###############################################################################
#
# Blueprint for DISA STIG for Red Hat Enterprise Linux 9
#
# Profile Description:
# This profile contains configuration checks that align to the
# DISA STIG for Red Hat Enterprise Linux 9 V2R2.
# In addition to being applicable to Red Hat Enterprise Linux 9, DISA recognizes this
# configuration baseline as applicable to the operating system tier of
# Red Hat technologies that are based on Red Hat Enterprise Linux 9, such as:
# - Red Hat Enterprise Linux Server
# - Red Hat Enterprise Linux Workstation and Desktop
# - Red Hat Enterprise Linux for HPC
# - Red Hat Storage
# - Red Hat Containers with a Red Hat Enterprise Linux 9 image
#
# Profile ID:  xccdf_org.ssgproject.content_profile_stig
# Benchmark ID:  xccdf_org.ssgproject.content_benchmark_RHEL-9
# Benchmark Version:  0.1.75
# XCCDF Version:  1.2
#
# This file was generated by OpenSCAP 1.4.2 using:
# $ oscap xccdf generate fix --profile xccdf_org.ssgproject.content_profile_stig --fix-type blueprint /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
#
# This Blueprint is generated from an OpenSCAP profile without preliminary evaluation.
# It attempts to fix every selected rule, even if the system is already compliant.
#
# How to apply this Blueprint:
# composer-cli blueprints push blueprint.toml
#
###############################################################################

name = "hardened_xccdf_org.ssgproject.content_profile_stig"
description = "DISA STIG for Red Hat Enterprise Linux 9"
version = "0.1.75"
distro="rhel-9.6"
[customizations.openscap]
profile_id = "xccdf_org.ssgproject.content_profile_stig"
# If your hardening data stream is not part of the scap-security-guide package
# provide the absolute path to it (from the root of the image filesystem).
# datastream = "/usr/share/xml/scap/ssg/content/ssg-xxxxx-ds.xml"


[[packages]]
name = "aide"
version = "*"

[customizations]
fips = true

[[packages]]
name = "crypto-policies"
version = "*"

[[customizations.filesystem]]
mountpoint = "/home"
size = 1073741824

[[customizations.filesystem]]
mountpoint = "/tmp"
size = 1073741824

[[customizations.filesystem]]
mountpoint = "/var"
size = 3221225472

[[customizations.filesystem]]
mountpoint = "/var/log"
size = 1073741824

[[customizations.filesystem]]
mountpoint = "/var/log/audit"
size = 10737418240

[[customizations.filesystem]]
mountpoint = "/var/tmp"
size = 1073741824

[[packages]]
name = "sudo"
version = "*"

[[packages]]
name = "gnutls-utils"
version = "*"

[[packages]]
name = "nss-tools"
version = "*"

[[packages]]
name = "rng-tools"
version = "*"

[[packages]]
name = "subscription-manager"
version = "*"

[[packages]]
name = "opensc"
version = "*"

[[packages]]
name = "pcsc-lite"
version = "*"

[[packages]]
name = "openssl-pkcs11"
version = "*"

[[packages]]
name = "rsyslog-gnutls"
version = "*"

[[packages]]
name = "rsyslog"
version = "*"

[[packages]]
name = "firewalld"
version = "*"

[[packages]]
name = "libreswan"
version = "*"

[[packages]]
name = "policycoreutils-python-utils"
version = "*"

[[packages]]
name = "policycoreutils"
version = "*"

[[packages]]
name = "fapolicyd"
version = "*"

[[packages]]
name = "s-nail"
version = "*"

[[packages]]
name = "chrony"
version = "*"

[[packages]]
name = "openssh-clients"
version = "*"

[[packages]]
name = "openssh-server"
version = "*"

[[packages]]
name = "usbguard"
version = "*"

[[packages]]
name = "audispd-plugins"
version = "*"

[[packages]]
name = "audit"
version = "*"

[customizations.kernel]
append = "audit_backlog_limit=8192 audit=1 slub_debug=P page_poison=1 vsyscall=none pti=on"

[customizations.services]
enabled = ["auditd","usbguard","sshd","chronyd","fapolicyd","firewalld","systemd-journald","rsyslog","pcscd"]
disabled = []
masked = ["kdump","autofs","debug-shell"]


