<commit_before>########################################################################
#
# XKEYSCORE kickstart configuration file
#
########################################################################


########################################################################
#
# General configuration
#
########################################################################

# System authorization information
auth --useshadow --passalgo=<PASSWORD>512

# Perform a new installation
install

# License agreement
eula --agreed

# Use CDROM installation media
cdrom
# Use installation tree on server
#url --url=http://198.51.100.17/rhel/7/os/x86_64

# Use graphical install
graphical

# Firewall configuration
firewall --enabled --ssh

# Do not run the Setup Agent on first boot
firstboot --disable

# Keyboard layouts
keyboard --vckeymap=us

# System language
lang en_US.UTF-8

# Networking information
network --bootproto=static --device=link --hostname=xkeyscore.example.com --noipv6 --activate --onboot=yes --gateway=198.51.100.1 --ip=198.51.100.111 --nameserver=198.51.100.1 --netmask=255.255.255.0
#network --bootproto=dhcp --delive=link --hostname=xkeyscore.example.com --noipv6 --activate --onboot=yes

# Reboot after installation
reboot --eject

# Root password
rootpw --iscrypted <PASSWORD>/

# SELinux configuration
selinux --enforcing

# System services
services --enabled=ssh

# System timezone
timezone Etc/UTC --isUtc --ntpservers=0.us.pool.ntp.org,1.us.pool.ntp.org,3.us.pool.ntp.org

# Users and groups
group --name=ssh-allowed --gid=2222
group --name=sudoers --gid=6666
user  --name=bofh --gecos=bofh,,, --password=<PASSWORD> --iscrypted --uid=4242 --gid=4242

########################################################################
#
# Storage configuration
#
########################################################################

bootloader --append="audit=1" --location=mbr

clearpart --all --initlabel

zerombr

### CCE-80145-6
part /boot --asprimary --fstype="xfs" --size=1024 --fsoptions="nodev"
part pv.1 --fstype="lvmpv" --size=1 --grow
volgroup xkeyscore --pesize=16384 pv.1
logvol / --fstype="xfs" --size=1 --grow --name=root --vgname=xkeyscore
logvol swap --fstype="swap" --size=4096 --name=swap --vgname=xkeyscore
### CCE-80144-9, CCE-80145-6
logvol /home --fstype="xfs" --size=2048 --name=home --vgname=xkeyscore --fsoptions="nodev"
### CCE-27173-4, CCE-80149-8, CCE-80150-6, CCE-80151-4, CCE-80145-6
logvol /tmp --fstype="xfs" --size=1024 --name=tmp --vgname=xkeyscore --fsoptions="nodev,noexec,nosuid"
### CCE-26404-4, CCE-80145-6
logvol /var --fstype="xfs" --size=5120 --name=var --vgname=xkeyscore --fsoptions="nodev"
### CCE-26967-0, CCE-80145-6
logvol /var/log --fstype="xfs" --size=5120 --name=log --vgname=xkeyscore --fsoptions="nodev"
### CCE-26971-2, CCE-80145-6
logvol /var/log/audit --fstype="xfs" --size=3072 --name=audit --vgname=xkeyscore --fsoptions="nodev"


########################################################################
#
# Package selection
#
########################################################################

%packages

@base
@core

# Additional packages to install for compliance
### CCE-27096-7
aide
### CCE-80170-4
libreswan
### CCE-27351-6
screen

# Additional packages to install for convenience
openscap
openscap-scanner

%end # %packages


########################################################################
#
# Pre-installation script
#
########################################################################

%pre

%end # %pre


########################################################################
#
# Post-installation script
#
########################################################################

%post
#!/bin/bash

### CCE-26957-1
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

### CCE-27068-6
sed -i -e 's/^umask .*$/umask 027/g' /etc/init.d/functions

### CCE-27286-4
sed -i -e 's/ nullok//g' /etc/pam.d/system-auth-ac

### CCE-27320-1
sed -i -e 's/^#Protocol 2$/Protocol 2/g' /etc/ssh/sshd_config

### CCE-27471-2
sed -i -e 's/^#PermitEmptyPasswords no$/PermitEmptyPasswords no/g' /etc/ssh/sshd_config

### CCE-27309-4
cat << FOOBAR >> /etc/grub.d/01_users

cat << EOF
set superusers="grubadmin"
password_pbkdf2 grubadmin <PASSWORD>.<PASSWORD>18555A282FB8FC2294654100DDBF6BEA84004A493368157BD73C8E9E7911F<PASSWORD>
EOF
FOOBAR

### CCE-27318-5
sed -i -e '/^vc\//d' /etc/securetty

### CCE-27268-2
sed -i -r -e '/^ttyS[0-9]+/d' /etc/securetty

### CCE-80347-8
sed -i -e '/^\[main\]$/a localpkg_gpgcheck=1' /etc/yum.conf

### CCE-80348-6
sed -i -e '/^\[main\]$/a repo_gpgcheck=1' /etc/yum.conf

### CCE-27511-5
ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target

### CCE-27353-2
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27353-2
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27410-0
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27410-0
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27367-2
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27367-2
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27347-4
cat << EOF >> /etc/audit/rules.d/30_access.rules
# CCE-27347-4
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
EOF

### CCE-27447-2
cat << EOF >> /etc/audit/rules.d/30_export.rules
# CCE-27447-2
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k export
EOF

### CCE-27206-2
cat << EOF >> /etc/audit/rules.d/30_delete.rules
# CCE-27206-2
-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
EOF

### CCE-27129-6
cat << EOF >> /etc/audit/rules.d/30_modules.rules
# CCE-27129-6
-w /usr/sbin/insmod -p x -k modules
-w /usr/sbin/rmmod -p x -k modules
-w /usr/sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
EOF

### CCE-80156-3
cat << EOF >> /etc/sysctl.conf
# CCE-80156-3
net.ipv4.conf.default.send_redirects = 0
EOF

### CCE-80156-3
cat << EOF >> /etc/sysctl.conf
# CCE-80156-3
net.ipv4.conf.all.send_redirects = 0
EOF

### CCE-80158-9
cat << EOF >> /etc/sysctl.conf
# CCE-80158-9
net.ipv4.conf.all.accept_redirects = 0
EOF

### CCE-80163-9
cat << EOF >> /etc/sysctl.conf
# CCE-80163-9
net.ipv4.conf.default.accept_redirects = 0
EOF

### CCE-80165-4
cat << EOF >> /etc/sysctl.conf
# CCE-80165-4
net.ipv4.icmp_echo_ignore_broadcasts = 1
EOF

### CCE-27495-1
cat << EOF >> /etc/sysctl.conf
# CCE-27495-1
net.ipv4.tcp_syncookies = 1
EOF

### CCE-27327-6
echo "install bluetooth /bin/true" >> /etc/modprobe.d/bluetooth.conf

### CCE-26828-4
echo "install dccp /bin/true" >> /etc/modprobe.d/dccp.conf

### CCE-27106-4
echo "install sctp /bin/true" >> /etc/modprobe.d/sctp.conf

### CCE-27375-5
sed -i -e 's/^space_left_action *= *.*$/space_left_action = email/g' /etc/audit/auditd.conf

### CCE-27370-6
sed -i -e 's/^admin_space_left_action *= *.*$/admin_space_left_action = single/g' /etc/audit/auditd.conf

### CCE-27341-7
sed -i -e 's/^active *= *.*$/active = yes/g' /etc/audisp/plugins.d/syslog.conf

### CCE-27204-7
cat << EOF >> /etc/audit/rules.d/30_logins.rules
# CCE-27204-7
-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins
EOF

### CCE-27445-6
sed -i -r -e 's/^#?PermitRootLogin .*$/PermitRootLogin no/g' /etc/ssh/sshd_config

### CCE-27082-7
sed -i -r -e 's/^#?ClientAliveCountMax .*$/ClientAliveCountMax 0/g' /etc/ssh/sshd_config

### CCE-27433-2
sed -i -r -e 's/^#?ClientAliveInterval .*$/ClientAliveInterval 300/g' /etc/ssh/sshd_config

### CCE-27314-4
sed -i -r -e 's/^#?Banner .*$/Banner \/etc\/issue/g' /etc/ssh/sshd_config

### CCE-27363-1
sed -i -r -e 's/^#?PermitUserEnvironment .*$/PermitUserEnvironment no/g' /etc/ssh/sshd_config

### CCE-27295-5
sed -i -e '/^# Ciphers and keying$/a Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc' /etc/ssh/sshd_config

### CCE-27051-2
sed -i -e 's/^PASS_MAX_DAYS.*$/PASS_MAX_DAYS\t60/g' /etc/login.defs

### CCE-27002-5
sed -i -e 's/^PASS_MIN_DAYS.*$/PASS_MIN_DAYS\t1/g' /etc/login.defs

### CCE-27127-0
cat << EOF >> /etc/sysctl.conf
# CCE-27127-0
kernel.randomize_va_space = 2
EOF

### CCE-27293-0
sed -i -r -e 's/^#? *(minlen *= *).*$/minlen = 15/g' /etc/security/pwquality.conf

### CCE-27214-6
sed -i -r -e 's/^#? *(dcredit *= *).*$/dcredit = -1/g' /etc/security/pwquality.conf

### CCE-27200-5
sed -i -r -e 's/^#? *(ucredit *= *).*$/ucredit = -1/g' /etc/security/pwquality.conf

### CCE-27345-8
sed -i -r -e 's/^#? *(lcredit *= *).*$/lcredit = -1/g' /etc/security/pwquality.conf

### CCE-27360-7
sed -i -r -e 's/^#? *(ocredit *= *).*$/ocredit = -1/g' /etc/security/pwquality.conf

### CCE-27350-8, CCE-26884-7, CCE-80353-6
for PAM_FILE in /etc/pam.d/password-auth-ac /etc/pam.d/system-auth-ac
do
    sed -i -e '/^auth *sufficient *pam_unix.so.*$/i auth        required      pam_faillock.so preauth silent even_deny_root deny=3 unlock_time=604800 fail_interval=900' ${PAM_FILE}
    sed -i -e '/^auth *sufficient *pam_unix.so.*$/a auth        [default=die] pam_faillock.so authfail even_deny_root deny=3 unlock_time=604800 fail_interval=900' ${PAM_FILE}
    sed -i -e '/^account *required *pam_unix.so.*$/i account     required      pam_faillock.so' ${PAM_FILE}
done

### CCE-26923-3
sed -i -e '/^password *sufficient *pam_unix.so.*$/s/$/ remember=5/g' /etc/pam.d/system-auth-ac

### CCE-80157-1
cat << EOF >> /etc/sysctl.conf
# CCE-80157-1
net.ipv4.ip_forward = 0
EOF

### CCE-80159-7
cat << EOF >> /etc/sysctl.conf
# CCE-80159-7
net.ipv4.conf.all.secure_redirects = 0
EOF

### CCE-80164-7
cat << EOF >> /etc/sysctl.conf
# CCE-80164-7
net.ipv4.conf.default.secure_redirects = 0
EOF

### CCE-80160-5
cat << EOF >> /etc/sysctl.conf
# CCE-80160-5
net.ipv4.conf.all.log_martians = 1
EOF

### CCE-80161-3
cat << EOF >> /etc/sysctl.conf
# CCE-80161-3
net.ipv4.conf.default.log_martians = 1
EOF

### CCE-80166-2
cat << EOF >> /etc/sysctl.conf
# CCE-80166-2
net.ipv4.icmp_ignore_bogus_error_responses = 1
EOF

### CCE-80175-3
cat << EOF >> /etc/sysctl.conf
# CCE-80175-3
net.ipv6.conf.all.disable_ipv6 = 1
EOF

### CCE-80173-8
echo "NOZEROCONF=yes" >> /etc/sysconfig/network

### CCE-27355-7
sed -i -e 's/^INACTIVE=.*$/INACTIVE=35/g' /etc/default/useradd

### CCE-27227-3
echo "install usb-storage /bin/true" >> /etc/modprobe.d/usb-storage.conf

### CCE-26872-2
systemctl disable abrtd.service
systemctl mask abrtd.service
yum -y remove abrt*

### CCE-80345-2
systemctl disable atd.service
systemctl mask atd.service
yum -y remove at

### CCE-80269-4
systemctl disable rhnsd.service
systemctl mask rhnsd.service

### CCE-80259-5
systemctl disable mdmonitor.service
systemctl mask mdmonitor.service

### CCE-80270-2
systemctl disable rhsmcertd.service
systemctl mask rhsmcertd.service

### CCE-80272-8
systemctl disable smartd.service
systemctl mask smartd.service

### CCE-80273-6
systemctl disable sysstat.service
systemctl mask sysstat.service

### CCE-80265-2
systemctl enable psacct.service

### CCE-27349-0
sed -i -e 's/^DefaultZone=.*$/DefaultZone=drop/g' /etc/firewalld/firewalld.conf

### CCE-26952-2
cat << EOF >> /etc/crontab
# CCE-26952-2
05 4 * * * root /usr/sbin/aide --check
EOF

### CCE-27319-3
sed -i -e 's/^max_log_file *= *.*$/max_log_file = 20/g' /etc/audit/auditd.conf

### CCE-27231-0
sed -i -e 's/^max_log_file_action *= *.*$/max_log_file_action = rotate/g' /etc/audit/auditd.conf

### CCE-80137-3
echo "install cramfs /bin/true" >> /etc/modprobe.d/cramfs.conf

### CCE-80138-1
echo "install freevxfs /bin/true" >> /etc/modprobe.d/freevxfs.conf

### CCE-80139-9
echo "install jffs2 /bin/true" >> /etc/modprobe.d/jffs2.conf

### CCE-80140-7
echo "install hfs /bin/true" >> /etc/modprobe.d/hfs.conf

### CCE-80141-5
echo "install hfsplus /bin/true" >> /etc/modprobe.d/hfsplus.conf

### CCE-80142-3
echo "install squashfs /bin/true" >> /etc/modprobe.d/squashfs.conf

### CCE-80143-1
echo "install udf /bin/true" >> /etc/modprobe.d/udf.conf

### CCE-80169-6
echo "*     hard   core    0" >> /etc/security/limits.conf

### CCE-26900-1
cat << EOF >> /etc/sysctl.conf
# CCE-26900-1
fs.suid_dumpable = 0
EOF

### CCE-27050-4
cat << EOF >> /etc/sysctl.conf
# CCE-27050-4
kernel.dmesg_restrict = 1
EOF

### CCE-26548-8
sed -i -e '/^GRUB_CMDLINE_LINUX=.*$/s/\"$/ nousb\"/g' /etc/default/grub

### CCE-27301-1
cat << EOF >> /etc/audit/rules.d/30_session.rules
# CCE-27301-1
-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session
EOF

### CCE-27290-6
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27290-6
-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
EOF

### CCE-27216-1
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27216-1
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules
EOF

### CCE-27299-7
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27299-7
-a always,exit -F arch=b32 -S stime -k audit_time_rules
EOF

### CCE-27219-5
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27219-5
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
EOF

### CCE-27310-2
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27310-2
-w /etc/localtime -p wa -k audit_time_rules
EOF

### CCE-27339-1
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27339-1
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27364-9
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27364-9
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27393-8
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27393-8
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27388-8
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27388-8
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27356-5
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27356-5
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27387-0
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27387-0
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27389-6
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27389-6
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27083-5
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27083-5
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27280-7
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27280-7
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27213-8
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27213-8
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27192-4
cat << EOF >> /etc/audit/rules.d/30_usergroup.rules
# CCE-27192-4
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
EOF

### CCE-27076-9
cat << EOF >> /etc/audit/rules.d/30_network.rules
# CCE-27076-9
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
EOF

### CCE-27168-4
cat << EOF >> /etc/audit/rules.d/30_mac-policy.rules
# CCE-27168-4
-w /etc/selinux/ -p wa -k MAC-policy
EOF

### CCE-27461-3
cat << EOF >> /etc/audit/rules.d/30_sysadmin.rules
# CCE-27461-3
-w /etc/sudoers -p wa -k actions
EOF

### CCE-27437-3
cat << EOF >> /etc/audit/rules.d/30_privileged.rules

########################################################################
#
# Use:
#
#   find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
#
# to find all setuid/setgid programs and create rules for them like
# the ones below. The "find" command should be ran for each system
# partition from which programs can be executed (e.g., /, /var, etc.).
#
########################################################################

# CCE-27437-3
EOF

### CCE-27437-3
PARTITIONS="/ /var"
for PARTITION in $PARTITIONS
do
    for PRIVCMD in $(find ${PARTITION} -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null)
    do
        echo "-a always,exit -F path=${PRIVCMD} -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged" >> /etc/audit/rules.d/30_privileged.rules
    done
done

### CCE-27097-5
cat << EOF >> /etc/audit/rules.d/90_immutable.rules
# CCE-27097-5
-e 2
EOF

### CCE-27303-7
cat << EOF > /etc/issue


********************************************************************
*                                                                  *
* This system is for the use of authorized users only.  Usage of   *
* this system may be monitored and recorded by system personnel.   *
*                                                                  *
* Anyone using this system expressly consents to such monitoring   *
* and is advised that if such monitoring reveals possible          *
* evidence of criminal activity, system personnel may provide the  *
* evidence from such monitoring to law enforcement officials.      *
*                                                                  *
********************************************************************


EOF
cat /etc/issue > /etc/issue.net


########################################################################
#
# "%post" cleanup, final tasks, etc.
#
########################################################################

# Set up SSH public key authentication for the "bofh" user account
mkdir /home/bofh/.ssh
chmod 0700 /home/bofh/.ssh

cat << EOF >> /home/bofh/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCOTRChspAf0HslThIc7HWt8RdKapD1CYtNKdR1gJEa93N5QerhNA0TRpnTKaEp/Gp3uePT5Yc2Dkaxuw/rGFFiWkCKXhtSUplmYvc2Q5V0xWKFYUXsstvv4sW3jpnMwcP40qUbUyLYkp26rHWBQ5pkwDamSc/j1yIl2WGGESu+J882uPPTbp7l9LHioGSai/KABr1E4GpwEKhmq8CTptu+33vFIMGRSuiCyGake36LYE2YIuNlWhp9ynSh5hXotYbbkD3E5yZtg/Aq3zl1n0HYQGN4TY+BeXZz9cWYwjAhuHbTDJDlpOl3F/fjFliACRnJSFd14p33TTARRRXB+nM7o3n+cfBbcaJ8sk68RhWM6Irp1gBxPgS+9ibfnqUuwAo5l5AIu1SoHAUL0+jj0zw5SPqJNXqJGmbA9WhItsdSDjNdGKgluFVx0tOBcNrGEWhFeWIta9YEJzvJh0gdJF3lyXfubbNxeGrJFNqQMdMCopsZ31ZSCCZw8mRd2xV7K/ytKvNkDOWKH4cV/mnQq7Gh9ZxHYss4TfH0WtCrj7x/W5xxaF/ZgcTbHhYlQ8sw3PsIaNCpMPqRqfkizG82ZnKXQX/pXeB+SEYULkFvtlXWzRy+7f2P0bhM5uhSD/lTSNZ7G97B5s262giN68T/WcDSTFJYjXa/rWHRwootbfCRQ== bofh@xks-vm
EOF
chmod 0400 /home/bofh/.ssh/authorized_keys

chown -R bofh:bofh /home/bofh
restorecon -r /home/bofh/.ssh/

# Regenerate the configuration file for the grub2 boot loader
grub2-mkconfig -o /boot/grub2/grub.cfg

### CCE-27054-6
chmod 0600 /boot/grub2/grub.cfg

### CCE-80155-5
echo "/tmp /var/tmp none rw,nodev,noexec,nosuid,bind 0 0" >> /etc/fstab

# Add entry to /etc/fstab for CD/DVD drive and create mount point
### CCE-80146-4, CCE-80147-2, CCE-80148-0
echo "/dev/cdrom /mnt/cdrom iso9660 noauto,owner,ro,user,nodev,noexec,nosuid 0 0" >> /etc/fstab
mkdir /mnt/cdrom

### CCE-27220-3
aide --init
cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

mkdir -p /srv/backups/aide
chmod 0700 /srv/backups /srv/backups/aide
cp -p /var/lib/aide/aide.db.new.gz /srv/backups/aide/aide.db.$(date +%s).gz
chmod 0400 /srv/backups/aide/aide.db.*.gz

%end # %post


########################################################################
#
# kdump add-on
#
########################################################################

%addon com_redhat_kdump --disable --reserve-mb='128M'
%end # %addon


########################################################################
#
# That's all, folks!  http://evilrouters.net/the_end/
#
########################################################################
<commit_msg>CCE-80191-0: rsyslog_files_permissions<commit_after>########################################################################
#
# XKEYSCORE kickstart configuration file
#
########################################################################


########################################################################
#
# General configuration
#
########################################################################

# System authorization information
auth --useshadow --passalgo=<PASSWORD>512

# Perform a new installation
install

# License agreement
eula --agreed

# Use CDROM installation media
cdrom
# Use installation tree on server
#url --url=http://198.51.100.17/rhel/7/os/x86_64

# Use graphical install
graphical

# Firewall configuration
firewall --enabled --ssh

# Do not run the Setup Agent on first boot
firstboot --disable

# Keyboard layouts
keyboard --vckeymap=us

# System language
lang en_US.UTF-8

# Networking information
network --bootproto=static --device=link --hostname=xkeyscore.example.com --noipv6 --activate --onboot=yes --gateway=198.51.100.1 --ip=198.51.100.111 --nameserver=198.51.100.1 --netmask=255.255.255.0
#network --bootproto=dhcp --delive=link --hostname=xkeyscore.example.com --noipv6 --activate --onboot=yes

# Reboot after installation
reboot --eject

# Root password
rootpw --iscrypted $<PASSWORD>/

# SELinux configuration
selinux --enforcing

# System services
services --enabled=ssh

# System timezone
timezone Etc/UTC --isUtc --ntpservers=0.us.pool.ntp.org,1.us.pool.ntp.org,3.us.pool.ntp.org

# Users and groups
group --name=ssh-allowed --gid=2222
group --name=sudoers --gid=6666
user  --name=bofh --gecos=bofh,,, --password=<PASSWORD> --iscrypted --uid=4242 --gid=4242

########################################################################
#
# Storage configuration
#
########################################################################

bootloader --append="audit=1" --location=mbr

clearpart --all --initlabel

zerombr

### CCE-80145-6
part /boot --asprimary --fstype="xfs" --size=1024 --fsoptions="nodev"
part pv.1 --fstype="lvmpv" --size=1 --grow
volgroup xkeyscore --pesize=16384 pv.1
logvol / --fstype="xfs" --size=1 --grow --name=root --vgname=xkeyscore
logvol swap --fstype="swap" --size=4096 --name=swap --vgname=xkeyscore
### CCE-80144-9, CCE-80145-6
logvol /home --fstype="xfs" --size=2048 --name=home --vgname=xkeyscore --fsoptions="nodev"
### CCE-27173-4, CCE-80149-8, CCE-80150-6, CCE-80151-4, CCE-80145-6
logvol /tmp --fstype="xfs" --size=1024 --name=tmp --vgname=xkeyscore --fsoptions="nodev,noexec,nosuid"
### CCE-26404-4, CCE-80145-6
logvol /var --fstype="xfs" --size=5120 --name=var --vgname=xkeyscore --fsoptions="nodev"
### CCE-26967-0, CCE-80145-6
logvol /var/log --fstype="xfs" --size=5120 --name=log --vgname=xkeyscore --fsoptions="nodev"
### CCE-26971-2, CCE-80145-6
logvol /var/log/audit --fstype="xfs" --size=3072 --name=audit --vgname=xkeyscore --fsoptions="nodev"


########################################################################
#
# Package selection
#
########################################################################

%packages

@base
@core

# Additional packages to install for compliance
### CCE-27096-7
aide
### CCE-80170-4
libreswan
### CCE-27351-6
screen

# Additional packages to install for convenience
openscap
openscap-scanner

%end # %packages


########################################################################
#
# Pre-installation script
#
########################################################################

%pre

%end # %pre


########################################################################
#
# Post-installation script
#
########################################################################

%post
#!/bin/bash

### CCE-26957-1
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

### CCE-27068-6
sed -i -e 's/^umask .*$/umask 027/g' /etc/init.d/functions

### CCE-27286-4
sed -i -e 's/ nullok//g' /etc/pam.d/system-auth-ac

### CCE-27320-1
sed -i -e 's/^#Protocol 2$/Protocol 2/g' /etc/ssh/sshd_config

### CCE-27471-2
sed -i -e 's/^#PermitEmptyPasswords no$/PermitEmptyPasswords no/g' /etc/ssh/sshd_config

### CCE-27309-4
cat << FOOBAR >> /etc/grub.d/01_users

cat << EOF
set superusers="grubadmin"
password_pbkdf2 <PASSWORD> <PASSWORD>.<PASSWORD>E<PASSWORD>
EOF
FOOBAR

### CCE-27318-5
sed -i -e '/^vc\//d' /etc/securetty

### CCE-27268-2
sed -i -r -e '/^ttyS[0-9]+/d' /etc/securetty

### CCE-80347-8
sed -i -e '/^\[main\]$/a localpkg_gpgcheck=1' /etc/yum.conf

### CCE-80348-6
sed -i -e '/^\[main\]$/a repo_gpgcheck=1' /etc/yum.conf

### CCE-27511-5
ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target

### CCE-27353-2
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27353-2
-a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27410-0
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27410-0
-a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27367-2
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27367-2
-a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27347-4
cat << EOF >> /etc/audit/rules.d/30_access.rules
# CCE-27347-4
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
EOF

### CCE-27447-2
cat << EOF >> /etc/audit/rules.d/30_export.rules
# CCE-27447-2
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k export
EOF

### CCE-27206-2
cat << EOF >> /etc/audit/rules.d/30_delete.rules
# CCE-27206-2
-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
EOF

### CCE-27129-6
cat << EOF >> /etc/audit/rules.d/30_modules.rules
# CCE-27129-6
-w /usr/sbin/insmod -p x -k modules
-w /usr/sbin/rmmod -p x -k modules
-w /usr/sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
EOF

### CCE-80156-3
cat << EOF >> /etc/sysctl.conf
# CCE-80156-3
net.ipv4.conf.default.send_redirects = 0
EOF

### CCE-80156-3
cat << EOF >> /etc/sysctl.conf
# CCE-80156-3
net.ipv4.conf.all.send_redirects = 0
EOF

### CCE-80158-9
cat << EOF >> /etc/sysctl.conf
# CCE-80158-9
net.ipv4.conf.all.accept_redirects = 0
EOF

### CCE-80163-9
cat << EOF >> /etc/sysctl.conf
# CCE-80163-9
net.ipv4.conf.default.accept_redirects = 0
EOF

### CCE-80165-4
cat << EOF >> /etc/sysctl.conf
# CCE-80165-4
net.ipv4.icmp_echo_ignore_broadcasts = 1
EOF

### CCE-27495-1
cat << EOF >> /etc/sysctl.conf
# CCE-27495-1
net.ipv4.tcp_syncookies = 1
EOF

### CCE-27327-6
echo "install bluetooth /bin/true" >> /etc/modprobe.d/bluetooth.conf

### CCE-26828-4
echo "install dccp /bin/true" >> /etc/modprobe.d/dccp.conf

### CCE-27106-4
echo "install sctp /bin/true" >> /etc/modprobe.d/sctp.conf

### CCE-27375-5
sed -i -e 's/^space_left_action *= *.*$/space_left_action = email/g' /etc/audit/auditd.conf

### CCE-27370-6
sed -i -e 's/^admin_space_left_action *= *.*$/admin_space_left_action = single/g' /etc/audit/auditd.conf

### CCE-27341-7
sed -i -e 's/^active *= *.*$/active = yes/g' /etc/audisp/plugins.d/syslog.conf

### CCE-27204-7
cat << EOF >> /etc/audit/rules.d/30_logins.rules
# CCE-27204-7
-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins
EOF

### CCE-27445-6
sed -i -r -e 's/^#?PermitRootLogin .*$/PermitRootLogin no/g' /etc/ssh/sshd_config

### CCE-27082-7
sed -i -r -e 's/^#?ClientAliveCountMax .*$/ClientAliveCountMax 0/g' /etc/ssh/sshd_config

### CCE-27433-2
sed -i -r -e 's/^#?ClientAliveInterval .*$/ClientAliveInterval 300/g' /etc/ssh/sshd_config

### CCE-27314-4
sed -i -r -e 's/^#?Banner .*$/Banner \/etc\/issue/g' /etc/ssh/sshd_config

### CCE-27363-1
sed -i -r -e 's/^#?PermitUserEnvironment .*$/PermitUserEnvironment no/g' /etc/ssh/sshd_config

### CCE-27295-5
sed -i -e '/^# Ciphers and keying$/a Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc' /etc/ssh/sshd_config

### CCE-27051-2
sed -i -e 's/^PASS_MAX_DAYS.*$/PASS_MAX_DAYS\t60/g' /etc/login.defs

### CCE-27002-5
sed -i -e 's/^PASS_MIN_DAYS.*$/PASS_MIN_DAYS\t1/g' /etc/login.defs

### CCE-27127-0
cat << EOF >> /etc/sysctl.conf
# CCE-27127-0
kernel.randomize_va_space = 2
EOF

### CCE-80191-0
for LOGFILE in boot.log dmesg cron maillog messages secure spooler
do
    chmod 0600 /var/log/${LOGFILE}
    chown root:root /var/log/${LOGFILE}
done
cat << EOF >> /etc/rc.d/rc.local
# CCE-80191-0
sleep 5
chmod 0600 /var/log/boot.log /var/log/dmesg
EOF
chmod 0700 /etc/rc.d/rc.local

### CCE-27293-0
sed -i -r -e 's/^#? *(minlen *= *).*$/minlen = 15/g' /etc/security/pwquality.conf

### CCE-27214-6
sed -i -r -e 's/^#? *(dcredit *= *).*$/dcredit = -1/g' /etc/security/pwquality.conf

### CCE-27200-5
sed -i -r -e 's/^#? *(ucredit *= *).*$/ucredit = -1/g' /etc/security/pwquality.conf

### CCE-27345-8
sed -i -r -e 's/^#? *(lcredit *= *).*$/lcredit = -1/g' /etc/security/pwquality.conf

### CCE-27360-7
sed -i -r -e 's/^#? *(ocredit *= *).*$/ocredit = -1/g' /etc/security/pwquality.conf

### CCE-27350-8, CCE-26884-7, CCE-80353-6
for PAM_FILE in /etc/pam.d/password-auth-ac /etc/pam.d/system-auth-ac
do
    sed -i -e '/^auth *sufficient *pam_unix.so.*$/i auth        required      pam_faillock.so preauth silent even_deny_root deny=3 unlock_time=604800 fail_interval=900' ${PAM_FILE}
    sed -i -e '/^auth *sufficient *pam_unix.so.*$/a auth        [default=die] pam_faillock.so authfail even_deny_root deny=3 unlock_time=604800 fail_interval=900' ${PAM_FILE}
    sed -i -e '/^account *required *pam_unix.so.*$/i account     required      pam_faillock.so' ${PAM_FILE}
done

### CCE-26923-3
sed -i -e '/^password *sufficient *pam_unix.so.*$/s/$/ remember=5/g' /etc/pam.d/system-auth-ac

### CCE-80157-1
cat << EOF >> /etc/sysctl.conf
# CCE-80157-1
net.ipv4.ip_forward = 0
EOF

### CCE-80159-7
cat << EOF >> /etc/sysctl.conf
# CCE-80159-7
net.ipv4.conf.all.secure_redirects = 0
EOF

### CCE-80164-7
cat << EOF >> /etc/sysctl.conf
# CCE-80164-7
net.ipv4.conf.default.secure_redirects = 0
EOF

### CCE-80160-5
cat << EOF >> /etc/sysctl.conf
# CCE-80160-5
net.ipv4.conf.all.log_martians = 1
EOF

### CCE-80161-3
cat << EOF >> /etc/sysctl.conf
# CCE-80161-3
net.ipv4.conf.default.log_martians = 1
EOF

### CCE-80166-2
cat << EOF >> /etc/sysctl.conf
# CCE-80166-2
net.ipv4.icmp_ignore_bogus_error_responses = 1
EOF

### CCE-80175-3
cat << EOF >> /etc/sysctl.conf
# CCE-80175-3
net.ipv6.conf.all.disable_ipv6 = 1
EOF

### CCE-80173-8
echo "NOZEROCONF=yes" >> /etc/sysconfig/network

### CCE-27355-7
sed -i -e 's/^INACTIVE=.*$/INACTIVE=35/g' /etc/default/useradd

### CCE-27227-3
echo "install usb-storage /bin/true" >> /etc/modprobe.d/usb-storage.conf

### CCE-26872-2
systemctl disable abrtd.service
systemctl mask abrtd.service
yum -y remove abrt*

### CCE-80345-2
systemctl disable atd.service
systemctl mask atd.service
yum -y remove at

### CCE-80269-4
systemctl disable rhnsd.service
systemctl mask rhnsd.service

### CCE-80259-5
systemctl disable mdmonitor.service
systemctl mask mdmonitor.service

### CCE-80270-2
systemctl disable rhsmcertd.service
systemctl mask rhsmcertd.service

### CCE-80272-8
systemctl disable smartd.service
systemctl mask smartd.service

### CCE-80273-6
systemctl disable sysstat.service
systemctl mask sysstat.service

### CCE-80265-2
systemctl enable psacct.service

### CCE-27349-0
sed -i -e 's/^DefaultZone=.*$/DefaultZone=drop/g' /etc/firewalld/firewalld.conf

### CCE-26952-2
cat << EOF >> /etc/crontab
# CCE-26952-2
05 4 * * * root /usr/sbin/aide --check
EOF

### CCE-27319-3
sed -i -e 's/^max_log_file *= *.*$/max_log_file = 20/g' /etc/audit/auditd.conf

### CCE-27231-0
sed -i -e 's/^max_log_file_action *= *.*$/max_log_file_action = rotate/g' /etc/audit/auditd.conf

### CCE-80137-3
echo "install cramfs /bin/true" >> /etc/modprobe.d/cramfs.conf

### CCE-80138-1
echo "install freevxfs /bin/true" >> /etc/modprobe.d/freevxfs.conf

### CCE-80139-9
echo "install jffs2 /bin/true" >> /etc/modprobe.d/jffs2.conf

### CCE-80140-7
echo "install hfs /bin/true" >> /etc/modprobe.d/hfs.conf

### CCE-80141-5
echo "install hfsplus /bin/true" >> /etc/modprobe.d/hfsplus.conf

### CCE-80142-3
echo "install squashfs /bin/true" >> /etc/modprobe.d/squashfs.conf

### CCE-80143-1
echo "install udf /bin/true" >> /etc/modprobe.d/udf.conf

### CCE-80169-6
echo "*     hard   core    0" >> /etc/security/limits.conf

### CCE-26900-1
cat << EOF >> /etc/sysctl.conf
# CCE-26900-1
fs.suid_dumpable = 0
EOF

### CCE-27050-4
cat << EOF >> /etc/sysctl.conf
# CCE-27050-4
kernel.dmesg_restrict = 1
EOF

### CCE-26548-8
sed -i -e '/^GRUB_CMDLINE_LINUX=.*$/s/\"$/ nousb\"/g' /etc/default/grub

### CCE-27301-1
cat << EOF >> /etc/audit/rules.d/30_session.rules
# CCE-27301-1
-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session
EOF

### CCE-27290-6
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27290-6
-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
EOF

### CCE-27216-1
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27216-1
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules
EOF

### CCE-27299-7
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27299-7
-a always,exit -F arch=b32 -S stime -k audit_time_rules
EOF

### CCE-27219-5
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27219-5
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
EOF

### CCE-27310-2
cat << EOF >> /etc/audit/rules.d/30_time.rules
# CCE-27310-2
-w /etc/localtime -p wa -k audit_time_rules
EOF

### CCE-27339-1
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27339-1
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27364-9
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27364-9
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27393-8
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27393-8
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27388-8
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27388-8
-a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27356-5
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27356-5
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27387-0
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27387-0
-a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27389-6
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27389-6
-a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27083-5
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27083-5
-a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27280-7
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27280-7
-a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27213-8
cat << EOF >> /etc/audit/rules.d/30_perm_mod.rules
# CCE-27213-8
-a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
EOF

### CCE-27192-4
cat << EOF >> /etc/audit/rules.d/30_usergroup.rules
# CCE-27192-4
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
EOF

### CCE-27076-9
cat << EOF >> /etc/audit/rules.d/30_network.rules
# CCE-27076-9
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
EOF

### CCE-27168-4
cat << EOF >> /etc/audit/rules.d/30_mac-policy.rules
# CCE-27168-4
-w /etc/selinux/ -p wa -k MAC-policy
EOF

### CCE-27461-3
cat << EOF >> /etc/audit/rules.d/30_sysadmin.rules
# CCE-27461-3
-w /etc/sudoers -p wa -k actions
EOF

### CCE-27437-3
cat << EOF >> /etc/audit/rules.d/30_privileged.rules

########################################################################
#
# Use:
#
#   find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
#
# to find all setuid/setgid programs and create rules for them like
# the ones below. The "find" command should be ran for each system
# partition from which programs can be executed (e.g., /, /var, etc.).
#
########################################################################

# CCE-27437-3
EOF

### CCE-27437-3
PARTITIONS="/ /var"
for PARTITION in $PARTITIONS
do
    for PRIVCMD in $(find ${PARTITION} -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null)
    do
        echo "-a always,exit -F path=${PRIVCMD} -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged" >> /etc/audit/rules.d/30_privileged.rules
    done
done

### CCE-27097-5
cat << EOF >> /etc/audit/rules.d/90_immutable.rules
# CCE-27097-5
-e 2
EOF

### CCE-27303-7
cat << EOF > /etc/issue


********************************************************************
*                                                                  *
* This system is for the use of authorized users only.  Usage of   *
* this system may be monitored and recorded by system personnel.   *
*                                                                  *
* Anyone using this system expressly consents to such monitoring   *
* and is advised that if such monitoring reveals possible          *
* evidence of criminal activity, system personnel may provide the  *
* evidence from such monitoring to law enforcement officials.      *
*                                                                  *
********************************************************************


EOF
cat /etc/issue > /etc/issue.net


########################################################################
#
# "%post" cleanup, final tasks, etc.
#
########################################################################

# Set up SSH public key authentication for the "bofh" user account
mkdir /home/bofh/.ssh
chmod 0700 /home/bofh/.ssh

cat << EOF >> /home/bofh/.ssh/authorized_keys
ssh-rsa <KEY>== bofh@xks-vm
EOF
chmod 0400 /home/bofh/.ssh/authorized_keys

chown -R bofh:bofh /home/bofh
restorecon -r /home/bofh/.ssh/

# Regenerate the configuration file for the grub2 boot loader
grub2-mkconfig -o /boot/grub2/grub.cfg

### CCE-27054-6
chmod 0600 /boot/grub2/grub.cfg

### CCE-80155-5
echo "/tmp /var/tmp none rw,nodev,noexec,nosuid,bind 0 0" >> /etc/fstab

# Add entry to /etc/fstab for CD/DVD drive and create mount point
### CCE-80146-4, CCE-80147-2, CCE-80148-0
echo "/dev/cdrom /mnt/cdrom iso9660 noauto,owner,ro,user,nodev,noexec,nosuid 0 0" >> /etc/fstab
mkdir /mnt/cdrom

### CCE-27220-3
aide --init
cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

mkdir -p /srv/backups/aide
chmod 0700 /srv/backups /srv/backups/aide
cp -p /var/lib/aide/aide.db.new.gz /srv/backups/aide/aide.db.$(date +%s).gz
chmod 0400 /srv/backups/aide/aide.db.*.gz

%end # %post


########################################################################
#
# kdump add-on
#
########################################################################

%addon com_redhat_kdump --disable --reserve-mb='128M'
%end # %addon


########################################################################
#
# That's all, folks!  http://evilrouters.net/the_end/
#
########################################################################

{'fraction_non_alphanumeric': 0.22760191300387156, 'fraction_numerical': 0.09253017535868822, 'mean_word_length': 3.6134692162218953, 'pattern_counts': {'":': 0, '<': 223, '<?xml version=': 0, '>': 353, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 10, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 12, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1271559', 'n_tokens_mistral': 20495, 'n_tokens_neox': 18029, 'n_words': 3902}