'

    fstab_var_log_audit_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.8'
              pattern: '/var/log/audit'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.8'
              pattern: '/var/log/audit'
      description: 'Create Separate Partition for /var/log/audit (Scored)'

    fstab_home_partition:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.9'
              pattern: '/home'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.9'
              pattern: '/home'
      description: 'Create Separate Partition for /home (Scored)'

    fstab_home_partition_nodev:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.10'
              pattern: '/home'
              match_output: 'nodev'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.10'
              pattern: '/home'
              match_output: 'nodev'
      description: 'Add nodev Option to /home (Scored)'

    fstab_dev_shm_partition_nodev:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.14'
              pattern: '/dev/shm'
              match_output: 'nodev'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.14'
              pattern: '/dev/shm'
              match_output: 'nodev'
      description: 'Add nodev Option to /dev/shm Partition (Scored)'

    fstab_dev_shm_partition_nosuid:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.15'
              pattern: '/dev/shm'
              match_output: 'nosuid'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.15'
              pattern: '/dev/shm'
              match_output: 'nosuid'
      description: 'Add nosuid Option to /dev/shm Partition (Scored)'

    fstab_dev_shm_partition_noexec:
      data:
        CentOS Linux-7:
          - '/etc/fstab':
              tag: 'CIS-1.1.16'
              pattern: '/dev/shm'
              match_output: 'noexec'
        Ubuntu-14.04:
          - '/etc/fstab':
              tag: 'CIS-2.16'
              pattern: '/dev/shm'
              match_output: 'noexec'
      description: 'Add noexec Option to /dev/shm Partition (Scored)'

    activate_gpg_check:
      data:
        CentOS Linux-7:
          - '/etc/yum.conf':
              tag: 'CIS-1.1.16'
              pattern: 'gpgcheck'
              match_output: 'gpgcheck=1'
      description: 'Verify that gpgcheck is Globally Activated (Scored)'

    boot_loader_passwd:
      data:
        CentOS Linux-7:
          - '/boot/grub2/grub.cfg':
              tag: 'CIS-1.5.3'
              pattern: '^password'
      description: 'Set Boot Loader Password (Scored)'

    restrict_core_dumps:
      data:
        CentOS Linux-7:
          - '/etc/security/limits.conf':
              tag: 'CIS-1.6.1'
              pattern: 'hard core'
      description: 'Restrict Core Dumps (Scored)'

    set_daemon_umask:
      data:
        CentOS Linux-7:
          - '/etc/sysconfig/init':
              tag: 'CIS-3.1'
              pattern: 'umask'
              match_output: 'umask 027'
      description: 'Set Daemon umask (Scored)'

    configure_ntp:
      data:
        CentOS Linux-7:
          - '/etc/ntp.conf':
              tag: 'CIS-3.6'
              pattern: 'restrict default'
          - '/etc/ntp.conf':
              tag: 'CIS-3.6'
              pattern: 'restrict -6 default'
      description: 'Configure Network Time Protocol (NTP) (Scored)'

    rsyslog_remote_logging:
      data:
        CentOS Linux-7:
          - '/etc/rsyslog.conf':
              tag: 'CIS-5.1.5'
              pattern: "^*.*[^I][^I]*@"
      description: 'Configure rsyslog to Send Logs to a Remote Log Host (Scored)'

    sshd_protocol_2:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.1'
              pattern: "^Protocol"
              match_output: 'Protocol 2'
      description: 'Set SSH Protocol to 2 (Scored)'

    sshd_loglevel_info:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.2'
              pattern: "^LogLevel"
              match_output: 'LogLevel INFO'
      description: 'Set LogLevel to INFO (Scored)'

    sshd_x11_forwarding:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.4'
              pattern: "^X11Forwarding"
              match_output: 'X11Forwarding no'
      description: 'Disable SSH X11 Forwarding (Scored)'

    sshd_max_auth_retries:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.5'
              pattern: "^MaxAuthTries"
              match_output: "MaxAuthTries 4"
      description: 'Set SSH MaxAuthTries to 4 or Less (Scored)'

    sshd_ignore_rhosts:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.6'
              pattern: "^IgnoreRhosts"
              match_output: "IgnoreRhosts yes"
      description: 'Set SSH IgnoreRhosts to Yes (Scored)'

    sshd_hostbased_auth:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.7'
              pattern: "^HostbasedAuthentication"
              match_output: "HostbasedAuthentication no"
      description: 'Set SSH HostbasedAuthentication to No (Scored)'

    sshd_disable_root_login:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.8'
              pattern: "^PermitRootLogin"
              match_output: "PermitRootLogin no"
      description: 'Set SSH HostbasedAuthentication to No (Scored)'

    sshd_permit_empty_passwords:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.9'
              pattern: "^PermitEmptyPasswords"
              match_output: "PermitEmptyPasswords no"
      description: 'Set SSH PermitEmptyPasswords to No (Scored)'

    sshd_permit_user_environment:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.10'
              pattern: "^PermitUserEnvironment"
              match_output: "PermitUserEnvironment no"
      description: 'Do Not Allow Users to Set Environment Options (Scored)'

    sshd_approved_cipher:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.11'
              pattern: "Ciphers"
              match_output: "Ciphers aes128-ctr,aes192-ctr,aes256-ctr "
      description: 'Use Only Approved Cipher in Counter Mode (Scored)'

    sshd_idle_timeout:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.12'
              pattern: "^ClientAliveInterval"
              match_output: "ClientAliveInterval 300"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.12'
              pattern: "^ClientAliveCountMatch"
              match_output: "ClientAliveCountMatch 0"
      description: 'Set Idle Timeout Interval for User Login (Scored)'

    sshd_limit_access:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^AllowUsers"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^AllowGroups"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^DenyUsers"
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.13'
              pattern: "^DenyGroups"
      description: 'Limit Access via SSH (Scored)'

    sshd_banner:
      data:
        CentOS Linux-7:
          - '/etc/ssh/sshd_config':
              tag: 'CIS-6.2.14'
              pattern: "^Banner"
      description: 'Set SSH Banner (Scored)'

    passwd_expiration_days:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-7.1.1'
              pattern: "PASS_MAX_DAYS"
              match_output: "90"
      description: 'Set Password Expiration Days (Scored)'

    passwd_change_min_days:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-7.1.2'
              pattern: "PASS_MIN_DAYS"
              match_output: "7"
      description: 'Set Password Change Minimum Number of Days (Scored)'

    passwd_expiry_warning:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-7.1.3'
              pattern: "PASS_WARN_DAYS"
              match_output: "7"
      description: 'Set Password Expiring Warning Days (Scored)'

    default_umask:
      data:
        CentOS Linux-7:
          - '/etc/bashrc':
              tag: 'CIS-7.4'
              pattern: "^umask 077"
          - '/etc/profile.d/*':
              tag: 'CIS-7.4'
              pattern: "^umask 077"
      description: 'Set Default umask for Users (Scored)'

    passwd_hashing_algorithm:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-6.3.1'
              pattern: "^ENCRYPT_METHOD"
              match_output: "SHA512"
      description: 'Upgrade password hashing algorithm to SHA-512 (Scored)'

    passwd_pam_cracklib:
      data:
        CentOS Linux-7:
          - '/etc/pam.d/system-auth':
              tag: 'CIS-6.3.2'
              pattern: "pam_cracklib.so"
      description: 'Set password creation requirement parameters using pam_cracklib (Scored)'

    passwd_pam_cracklib:
      data:
        CentOS Linux-7:
          - '/etc/pam.d/system-auth':
              tag: 'CIS-6.3.2'
              pattern: "pam_cracklib.so"
      description: 'Set password creation requirement parameters using pam_cracklib (Scored)'

    passwd_limit_reuse:
      data:
        CentOS Linux-7:
          - '/etc/pam.d/system-auth':
              tag: 'CIS-6.3.4'
              pattern: "remember"
              match_output: "5"
      description: 'Limit password reuise (Scored)'

    restrict_access_su:
      data:
        CentOS Linux-7:
          - '/etc/pam.d/su':
              tag: 'CIS-6.5'
              pattern: "pam_wheel.so"
      description: 'Restrict access to the su command (Scored)'

    lock_inactive_accounts:
      data:
        CentOS Linux-7:
          - '/etc/default/useradd':
              tag: 'CIS-7.5'
              pattern: "^INACTIVE"
              match_output: "-1"
      description: 'Lock inactive user accounts (Scored)'

  blacklist:
    legacy_passwd_entries:
      data:
        CentOS Linux-7:
          - '/etc/login.defs':
              tag: 'CIS-9.2.2'
              pattern: "^+:"
      description: 'Set Password Expiring Warning Days (Scored)'

{'fraction_non_alphanumeric': 0.12068778829287308, 'fraction_numerical': 0.02841241310609178, 'mean_word_length': 1.3674955139707767, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2455173', 'n_tokens_mistral': 16074, 'n_tokens_neox': 15020, 'n_words': 3566}