packages/scap-security-guide
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
scap-security-guide/add-80-rules-for-openeuler.patch
qsw33 b8c79f7915 enable 80 rules for openEuler
2023-11-17 17:29:27 +08:00

2735 lines
128 KiB
Diff
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

From 941e961d84f0c1610134b367364a0f66b82cc9f9 Mon Sep 17 00:00:00 2001
From: qsw333 <wangqingsan@huawei.com>
Date: Thu, 16 Nov 2023 13:50:38 +0800
Subject: [PATCH] second
---
.../base/service_haveged_enabled/rule.yml | 31 +++++++
.../service_dhcpd_disabled/rule.yml | 2 +-
.../service_named_disabled/rule.yml | 2 +-
.../package_httpd_removed/rule.yml | 2 +-
.../package_openldap-clients_removed/rule.yml | 23 +++++
.../service_rpcbind_disabled/rule.yml | 2 +-
.../service_nfs-server_disabled/rule.yml | 33 +++++++
linux_os/guide/services/rsync/group.yml | 9 ++
.../rsync/service_rsyncd_disabled/rule.yml | 20 ++++
.../service_smb_disabled/rule.yml | 2 +-
.../oval/shared.xml | 25 +++++
.../rule.yml | 16 ++++
.../oval/shared.xml | 25 +++++
.../rule.yml | 19 ++++
.../oval/shared.xml | 25 +++++
.../rule.yml | 18 ++++
.../oval/shared.xml | 25 +++++
.../sshd_configure_correct_interface/rule.yml | 18 ++++
.../oval/shared.xml | 25 +++++
.../sshd_disable_AllowTcpForwardindg/rule.yml | 18 ++++
.../oval/shared.xml | 25 +++++
.../sshd_disable_x11_forwarding/rule.yml | 16 ++++
.../oval/shared.xml | 25 +++++
.../rule.yml | 18 ++++
.../uninstall_software_service/group.yml | 5 +
.../network_sniffing_tools/rule.yml | 24 +++++
.../rule.yml | 2 +-
.../no_forward_files/oval/shared.xml | 20 ++++
.../no_forward_files/rule.yml | 17 ++++
.../rule.yml | 27 ++++++
.../rule.yml | 2 +-
.../rule.yml | 2 +-
.../rule.yml | 2 +-
.../rule.yml | 2 +-
.../rule.yml | 25 +++++
.../oval/shared.xml | 25 +++++
.../audit_rule_admin_privilege/rule.yml | 27 ++++++
.../oval/shared.xml | 25 +++++
.../rule.yml | 56 +++++++++++
.../auditd_data_retention_space_left/rule.yml | 2 +-
.../auditing/grub2_audit_argument/rule.yml | 2 +-
.../rule.yml | 2 +-
.../oval/shared.xml | 25 +++++
.../configure_dump_journald_log/rule.yml | 22 +++++
.../rule.yml | 19 ++++
.../configure_rsyslog_log_rotate/rule.yml | 45 +++++++++
.../configure_service_logging/rule.yml | 21 +++++
.../diasable_root_accessing_system/rule.yml | 35 +++++++
.../rsyslog_files_permissions/oval/shared.xml | 1 +
.../oval/shared.xml | 25 +++++
.../rule.yml | 24 +++++
.../rsyslog_remote_loghost/oval/shared.xml | 1 +
.../rule.yml | 28 ++++++
.../rule.yml | 36 +++++++
.../rule.yml | 27 ++++++
.../rule.yml | 36 +++++++
.../rule.yml | 28 ++++++
.../wireless_disable_interfaces/rule.yml | 2 +-
.../rule.yml | 26 ++++++
.../system/network/network_nftables/group.yml | 12 +++
.../rule.yml | 32 +++++++
.../rule.yml | 24 +++++
.../rule.yml | 21 +++++
.../rule.yml | 23 +++++
.../rule.yml | 22 +++++
.../service_nftables_enabled/rule.yml | 22 +++++
.../define_ld_lib_path_correctly/rule.yml | 25 +++++
.../files/define_path_strictly/rule.yml | 31 +++++++
.../no_files_globally_writable_files/rule.yml | 34 +++++++
.../rule.yml | 28 ++++++
.../partitions_mounted_nodev_mode/rule.yml | 48 ++++++++++
.../partitions_mounted_noexec_mode/rule.yml | 19 ++++
.../partitions_mounted_nosuid_mode/rule.yml | 27 ++++++
.../rule.yml | 28 ++++++
.../read_only_partitions_no_modified/rule.yml | 19 ++++
.../rule.yml | 29 ++++++
.../sysctl_kernel_yama_ptrace_scope/rule.yml | 2 +-
.../rule.yml | 28 ++++++
.../system/software/enabled_seccomp/rule.yml | 35 +++++++
.../crypto/configure_crypto_policy/rule.yml | 2 +-
.../aide/aide_build_database/oval/shared.xml | 1 +
.../aide/enable_aide_detection/rule.yml | 29 ++++++
.../ima_verification/rule.yml | 47 ++++++++++
.../rule.yml | 18 ++++
.../disabled_SysRq/oval/shared.xml | 25 +++++
.../system-tools/disabled_SysRq/rule.yml | 20 ++++
.../uninstall_debugging_tools/rule.yml | 23 +++++
.../rule.yml | 26 ++++++
openeuler2203/profiles/standard.profile | 93 +++++++++++++++++++
89 files changed, 1869 insertions(+), 16 deletions(-)
create mode 100644 linux_os/guide/services/base/service_haveged_enabled/rule.yml
create mode 100644 linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml
create mode 100644 linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs-server_disabled/rule.yml
create mode 100644 linux_os/guide/services/rsync/group.yml
create mode 100644 linux_os/guide/services/rsync/service_rsyncd_disabled/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/oval/shared.xml
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/rule.yml
create mode 100644 linux_os/guide/services/uninstall_software_service/group.yml
create mode 100644 linux_os/guide/services/uninstall_software_service/network_sniffing_tools/rule.yml
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/oval/shared.xml
create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_privilege_escalation_command/rule.yml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/rule.yml
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/oval/shared.xml
create mode 100644 linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/rule.yml
create mode 100644 linux_os/guide/system/logging/configure_dump_journald_log/oval/shared.xml
create mode 100644 linux_os/guide/system/logging/configure_dump_journald_log/rule.yml
create mode 100644 linux_os/guide/system/logging/configure_first_logging_change_password/rule.yml
create mode 100644 linux_os/guide/system/logging/configure_rsyslog_log_rotate/rule.yml
create mode 100644 linux_os/guide/system/logging/configure_service_logging/rule.yml
create mode 100644 linux_os/guide/system/logging/diasable_root_accessing_system/rule.yml
create mode 100644 linux_os/guide/system/logging/recorded_authentication_related_event/oval/shared.xml
create mode 100644 linux_os/guide/system/logging/recorded_authentication_related_event/rule.yml
create mode 100644 linux_os/guide/system/logging/warning_banners_contain_reasonable_information/rule.yml
create mode 100644 linux_os/guide/system/network/network-iptables/iptables_association_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network-iptables/iptables_input_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network-iptables/iptables_loopback_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network-iptables/iptables_output_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network_interface_binding_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network_nftables/group.yml
create mode 100644 linux_os/guide/system/network/network_nftables/nftables_association_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network_nftables/nftables_configure_default_deny_policy/rule.yml
create mode 100644 linux_os/guide/system/network/network_nftables/nftables_input_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network_nftables/nftables_loopback_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network_nftables/nftables_output_policy_configured_corrently/rule.yml
create mode 100644 linux_os/guide/system/network/network_nftables/service_nftables_enabled/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/define_ld_lib_path_correctly/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/define_path_strictly/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/no_files_globally_writable_files/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/partitions_manage_hard_drive_data/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/partitions_mounted_nodev_mode/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/partitions_mounted_noexec_mode/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/partitions_mounted_nosuid_mode/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/partitoin_mounted_noexec_or_nodev/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/read_only_partitions_no_modified/rule.yml
create mode 100644 linux_os/guide/system/permissions/files/removed_unnecessary_file_mount_support/rule.yml
create mode 100644 linux_os/guide/system/selinux/disabled_unconfined_service_t_programs/rule.yml
create mode 100644 linux_os/guide/system/software/enabled_seccomp/rule.yml
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/aide/enable_aide_detection/rule.yml
create mode 100644 linux_os/guide/system/software/integrity/software-integrity/ima_verification/rule.yml
create mode 100644 linux_os/guide/system/software/sudo/sudoers_disable_low_privileged_configure/rule.yml
create mode 100644 linux_os/guide/system/software/system-tools/disabled_SysRq/oval/shared.xml
create mode 100644 linux_os/guide/system/software/system-tools/disabled_SysRq/rule.yml
create mode 100644 linux_os/guide/system/software/uninstall_debugging_tools/rule.yml
create mode 100644 linux_os/guide/system/software/uninstall_development_and_compliation_tools/rule.yml
diff --git a/linux_os/guide/services/base/service_haveged_enabled/rule.yml b/linux_os/guide/services/base/service_haveged_enabled/rule.yml
new file mode 100644
index 0000000..a2e373a
--- /dev/null
+++ b/linux_os/guide/services/base/service_haveged_enabled/rule.yml
@@ -0,0 +1,31 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Enable haveged service'
+
+description: |-
+ The haveged service provides an easy-to-use, unpredictable random number
+ generator. The generated random numbers are used to supplement the system
+ entropy pool, which can solve the problem of low system entropy in some
+ cases. It is recommended to enable this service in scenarios where encryption,
+ decryption or key generation is required (such as using openssl and gnutls).
+
+ If the haveged service is not turned on, when the process that needs to
+ generate strong pseudo-random numbers gets values from /dev/random, it will
+ be stuck in waiting because it cannot get enough values, and will not return
+ until new random bytes are obtained.
+
+severity: low
+
+rationale: |-
+ none.
+
+ocil: '{{{ ocil_service_disabled(service="haveged") }}}'
+
+platform: machine
+
+template:
+ name: service_enabled
+ vars:
+ servicename: haveged
\ No newline at end of file
diff --git a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml
index efe3519..4d41613 100644
--- a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml
+++ b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: rhel6,rhel7,rhel8
+prodtype: rhel6,rhel7,rhel8,openeuler2203
title: 'Disable DHCP Service'
diff --git a/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml b/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml
index 62c1bf0..7add584 100644
--- a/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml
+++ b/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: rhel6,rhel7,rhel8
+prodtype: rhel6,rhel7,rhel8,openeuler2203
title: 'Disable named Service'
diff --git a/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml b/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml
index b9a6437..8156243 100644
--- a/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml
+++ b/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: rhel6,rhel7,rhel8
+prodtype: rhel6,rhel7,rhel8,openeuler2203
title: 'Uninstall httpd Package'
diff --git a/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml b/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml
new file mode 100644
index 0000000..717c04b
--- /dev/null
+++ b/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml
@@ -0,0 +1,23 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Remove LDAP Client'
+
+description: |-
+ LDAP (Lightweight Directory Access Protocol) is a lightweight directory
+ access protocol that provides access control and maintains distributed
+ directory information.
+
+rationale: |-
+ Providing an LDAP client (<tt>openldap-clients</tt>) in the system can cause
+ waste of system resources and expand the scope of attacks. If the business
+ scenario does not require the use of LDAP services, it is prohibited to
+ install the LDAP client.
+
+severity: high
+
+template:
+ name: package_removed
+ vars:
+ pkgname: openldap-clients
\ No newline at end of file
diff --git a/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml b/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml
index 902117f..9bd2182 100644
--- a/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml
+++ b/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: rhel6,rhel7,rhel8
+prodtype: rhel6,rhel7,rhel8,openeuler2203
title: 'Disable rpcbind Service'
diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs-server_disabled/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs-server_disabled/rule.yml
new file mode 100644
index 0000000..32a4889
--- /dev/null
+++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs-server_disabled/rule.yml
@@ -0,0 +1,33 @@
+documentation_complete: true
+
+prodtype: fedora,rhel6,rhel7,rhel8,openeuler2203
+
+title: 'Disable Network File System (nfs) Service'
+
+description: |-
+ Network File System (NFS) is one of the oldest and most widely distributed
+ file systems in UNIX environments. It provides the system with the ability
+ to mount other servers' file systems over the network. If the system does
+ not export NFS shares, it is recommended to disable NFS to reduce the remote
+ attack surface..
+ {{{ describe_service_disable(service="nfs-server") }}}
+
+rationale: |-
+ 'Disabling NFS affects services and applications on the system that rely on NFS,
+ as well as existing NFS mount points. Before disabling NFS, you should make sure
+ you understand the usage on your system and consider whether there are alternatives
+ to meet your file sharing and data access needs.'
+
+severity: low
+
+ocil_clause: 'it does not'
+
+ocil: '{{{ ocil_service_disabled(service="nfs") }}}'
+
+platform: machine
+
+template:
+ name: service_disabled
+ vars:
+ servicename: nfs-server
+ packagename: nfs-utils
diff --git a/linux_os/guide/services/rsync/group.yml b/linux_os/guide/services/rsync/group.yml
new file mode 100644
index 0000000..0482394
--- /dev/null
+++ b/linux_os/guide/services/rsync/group.yml
@@ -0,0 +1,9 @@
+documentation_complete: true
+
+title: 'Rsync Server'
+
+description: |-
+ The rsync service can be used to synchronize data between
+ servers or between different Disk partitioning on the server,
+ but because rsync uses an unencrypted transmission protocol,
+ there is a risk of information disclosure.
\ No newline at end of file
diff --git a/linux_os/guide/services/rsync/service_rsyncd_disabled/rule.yml b/linux_os/guide/services/rsync/service_rsyncd_disabled/rule.yml
new file mode 100644
index 0000000..5afaa7c
--- /dev/null
+++ b/linux_os/guide/services/rsync/service_rsyncd_disabled/rule.yml
@@ -0,0 +1,20 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Disable Rsync Server Software'
+
+description: '{{{ describe_service_disable(service="rsync-daemon") }}}'
+
+rationale: |-
+ If the rsync service is enabled and data is transmitted between
+ different servers through the network, attackers can steal data
+ by listening to server ports, routers, and switch data packets.
+
+severity: high
+
+template:
+ name: service_disabled
+ vars:
+ servicename: rsyncd
+ packagename: rsync
\ No newline at end of file
diff --git a/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml b/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml
index aec5800..c13311f 100644
--- a/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml
+++ b/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: rhel6,rhel7,rhel8
+prodtype: rhel6,rhel7,rhel8,openeuler2203
title: 'Disable Samba'
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml
new file mode 100644
index 0000000..e6c1a0e
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_concurrent_unauthenticated_connections" version="1">
+ <metadata>
+ <title>SSH concurrent unauthenticated connections should be configured correctly</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure the specified IP address for SSH connection.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH configure correctly concurrent unauthenticated connections"
+ test_ref="test_sshd_configure_concurrent_unauthenticated_connections" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH configure correctly concurrent unauthenticated connections"
+ id="test_sshd_configure_concurrent_unauthenticated_connections" version="1">
+ <ind:object object_ref="obj_test_sshd_configure_concurrent_unauthenticated_connections" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_configure_concurrent_unauthenticated_connections" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^maxstartups\s+\d+:\d+:\d+$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/rule.yml
new file mode 100644
index 0000000..60d2ccd
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/rule.yml
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'SSH concurrent unauthenticated connections should be configured correctly'
+
+description: |-
+ Attackers can consume system resources by establishing a large number of
+ concurrent connections with incomplete authentication without knowing the
+ password.
+
+rationale: |-
+ The MaxStartups setting specifies the maximum number of concurrent unauthenticated
+ connections to the SSH daemon.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/oval/shared.xml
new file mode 100644
index 0000000..d30df39
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_configure_correct_sessions" version="1">
+ <metadata>
+ <title>The allowed number of concurrent sessions for a single SSH connection should be configured correctly</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure the allowed number of concurrent sessions.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH configure the allowed number of concurrent sessions"
+ test_ref="test_sshd_configure_concurrent_sessions" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH configure the allowed number of concurrent sessions"
+ id="test_sshd_configure_concurrent_sessions" version="1">
+ <ind:object object_ref="obj_test_sshd_configure_concurrent_sessions" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_configure_concurrent_sessions" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^MaxSessions\s+\d+$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/rule.yml
new file mode 100644
index 0000000..2517850
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_concurrent_sessions/rule.yml
@@ -0,0 +1,19 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'The allowed number of concurrent sessions for a single SSH connection should be configured correctly'
+
+description: |-
+ SSH allows clients that support multiplexing to establish multiple sessions
+ based on a single network connection. MaxSessions limits the number of SSH
+ concurrent sessions allowed for each network connection, which can prevent
+ system resources from being unlimited occupied by a single or a few connections,
+ leading to denial of service attacks.
+
+rationale: |-
+ Setting MaxSessions to 1 will disable session multiplexing, meaning that only
+ one session is allowed for a connection, while setting it to 0 will block all
+ connected sessions.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml
new file mode 100644
index 0000000..fb79aff
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_configure_correct_LoginGraceTime" version="1">
+ <metadata>
+ <title>LoginGraceTime should be configured correctly</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure the LoginGraceTime for SSH connection.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH configure correctly LoginGraceTime"
+ test_ref="test_sshd_configure_correct_LoginGraceTime" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH configure correctly LoginGraceTime"
+ id="test_sshd_configure_correct_LoginGraceTime" version="1">
+ <ind:object object_ref="obj_test_sshd_configure_correct_LoginGraceTime" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_configure_correct_LoginGraceTime" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^LoginGraceTime\s+\d+$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/rule.yml
new file mode 100644
index 0000000..2c97751
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/rule.yml
@@ -0,0 +1,18 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'LoginGraceTime should be configured correctly'
+
+description: |-
+ LoginGraceTime is used to limit the user's login time. If the user
+ fails to complete the login action within the time limit specified
+ by LoginGraceTime, the connection will be automatically disconnected.
+
+rationale: |-
+ It is recommended to set this value to less than or equal to 60 seconds.
+ If the value is set too high, attackers can utilize a large number of
+ incomplete login actions to consume server resources, resulting in normal
+ administrator login failures.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/oval/shared.xml
new file mode 100644
index 0000000..47510c8
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_configure_correct_interface" version="1">
+ <metadata>
+ <title>SSH service interface should be configured correctly</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure the specified IP address for SSH connection.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH configure correctly interface"
+ test_ref="test_sshd_configure_interface" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH configure correctly interface"
+ id="test_sshd_configure_interface" version="1">
+ <ind:object object_ref="obj_test_sshd_configure_interface" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_configure_interface" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^ListenAddress\s+((?:\d{1,3}\.){3}\d{1,3})$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/rule.yml
new file mode 100644
index 0000000..0e1cb5c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_interface/rule.yml
@@ -0,0 +1,18 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'SSH service interface should be configured correctly'
+
+description: |-
+ Generally, the server has multiple network cards and multiple
+ IP addresses. IP addresses should be planned for business and
+ management. Therefore, not every IP address needs to listen for
+ SSH connections. You can configure to limit SSH connections to
+ only specified IP addresses to reduce the attack surface.
+
+rationale: |-
+ Unconfigured IP addresses cannot connect to the server through SSH.
+ It is recommended to plan and configure according to the actual situation.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/oval/shared.xml
new file mode 100644
index 0000000..9146f4c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_disable_AllowTcpForwardindg" version="1">
+ <metadata>
+ <title>Does not allow the use of AllowTcpForwarding</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Sshd does not allow the use of AllowTcpForwarding.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH prohibits the use of AllowTcpForwarding"
+ test_ref="test_sshd_disable_AllowTcpForwarding" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH prohibits the use of AllowTcpForwarding"
+ id="test_sshd_disable_AllowTcpForwarding" version="1">
+ <ind:object object_ref="obj_test_sshd_disable_AllowTcpForwarding" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_disable_AllowTcpForwarding" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^AllowTcpForwarding\s+no$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/rule.yml
new file mode 100644
index 0000000..1cdfb4e
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_AllowTcpForwardindg/rule.yml
@@ -0,0 +1,18 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Does not allow the use of AllowTcpForwarding'
+
+description: |-
+ AllowTcpForwarding allows the SSH server to act as a proxy to forward TCP requests from
+ clients, similar to establishing an SSH tunnel between the server and the client. This
+ feature may cause the client to attack other servers from the external network through
+ the SSH channel.
+
+rationale: |-
+ If AllowTcpForwarding is configured as yes, attackers can bypass firewall monitoring on
+ the client through the SSH channel and send attack commands to the intranet server where
+ the SSH server is located, thereby attacking it. So AllowTcpForwarding must be closed.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/oval/shared.xml
new file mode 100644
index 0000000..5f4d777
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_disable_x11_forwarding" version="1">
+ <metadata>
+ <title>Does not allow the use of X11 Forwarding</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Sshd does not allow the use of X11 Forwarding.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH prohibits the use of X11 Forwarding"
+ test_ref="test_sshd_disable_X11_forwarding" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH prohibits the use of X11 Forwarding"
+ id="test_sshd_disable_X11_forwarding" version="1">
+ <ind:object object_ref="obj_test_sshd_disable_X11_forwarding" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_disable_X11_forwarding" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^X11Forwarding\s+no$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
new file mode 100644
index 0000000..bc5f1fe
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Does not allow the use of X11 Forwarding'
+
+description: |-
+ The X11 Forwarding feature of SSH allows for the execution of GUI programs for remote
+ hosts on the local host. If not required in the business scenario, this feature must
+ be disabled.
+
+rationale: |-
+ Enabling the X11 Forwarding function expands the scope of attacks and poses a possibility
+ of being attacked by other users on the X11 server.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/oval/shared.xml
new file mode 100644
index 0000000..3edae48
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="sshd_prohibit_preset_authorized_keys" version="1">
+ <metadata>
+ <title>Prohibit SSH service pre setting authorized_Keys</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>SSH service prohibits preset authorized_Keys.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="SSH service prohibits preset authorized_Keys"
+ test_ref="test_sshd_prohibit_preset_authorized_keys" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="SSH service prohibits preset authorized_Keys"
+ id="test_sshd_prohibit_preset_authorized_keys" version="1">
+ <ind:object object_ref="obj_test_sshd_prohibit_preset_authorized_keys" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_sshd_prohibit_preset_authorized_keys" version="1">
+ <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+ <ind:pattern operation="pattern match">^LoginGraceTime\s+\d+$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/rule.yml
new file mode 100644
index 0000000..1c139fa
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_prohibit_preset_authorized_keys/rule.yml
@@ -0,0 +1,18 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Prohibit SSH service pre setting authorized_Keys'
+
+description: |-
+ Authorized_ Keys is the public key of the remote host, which users can
+ store in their home directory $HOME/. ssh/authorized_ In the keys file,
+ for public key authentication, you can directly log in to the system.
+
+rationale: |-
+ If authorized is preset in the system_ Keys, and the server has enabled
+ the login method of public and private key authentication, allowing
+ attackers to bypass authentication and directly log in to the specified
+ system to attack it. So authorized cannot be preset in the system_ Keys.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/services/uninstall_software_service/group.yml b/linux_os/guide/services/uninstall_software_service/group.yml
new file mode 100644
index 0000000..0a269ba
--- /dev/null
+++ b/linux_os/guide/services/uninstall_software_service/group.yml
@@ -0,0 +1,5 @@
+documentation_complete: true
+
+title: 'Do not install some software packages.'
+
+description: |-
\ No newline at end of file
diff --git a/linux_os/guide/services/uninstall_software_service/network_sniffing_tools/rule.yml b/linux_os/guide/services/uninstall_software_service/network_sniffing_tools/rule.yml
new file mode 100644
index 0000000..b41c210
--- /dev/null
+++ b/linux_os/guide/services/uninstall_software_service/network_sniffing_tools/rule.yml
@@ -0,0 +1,24 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Uninstall network sniffing Package'
+
+description: |-
+ If the production environment contains network sniffing tools, attackers
+ can easily use these tools to conduct network analysis and assist network
+ attacks. Therefore, installation of various network sniffing and packet
+ capture analysis tools, such as tcpdump, ethereal, wireshark, etc., should
+ be prohibited in the production environment.
+
+ <p><tt>It can not be scanned automatically,please check it manually.</tt></p>
+ <p>check the network_sniffing_tools,such as wireshark,netcat,tcpdump,namp,ethereal:</p>
+ <ul>
+ <pre> rpm -qa | grep -iE "^(wireshark-|netcat-|tcpdump-|nmap-|ethereal-)"</pre>
+ </ul>
+
+rationale: |-
+ There is no need to install various network sniffing and packet capture
+ analysis tools in the production environment.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
index 84a64db..625f15d 100644
--- a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
+++ b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,rhel6,rhel7,rhel8,rhv4
+prodtype: fedora,rhel6,rhel7,rhel8,rhv4,openeuler2203
title: 'Remove the X Windows Package Group'
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/oval/shared.xml
new file mode 100644
index 0000000..eab54dd
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+ <definition class="compliance" id="no_forward_files" version="1">
+ <metadata>
+ <title>Verify No forward Files Exist</title>
+ {{{- oval_affected(products) }}}
+ <description>If there are no related email forwarding scenarios, it is recommended to delete the .forward file.</description>
+ </metadata>
+ <criteria>
+ <criterion test_ref="test_no_forward_files_home" negate="true" />
+ </criteria>
+ </definition>
+ <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .forward in /home" id="test_no_forward_files_home" version="1">
+ <unix:object object_ref="object_no_forward_files_home" />
+ </unix:file_test>
+ <unix:file_object comment="look for .forward in /home" id="object_no_forward_files_home" version="1">
+ <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+ <unix:path operation="equals">/home</unix:path>
+ <unix:filename operation="pattern match">^\.forward$</unix:filename>
+ </unix:file_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/rule.yml
new file mode 100644
index 0000000..318131a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_forward_files/rule.yml
@@ -0,0 +1,17 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Verify No forward Files Exist'
+
+description: |-
+ The <tt>.forward</tt> file can be configured with an email address, which
+ will be automatically forwarded to when users receive emails. If there are
+ no related email forwarding scenarios, it is recommended to delete the
+ <tt>.forward</tt> file.
+
+rationale: |-
+ If there is a <tt>.forward</tt> file, it may cause user emails carrying
+ sensitive information to be automatically forwarded to high-risk mailboxes.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification/rule.yml
new file mode 100644
index 0000000..b01dad4
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure the network interface is bound to the correct area'
+
+description: |-
+ File access permission control is the basic permission management in Linux. Different users
+ are authorized to access different files, preventing the leakage of sensitive information
+ between users or the tampering of file data. It can also prevent ordinary users from
+ unauthorized access to high-privilege files or configurations in the system.
+
+ It is recommended to audit and monitor system calls that modify file permissions and file
+ owners in the operating system. If relevant auditing is not configured, if illegal
+ modification occurs, it will not be conducive to traceability.
+
+ openEuler does not configure file access control permission audit rules by default. It is
+ recommended that users configure corresponding rules based on actual business scenarios.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ Configuring auditing, because audit logs need to be recorded when file permissions and owners
+ are modified, will have a slight impact on performance. However, since such operations should
+ not be performed frequently, it is actually not perceptible to users.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
index ebd52e2..2e7f907 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019,openeuler2203
title: 'Record Unsuccessful Access Attempts to Files - creat'
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
index 3634935..cac6a0d 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019,openeuler2203
title: 'Record Unsuccessful Access Attempts to Files - ftruncate'
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
index 8d813fa..425ecb7 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019,openeuler2203
title: 'Record Unsuccessful Access Attempts to Files - open'
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
index e8ec755..20b4d42 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019,openeuler2203
title: 'Record Unsuccessful Access Attempts to Files - openat'
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privilege_escalation_command/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privilege_escalation_command/rule.yml
new file mode 100644
index 0000000..6cebb2c
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privilege_escalation_command/rule.yml
@@ -0,0 +1,25 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure to remove unnecessary file system mount support'
+
+description: |-
+ Ordinary users can obtain super administrator privileges by calling privilege
+ escalation commands (with SUID/SGID set), so the use of privilege escalation
+ commands carries high risks and is often used by attackers to attack the system.
+
+ It is recommended to audit and monitor privilege escalation commands to facilitate
+ traceability afterwards.
+
+ openEuler does not configure audit rules for privilege escalation commands by
+ default. It is recommended that users configure corresponding rules based on actual
+ business scenarios.
+
+rationale: |-
+ Configuring auditing requires audit logging when using privilege escalation
+ commands, which has a slight impact on performance. If the user business has
+ a large number of scenarios where privilege escalation commands are frequently
+ called, there may be a cumulative effect.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/oval/shared.xml
new file mode 100644
index 0000000..b70b4d9
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="audit_rule_admin_privilege" version="1">
+ <metadata>
+ <title>Audit rules for administrator privileged operations should be configured</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure audit rules for administrator privileged operations</description>
+ </metadata>
+ <criteria>
+ <criterion comment="Configure audit rules for administrator privileged operations"
+ test_ref="test_audit_rule_admin_privilege" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="recorded authentication-related event"
+ id="test_audit_rule_admin_privilege" version="1">
+ <ind:object object_ref="obj_test_audit_rule_admin_privilege" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_audit_rule_admin_privilege" version="1">
+ <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+ <ind:pattern operation="pattern match">^\-w[\s]+sudo\.log[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/rule.yml
new file mode 100644
index 0000000..8d548e5
--- /dev/null
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rule_admin_privilege/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Audit rules for administrator privileged operations should be configured'
+
+description: |-
+
+ The sudo extraction command operation log in the openEuler system is recorded
+ in the /var/log/secure log file by default. Other authentication-related security
+ logs are also recorded in this file. If the user wants to audit the sudo extraction
+ command, it is recommended that the sudo related logs be Record separately and
+ output to /var/log/sudo.log, and then audit and monitor the sudo log file. Sudo
+ privilege escalation is a high-risk operation and is relatively common in attacks. It
+ is recommended to configure audit rules for later tracing.
+
+ openEuler does not configure audit rules for administrator privileged operations
+ by default. It is recommended that users configure corresponding rules based on
+ actual business scenarios.
+
+rationale: |-
+ Configure auditing. Since audit logging is required for any sudo privilege escalation
+ operation, it will have a slight impact on performance. If there are a large number
+ of frequent sudo operations in the user's business scenario, the impact on performance
+ will have a cumulative effect.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/oval/shared.xml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/oval/shared.xml
new file mode 100644
index 0000000..bf0b651
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="auditd_data_retention_admin_space_left" version="1">
+ <metadata>
+ <title>auditd data retention admin space left</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>auditd data retention admin space left.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="auditd data retention admin space left"
+ test_ref="test_auditd_data_retention_admin_space_left" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="auditd data retention admin space left"
+ id="test_auditd_data_retention_admin_space_left" version="1">
+ <ind:object object_ref="obj_test_auditd_data_retention_admin_space_left" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_auditd_data_retention_admin_space_left" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[\s]*admin_space_left[\s]+=[\s]+(\d+)[\s]*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/rule.yml
new file mode 100644
index 0000000..2c9273d
--- /dev/null
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left/rule.yml
@@ -0,0 +1,56 @@
+documentation_complete: true
+
+title: 'Configure auditd admin_space_left on Low Disk Space'
+
+description: |-
+ The <tt>auditd</tt> service can be configured to take an action
+ when disk space is running low but prior to running out of space completely.
+ Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the following line,
+ substituting <i>ACTION</i> appropriately:
+ <pre>admin_space_left_action = <i>ACTION</i></pre>
+ Set this value to <tt>single</tt> to cause the system to switch to single user
+ mode for corrective action. Acceptable values also include <tt>suspend</tt> and
+ <tt>halt</tt>. For certain systems, the need for availability
+ outweighs the need to log all actions, and a different setting should be
+ determined. Details regarding all possible values for <i>ACTION</i> are described in the
+ <tt>auditd.conf</tt> man page.
+
+rationale: |-
+ Administrators should be made aware of an inability to record
+ audit records. If a separate partition or logical volume of adequate size
+ is used, running low on space for audit records should never occur.
+
+severity: medium
+
+identifiers:
+ cce@rhel6: 27239-3
+ cce@rhel7: 27370-6
+ cce@rhel8: 80679-4
+ cce@ocp4: 82677-6
+
+references:
+ stigid@rhel6: "000163"
+ srg@rhel6: SRG-OS-999999
+ cis: 5.2.1.2
+ cjis: 5.4.1.1
+ cui: 3.3.1
+ disa: 140,1343
+ hipaa: 164.312(a)(2)(ii)
+ iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.16.1.4,A.16.1.5,A.16.1.7,A.17.2.1
+ nist: AU-5(b),AU-5(2),AU-5(1),AU-5(4),CM-6(a)
+ nist-csf: DE.AE-3,DE.AE-5,PR.DS-4,PR.PT-1,RS.AN-1,RS.AN-4
+ pcidss: Req-10.7
+ stigid@rhel7: "030340"
+ isa-62443-2013: 'SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 6.1,SR 7.1,SR 7.2'
+ isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4
+ cobit5: APO11.04,APO12.06,APO13.01,BAI03.05,BAI04.04,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,MEA02.01
+ cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8
+
+ocil_clause: 'the system is not configured to switch to single user mode for corrective action'
+
+ocil: |-
+ Inspect <tt>/etc/audit/auditd.conf</tt> and locate the following line to
+ determine if the system is configured to either suspend, switch to single user mode,
+ or halt when disk space has run low:
+ <pre>admin_space_left_action single</pre>
+
diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
index cb1ff1d..080e1ee 100644
--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
+++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: ocp4,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: ocp4,rhel6,rhel7,rhel8,rhv4,wrlinux1019,openeuler2203
title: 'Configure auditd space_left on Low Disk Space'
diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
index 2c17ee1..0f4cdf0 100644
--- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel7,rhel8,rhv4
+prodtype: fedora,ocp4,ol7,ol8,rhel7,rhel8,rhv4,openeuler2203
title: 'Enable Auditing for Processes Which Start Prior to the Audit Daemon'
diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
index 36f3200..34ca8aa 100644
--- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
+++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel7,rhel8
+prodtype: fedora,ocp4,ol7,ol8,rhel7,rhel8,openeuler2203
title: 'Extend Audit Backlog Limit for the Audit Daemon'
diff --git a/linux_os/guide/system/logging/configure_dump_journald_log/oval/shared.xml b/linux_os/guide/system/logging/configure_dump_journald_log/oval/shared.xml
new file mode 100644
index 0000000..1e95b34
--- /dev/null
+++ b/linux_os/guide/system/logging/configure_dump_journald_log/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="configure_dump_journald_log" version="1">
+ <metadata>
+ <title>Make sure rsyslog dump journald log is configured</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure rsyslog dump journald log.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="configure dump journald log"
+ test_ref="test_configure_dump_journald_log" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="configure dump journald log"
+ id="test_configure_dump_journald_log" version="1">
+ <ind:object object_ref="obj_test_configure_dump_journald_log" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_configure_dump_journald_log" version="1">
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[^#]*imjournal</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/logging/configure_dump_journald_log/rule.yml b/linux_os/guide/system/logging/configure_dump_journald_log/rule.yml
new file mode 100644
index 0000000..7247e27
--- /dev/null
+++ b/linux_os/guide/system/logging/configure_dump_journald_log/rule.yml
@@ -0,0 +1,22 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure rsyslog dump journald log is configured'
+
+description: |-
+
+ The system uses journald to collect logs. The logs may be stored on
+ volatile storage devices or on persistent storage devices. If there
+ are problems such as log loss or logs filling up the disk, the logs
+ must be dumped in a timely manner to ensure that the logs are more
+ consistent with the system. Safety.
+
+rationale: |-
+ If there is a volatile storage device for the log, failure to dump
+ the log in time may result in log loss. If there is a persistent
+ storage device, the amount of logs may be very large. If the logs
+ are not dumped in time, the logs may fill up the current partition,
+ causing the risk of other processes or system failures.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/logging/configure_first_logging_change_password/rule.yml b/linux_os/guide/system/logging/configure_first_logging_change_password/rule.yml
new file mode 100644
index 0000000..16c62e7
--- /dev/null
+++ b/linux_os/guide/system/logging/configure_first_logging_change_password/rule.yml
@@ -0,0 +1,19 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that the account is forced to change the password when logging in for the first time'
+
+description: |-
+ Passwords that are not set by users themselves, such as passwords reset by
+ administrators, if not modified in a timely manner in the business environment,
+ can easily cause low-cost attacks. Therefore, users are required to forcibly change
+ their passwords when logging in to their accounts for the first time. Except for
+ the root password.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/logging/configure_rsyslog_log_rotate/rule.yml b/linux_os/guide/system/logging/configure_rsyslog_log_rotate/rule.yml
new file mode 100644
index 0000000..4257677
--- /dev/null
+++ b/linux_os/guide/system/logging/configure_rsyslog_log_rotate/rule.yml
@@ -0,0 +1,45 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that the iptables input and output association policies configuration is correct'
+
+description: |-
+ rsyslog is responsible for collecting log records from the system into files, and logrotate
+ is responsible for regularly or quantitatively copying and compressing log files to ensure
+ that excessive hard disk resources are not occupied due to excessive log file size, or that
+ the log files are even unmaintainable.
+
+ If the rotate policy is not configured, the log file will continue to grow, which may
+ eventually lead to the exhaustion of space on the hard disk partition where the log is
+ located, which may affect log recording at best, or may cause the system and business to be
+ unable to continue to execute normally.
+
+ By default, openEuler has configured the rsyslog rotate policy in the /etc/logrotate.d/rsyslog
+ file as follows:.
+
+ rotate log file:
+ /var/log/cron
+
+ /var/log/maillog
+
+ /var/log/messages
+
+ /var/log/secure
+
+ /var/log/spooler
+
+ The maximum retention period of log files is 365 days;
+
+ A maximum of 30 log files can be retained;
+
+ Log files are retained in a compressed manner;
+
+ The log file reaches 4MB, perform rotate operation.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: high
diff --git a/linux_os/guide/system/logging/configure_service_logging/rule.yml b/linux_os/guide/system/logging/configure_service_logging/rule.yml
new file mode 100644
index 0000000..c15d25b
--- /dev/null
+++ b/linux_os/guide/system/logging/configure_service_logging/rule.yml
@@ -0,0 +1,21 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Each service logging should be configured correctly'
+
+description: |-
+ Configure logging so that important system behaviors and security-related information will
+ be recorded using rsyslog. The configuration files /etc/rsyslog.conf and /etc/rsyslog.d/*.conf
+ can specify logging rules and which files will be used to record specific types of logs.
+
+ If logging is not configured, system behavior cannot be recorded, and problem location and
+ auditing cannot be performed when problems occur.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ After logging is configured, if the logs are not cleared in time, the logs may fill up the current partition, causing the
+ risk of other processes or system failures.
+
+severity: low
diff --git a/linux_os/guide/system/logging/diasable_root_accessing_system/rule.yml b/linux_os/guide/system/logging/diasable_root_accessing_system/rule.yml
new file mode 100644
index 0000000..b235f0e
--- /dev/null
+++ b/linux_os/guide/system/logging/diasable_root_accessing_system/rule.yml
@@ -0,0 +1,35 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Prevent root users from accessing the system locally'
+
+description: |-
+ Root is a super-privileged user in a Linux system and has access to all
+ Linux system resources. If you are allowed to directly use the root account
+ to log in to the Linux system to operate the system, it will bring many
+ potential security risks. In order to avoid the risks caused by this, it
+ should be prohibited to directly use the root account to log in to the
+ operating system, and only use other technologies when necessary. Methods
+ (such as: sudo or su) indirectly use the root account.
+
+ Since the root account has the highest authority, logging in directly with
+ root has the following risks:
+
+ High-risk misoperations may directly cause server paralysis, such as accidentally
+ deleting or modifying key system files;
+
+ If multiple people need root privileges to operate, the root password will be
+ kept by multiple people, which can easily lead to password leakage and increase
+ password maintenance costs.
+
+ openEuler is not configured by default. If there is no need to log in locally using
+ the root account in actual scenarios, it is recommended to disable local login
+ with the root account.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ The root account cannot access the system locally.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
index a78cd69..3bd9887 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
@@ -9,6 +9,7 @@
<platform>multi_platform_ol</platform>
<platform>multi_platform_rhel</platform>
<platform>multi_platform_ubuntu</platform>
+ <platform>multi_platform_openeuler</platform>
</affected>
<description>File permissions for all syslog log files should be set correctly.</description>
</metadata>
diff --git a/linux_os/guide/system/logging/recorded_authentication_related_event/oval/shared.xml b/linux_os/guide/system/logging/recorded_authentication_related_event/oval/shared.xml
new file mode 100644
index 0000000..63bce75
--- /dev/null
+++ b/linux_os/guide/system/logging/recorded_authentication_related_event/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="recorded_authentication_related_event" version="1">
+ <metadata>
+ <title>Ensure that system authentication related event logs are recorded</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Configure the System to Record Authentication-related Event.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="recorded authentication-related event"
+ test_ref="test_recorded_authentication_related_event" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="recorded authentication-related event"
+ id="test_recorded_authentication_related_event" version="1">
+ <ind:object object_ref="obj_test_recorded_authentication_related_event" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_recorded_authentication_related_event" version="1">
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^[^#]*auth</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/logging/recorded_authentication_related_event/rule.yml b/linux_os/guide/system/logging/recorded_authentication_related_event/rule.yml
new file mode 100644
index 0000000..1a52982
--- /dev/null
+++ b/linux_os/guide/system/logging/recorded_authentication_related_event/rule.yml
@@ -0,0 +1,24 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that system authentication related event logs are recorded'
+
+description: |-
+
+ Events related to system authentication must be recorded to help
+ analyze user logins, use of root privileges, and monitor suspicious
+ system actions.
+ Failure to record system authentication-related event logs will
+ result in the inability to analyze suspicious attack actions from
+ the logs, such as login actions performed by attackers trying to
+ guess administrator passwords.
+
+rationale: |-
+ If there is a volatile storage device for the log, failure to
+ dump the log in time may result in log loss. If there is a persistent
+ storage device, the amount of logs may be very large. If the logs
+ are not dumped in time, the logs may fill up the current partition,
+ causing the risk of other processes or system failures.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/oval/shared.xml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/oval/shared.xml
index 22307d4..c3e2752 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/oval/shared.xml
+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/oval/shared.xml
@@ -10,6 +10,7 @@
<platform>multi_platform_rhel</platform>
<platform>multi_platform_ubuntu</platform>
<platform>multi_platform_wrlinux</platform>
+ <platform>multi_platform_openeuler</platform>
</affected>
<description>Syslog logs should be sent to a remote loghost</description>
</metadata>
diff --git a/linux_os/guide/system/logging/warning_banners_contain_reasonable_information/rule.yml b/linux_os/guide/system/logging/warning_banners_contain_reasonable_information/rule.yml
new file mode 100644
index 0000000..d5d2335
--- /dev/null
+++ b/linux_os/guide/system/logging/warning_banners_contain_reasonable_information/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure Warning Banners contain reasonable information'
+
+description: |-
+ Warning Banners include warning information added to the system login
+ interface, which identifies the system's security warnings for all
+ users who log in to the system. Security warnings can include the
+ organization to which the system belongs, monitoring or recording of
+ login behaviors, and unauthorized logins based on business scenarios. Or
+ the legal sanctions that will be imposed upon intrusion. Inappropriate
+ security warning information may increase the risk of system attacks
+ or violate local laws and regulations.
+
+ Warning Banners should not expose the system version, application server
+ type, functions, etc. to users to prevent attackers from obtaining system
+ information and carrying out attacks. In addition to this, file ownership
+ needs to be configured correctly, otherwise unauthorized users may modify
+ files with incorrect or misleading information.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-iptables/iptables_association_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network-iptables/iptables_association_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..278556e
--- /dev/null
+++ b/linux_os/guide/system/network/network-iptables/iptables_association_policy_configured_corrently/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that the iptables input and output association policies configuration is correct'
+
+description: |-
+ Although it is possible to configure packet policies for incoming and outgoing servers to the
+ Input and OUTPUT chains by configuring protocols, IP, and ports, in some cases it may be more
+ complex. For example, if the client accesses the server through a certain port, the server may
+ not necessarily return the response packet from the original port, and may use a random source
+ port. In this case, it is difficult to configure accurate policies through the sport parameter.
+
+ At this point, it is necessary to consider using association links to configure the strategy.
+ If an outgoing message belongs to an existing network link, it will be directly released; If a
+ received message belongs to an existing network link, it is also directly released. Because
+ these existing links must have been filtered and checked by other policies, otherwise they cannot
+ be established.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+ <p>Check if the input and output chains are configured with associated policies.</p>
+ <ul>
+ <li>You can use below cli command to check if the input and output chains of IPv4 are configured with associated policies:
+ <pre># iptables -L</pre>
+ </li>
+ <li>You can use below cli command to check if the input and output chains of IPv6 are configured with associated policies:
+ <pre># ip6tables -L</pre>
+ </li>
+ </ul>
+
+rationale: |-
+ If the policy is not configured through associated links, it is necessary to analyze all possible
+ link situations and configure corresponding policies. If the configuration is too loose, it may
+ cause security risks, and if the configuration is too strict, it may cause business interruption.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-iptables/iptables_input_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network-iptables/iptables_input_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..0f7e91a
--- /dev/null
+++ b/linux_os/guide/system/network/network-iptables/iptables_input_policy_configured_corrently/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that the iptables input policy configuration is correct'
+
+description: |-
+ The function of the Input chain is to filter packets received from external sources. Any
+ externally provided service requires configuring the corresponding Input policy and opening
+ the relevant port, so that external clients can access the service through that port.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+ <p>Check if the policy configured for the input chain meets business needs.</p>
+ <ul>
+ <li>You can use below cli command to check the input chain of IPv4:
+ <pre># iptables -L INPUT -v -n</pre>
+ </li>
+ <li>Or check the input chain of IPv6:
+ <pre># ip6tables -L INPUT -v -n</pre>
+ </li>
+ </ul>
+
+rationale: |-
+ If not configured, all external attempts to access related services will be discarded due to
+ the default policy configuration being DROP.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-iptables/iptables_loopback_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network-iptables/iptables_loopback_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..9d8bafe
--- /dev/null
+++ b/linux_os/guide/system/network/network-iptables/iptables_loopback_policy_configured_corrently/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that the iptables loopback policy configuration is correct'
+
+description: |-
+ The loopback address is a special address on the server, represented by 127.0.0.0/8,which is
+ not related to the network card and is mainly used for communication between local processes.
+ Messages with a source address of 127.0.0.0/8 should not be received from the network card,
+ and such messages should be discarded.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+ <p>Check if the loopback address policy has been correctly configured.</p>
+ <ul>
+ <li>You can use below cli command to check the input chain of IPv4:
+ <pre># iptables -L INPUT -v -n</pre>
+ </li>
+ <li>Or check the output chain of IPv4:
+ <pre># iptables -L OUTPUT -v -n</pre>
+ </li>
+ <li>Or check the input chain of IPv6:
+ <pre># ip6tables -L INPUT -v -n</pre>
+ </li>
+ <li>Or check the output chain of IPv6:
+ <pre># ip6tables -L OUTPUT -v -n</pre>
+ </li>
+ </ul>
+
+rationale: |-
+ If the loopback address policy is not set correctly, it may cause communication failure between
+ local processes or receive spoofing messages from the network card. The server needs to set
+ policies that allow receiving and processing loopback address messages from the lo interface,
+ but reject messages received from the network card.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-iptables/iptables_output_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network-iptables/iptables_output_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..c10cd44
--- /dev/null
+++ b/linux_os/guide/system/network/network-iptables/iptables_output_policy_configured_corrently/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure that the iptables output policy configuration is correct'
+
+description: |-
+ There are two main situations for server outgoing messages: one is when the host process
+ actively connects to an external server, such as HTTP access, or sends data to a log server,
+ etc.; the other is when the host process accesses the local service externally and the local
+ machine responds to the message.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+ <p>Check if the policy configured for the output chain meets business needs.</p>
+ <ul>
+ <li>You can use below cli command to check the output chain of IPv4:
+ <pre># iptables -L OUTPUT -v -n</pre>
+ </li>
+ <li>Or check the input chain of IPv6:
+ <pre># ip6tables -L OUTPUT -v -n</pre>
+ </li>
+ </ul>
+
+rationale: |-
+ If the OUTPUT policy is not configured, all outgoing messages from the server will be discarded
+ due to the default policy being DROP.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml b/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml
index bbea345..19cc6f5 100644
--- a/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml
+++ b/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,rhel6,rhel7,rhel8,rhv4
+prodtype: fedora,ocp4,rhel6,rhel7,rhel8,rhv4,openeuler2203
title: 'Deactivate Wireless Network Interfaces'
diff --git a/linux_os/guide/system/network/network_interface_binding_corrently/rule.yml b/linux_os/guide/system/network/network_interface_binding_corrently/rule.yml
new file mode 100644
index 0000000..ee66dd7
--- /dev/null
+++ b/linux_os/guide/system/network/network_interface_binding_corrently/rule.yml
@@ -0,0 +1,26 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure the network interface is bound to the correct area'
+
+description: |-
+ Different firewall regions can develop different filtering strategies. If the server network
+ is complex and has multiple interfaces, and different interfaces undertake different business
+ functions, it is recommended to configure the interfaces to different regions and develop
+ different firewall strategies. For example, the external network business interface does not
+ allow SSH access, while the internal network management interface can open SSH access.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+ <p>Check the interface configuration of each region:</p>
+ <ul>
+ <pre># find ./ -type l -follow</pre>
+ </ul>
+
+rationale: |-
+ If all interfaces are configured in one area, firewall policies are not conducive to configuring
+ different interfaces differently, increasing management complexity, and reducing the filtering
+ efficiency of firewall security protection. Due to configuration issues, messages that should
+ not be received may not be rejected or discarded.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/group.yml b/linux_os/guide/system/network/network_nftables/group.yml
new file mode 100644
index 0000000..68ecddd
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/group.yml
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'nftables'
+
+description: |-
+ nftables is a subsystem of the Linux kernel that provides filtering
+ and classification of network packets. nftables replaces the iptables
+ part of Netfilter. Compared with iptables, nftable is easier to extend
+ to new protocols, and nftables will replace iptables in the future.
+ In addition, nftables is different from firewalld and iptables. The
+ operating system does not configure any policies by default and
+ requires manual configuration by the administrator.
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/nftables_association_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network_nftables/nftables_association_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..73b0e5e
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/nftables_association_policy_configured_corrently/rule.yml
@@ -0,0 +1,32 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Configure nftables input strategy'
+
+description: |-
+ Although you can configure the policy of packets in and out of the server to
+ the input and output chains by configuring the protocol, IP and port, etc,
+ it is more complicated in some cases. For example, the client accesses the
+ server through a certain port, but when the server returns a response message
+ It does not necessarily return from the original port, but may use a random
+ source port. In this case, it is difficult to configure an accurate policy
+ through the sport parameter.
+
+ At this time, you need to consider using the associated link method to configure
+ the policy. If an outgoing packet belongs to an existing network link, it is
+ directly allowed; if a received packet belongs to an existing network link, it
+ is also directly allowed. Because these existing links must have been filtered
+ and checked by other policies, otherwise they cannot be established.
+
+ If you do not configure policies through associated links, you need to analyze
+ all possible link situations and configure corresponding policies. If the
+ configuration is too loose, it may lead to security risks. If the configuration
+ is too strict, it may cause business interruption.lll
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/nftables_configure_default_deny_policy/rule.yml b/linux_os/guide/system/network/network_nftables/nftables_configure_default_deny_policy/rule.yml
new file mode 100644
index 0000000..9a95f50
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/nftables_configure_default_deny_policy/rule.yml
@@ -0,0 +1,24 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Configure nftables default deny policy'
+
+description: |-
+ From a security perspective, the nftables basic chain is similar to
+ iptables. (Input, output, forward) you need to configure the rejection
+ policy for all packets, and then add the allow policy to the basic
+ chain to open related services and ports.
+
+ If the basic chain is not configured, or the hook rules of the basic
+ chain are not specified, the packet will not be captured by nftables,
+ and filtering will not be possible.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ If the basic chain is not configured with a DROP or REJECT policy, the
+ packets will be ACCEPT by default, which may easily lead to security
+ risks due to omission of the rejection policy.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/nftables_input_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network_nftables/nftables_input_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..a1fb377
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/nftables_input_policy_configured_corrently/rule.yml
@@ -0,0 +1,21 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Configure nftables input strategy'
+
+description: |-
+ The function of the input chain is to filter messages received from the
+ outside. Any externally provided service needs to configure the
+ corresponding input policy and open the relevant port so that external
+ clients can access the service through the port.
+
+ If not configured, since the default policy is configured as DROP, all
+ external packets trying to access related services will be dropped.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/nftables_loopback_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network_nftables/nftables_loopback_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..c71aabe
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/nftables_loopback_policy_configured_corrently/rule.yml
@@ -0,0 +1,23 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Configure nftables loopback policy'
+
+description: |-
+ The loopback address is a special address on the server, represented by 127.0.0.0/8. It
+ has nothing to do with the network card. It is mainly used for inter-process communication
+ on this machine. Packets with the source address 127.0.0.0/8 should not be received from
+ the network card. Such messages should be discarded. If the loopback address policy is
+ set incorrectly, inter-process communication on the local machine may fail, or spoofed
+ packets may be received from the network card.
+
+ The server needs to set a policy to allow receiving and processing the loopback address
+ packets of the lo interface, but reject the packets received from the network card.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/nftables_output_policy_configured_corrently/rule.yml b/linux_os/guide/system/network/network_nftables/nftables_output_policy_configured_corrently/rule.yml
new file mode 100644
index 0000000..b3a795f
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/nftables_output_policy_configured_corrently/rule.yml
@@ -0,0 +1,22 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Configure nftables input strategy'
+
+description: |-
+ There are two main situations when the server sends outbound messages. One
+ is when the host process actively connects to an external server, such as
+ http access, or sends outgoing data to a log server, etc. The other is when
+ the host process externally accesses local services and the local machine
+ responds arts.
+
+ If no output policy is configured, all outgoing packets from the server will
+ be discarded because the default policy is DROP.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network_nftables/service_nftables_enabled/rule.yml b/linux_os/guide/system/network/network_nftables/service_nftables_enabled/rule.yml
new file mode 100644
index 0000000..ddc0939
--- /dev/null
+++ b/linux_os/guide/system/network/network_nftables/service_nftables_enabled/rule.yml
@@ -0,0 +1,22 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Verify nftables Enabled'
+
+description: '{{{ describe_service_enable(service="docker") }}}'
+
+rationale: |-
+ If multiple firewall services are enabled, business
+ interruption may occur due to inconsistent policy configurations.
+
+severity: low
+
+ocil: '{{{ ocil_service_enabled(service="nftables") }}}'
+
+platform: machine
+
+template:
+ name: service_enabled
+ vars:
+ servicename: nftables
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/define_ld_lib_path_correctly/rule.yml b/linux_os/guide/system/permissions/files/define_ld_lib_path_correctly/rule.yml
new file mode 100644
index 0000000..b5a1142
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/define_ld_lib_path_correctly/rule.yml
@@ -0,0 +1,25 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure the LD_LIBRARY_PATH variable is defined correctly'
+
+description: |-
+ LD_LIBRARY_PATH is a Linux environment variable. When a program loads a
+ dynamic link library, it will first obtain it from the path specified by
+ this environment variable. Normally, this environment variable should
+ not be set. If it is maliciously set to an incorrect value, the program
+ may be linked to an incorrect dynamic library when running, resulting in
+ security risks. Note: The configuration in /etc/ld.so.conf.d will also
+ affect dynamic library loading, so you need to ensure correct configuration.
+
+ openEuler does not set this variable by default. According to the actual
+ scenario, if LD_LIBRARY_PATH must be set, you need to ensure that the
+ value is correct in all user contexts.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/define_path_strictly/rule.yml b/linux_os/guide/system/permissions/files/define_path_strictly/rule.yml
new file mode 100644
index 0000000..68adae3
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/define_path_strictly/rule.yml
@@ -0,0 +1,31 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure the LD_LIBRARY_PATH variable is defined correctly'
+
+description: |-
+ The PATH variable under Linux defines the search path for executable files
+ in the current user context. For example, if the user uses the ls command
+ in any directory, the system will search for the ls command in the directory
+ specified by the PATH variable and execute it after finding it. The PATH
+ variable in all user contexts cannot contain the current directory "." .The
+ directory must be a path that actually exists in the file system and meets
+ the design expectations of the system. The correct PATH value can effectively
+ prevent system commands from being replaced by malicious instructions and
+ ensure that system commands can be executed safely.
+
+ So the PATH variable should be defined to the correct value, and the openEuler
+ system default setting is:
+
+ /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
+
+ PATH can be modified according to the actual scenario, but be sure to make sure
+ it is correct.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/no_files_globally_writable_files/rule.yml b/linux_os/guide/system/permissions/files/no_files_globally_writable_files/rule.yml
new file mode 100644
index 0000000..e4fa75f
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/no_files_globally_writable_files/rule.yml
@@ -0,0 +1,34 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Disallow globally writable files'
+
+description: |-
+ Globally writable means that all users can write to the file, but usually this
+ permission is not necessary. If a file is unreasonably set with globally writable
+ permissions, it can easily be tampered with by attackers, leading to security risks.
+ Therefore, if the file must have globally writable permissions, the security risks
+ need to be analyzed based on actual scenarios to ensure that attackers cannot use
+ this file to carry out attacks.
+
+ You can search for globally writable files in the root directory. The exceptions
+ are: There are a large number of globally writable files in the two system directories
+ "/sys" and "/proc" when Linux is running, so these two should be excluded when checking
+ directory to avoid confusion.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+ <p>Check globally writable files（directories "/sys" and "/proc" have been excluded）.</p>
+ <ul>
+ <li>You can use below command to check :
+ <pre>find / -path /proc -prune -o -path /sys -prune -o -type f -perm -0002 -exec ls -lg {} \;</pre>
+ </li>
+ <li>or:
+ <pre>find / -xdev -type f -perm -0002 -exec ls -lg {} \；</pre>
+ </li>
+ </ul>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/partitions_manage_hard_drive_data/rule.yml b/linux_os/guide/system/permissions/files/partitions_manage_hard_drive_data/rule.yml
new file mode 100644
index 0000000..a80fe6a
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/partitions_manage_hard_drive_data/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Hard drive data should be managed in partitions'
+
+description: |-
+ When installing the operating system, the operating system data and business data
+ partitions should be managed according to the characteristics of the actual scenario
+ to avoid placing all data on one hard disk or partition. Proper planning of hard disk
+ partitions can avoid or reduce the following risks:
+
+ The log file is too large, causing the business or system data disk to become full;
+ The home directory of ordinary accounts is too large, causing the system or business disk to become full;
+ The system partition is not independent, causing the basic service of the operating system to fail when the disk is full, causing a full-scale DOS attack;
+ It is not conducive to minimizing permissions and encrypting data disks;
+ It is not conducive to system or data recovery after the disk is damaged.
+
+ As a general operating system, openEuler installs separate partitions "/boot, /tmp,
+ /home, /" by default. It is recommended to determine the partition mounting and size
+ of other directories based on the actual scenario.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/partitions_mounted_nodev_mode/rule.yml b/linux_os/guide/system/permissions/files/partitions_mounted_nodev_mode/rule.yml
new file mode 100644
index 0000000..86766f1
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/partitions_mounted_nodev_mode/rule.yml
@@ -0,0 +1,48 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Partitions that do not need to be mounted are mounted in nodev mode'
+
+description: |-
+ nodev means that device files are not allowed to be mounted, which is used
+ to reduce the attack surface and increase security. When the directory is
+ mounted, if the nodev option is set, all block devices, character devices
+ and other device files in the directory will be parsed into ordinary files
+ and cannot be operated on device files. If nodev is not set when mounting,
+ it will lead to security risks. For example, an attacker creates a file system
+ on the USB flash drive and creates a block device file in it (his own USB flash
+ drive, with corresponding permissions), and this block The device actually
+ points to the server hard disk or partition such as /dev/sda. If an attacker
+ has the opportunity to insert a USB flash drive into the server and the server
+ loads the USB flash drive, the attacker can access the corresponding file through
+ this block device file. Hard drive data. If the U disk in the above case is changed
+ to another hard disk or partition, a similar problem will exist. As long as there
+ is a maliciously constructed device file on the hard disk or partition, an attack
+ can be formed.
+
+ The following directories are mounted by nodev by default in the openEuler system:
+
+ /sys、/proc、/sys/kernel/security、/dev/shm、/run、/sys/fs/cgroup、/sys/fs/cgroup/systemd、
+ /sys/fs/pstore、/sys/fs/bpf、/sys/fs/cgroup/files、/sys/fs/cgroup/net_cls,net_prio、
+ /sys/fs/cgroup/devices、/sys/fs/cgroup/freezer、/sys/fs/cgroup/cpu,cpuacct、/sys/fs/cgroup/perf_event、
+ /sys/fs/cgroup/pids、/sys/fs/cgroup/hugetlb、/sys/fs/cgroup/memory、/sys/fs/cgroup/blkio、
+ /sys/fs/cgroup/cpuset、/sys/fs/cgroup/rdma、/sys/kernel/config、/sys/kernel/debug、/dev/mqueue、
+ /tmp、/run/user/0
+
+ openEuler has the following directories (some directories vary depending on hard disk partitions
+ and deployment platforms). These directories are not mounted by nodev by default:
+
+ /dev、/dev/pts、/、/sys/fs/selinux、/proc/sys/fs/binfmt_misc、/dev/hugepages、/boot、
+ /var/lib/nfs/rpc_pipefs、/boot/efi、/home
+
+ In actual scenarios, based on business needs, the nodev method is used to mount partitions
+ that do not require device mounting.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/partitions_mounted_noexec_mode/rule.yml b/linux_os/guide/system/permissions/files/partitions_mounted_noexec_mode/rule.yml
new file mode 100644
index 0000000..21a7390
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/partitions_mounted_noexec_mode/rule.yml
@@ -0,0 +1,19 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure to remove unnecessary file system mount support'
+
+description: |-
+ The data disk is only used to save data during system operation. There
+ is no need to execute relevant commands on the data disk. In this case,
+ the hard disk or partition must be mounted in noexec mode to improve security
+ and reduce the attack surface.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ If the hard disk or partition is mounted in noexec mode, the executable
+ file in the mount point directory cannot be run directly.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/partitions_mounted_nosuid_mode/rule.yml b/linux_os/guide/system/permissions/files/partitions_mounted_nosuid_mode/rule.yml
new file mode 100644
index 0000000..ddbe5c6
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/partitions_mounted_nosuid_mode/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure partitions that do not require SUID/SGID are mounted in nosuid mode'
+
+description: |-
+ After the SUID bit is set on an executable file, even if the user executing the file
+ is not the owner of the file, the process will be temporarily granted the permissions
+ of the file owner during execution. For example, the ordinary user test executes a
+ program with permissions 755 and owner root. If the program does not set the SUID bit,
+ the process only has the permissions of the test user; if the SUID is set, the process
+ has root permissions during execution. . SGID has a similar function, but it only has
+ the permissions of the group to which the file belongs. For partitions that do not
+ need SUID/SGID, use the nosuid method to mount them. This can invalidate the S bit of
+ files with SUID/SGID in the partition, prevent privilege escalation through the
+ executable files of the partition, and strengthen the security of the partition.
+
+ Users need to plan each mounted hard drive and partition and set nosuid mounting items
+ based on actual scenarios.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/partitoin_mounted_noexec_or_nodev/rule.yml b/linux_os/guide/system/permissions/files/partitoin_mounted_noexec_or_nodev/rule.yml
new file mode 100644
index 0000000..512d8c1
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/partitoin_mounted_noexec_or_nodev/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure to remove unnecessary file system mount support'
+
+description: |-
+ Removable devices themselves are uncertain, and their origin, past usage,
+ and transportation processes cannot guarantee absolute safety. Therefore,
+ removable devices are often the main host devices for virus transmission.
+ Therefore, for removable devices, it is required to mount them in noexec
+ or nodev mode to improve security and reduce the attack surface.
+
+ noexec can prevent files on removable devices from being directly executed,
+ such as virus files, attack scripts, etc.;
+
+ nodev prevents incorrect device files on removable devices from being linked
+ to real devices on the server, leading to attacks;
+
+ Common removable devices such as: CD/DVD/USB, etc.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ If a removable device is mounted in noexec mode, the executable file
+ in the mount point directory cannot be run directly.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/read_only_partitions_no_modified/rule.yml b/linux_os/guide/system/permissions/files/read_only_partitions_no_modified/rule.yml
new file mode 100644
index 0000000..b54202f
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/read_only_partitions_no_modified/rule.yml
@@ -0,0 +1,19 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Partitions that do not need to be modified are mounted read-only.'
+
+description: |-
+ Mounting file systems that do not require data modification in read-only mode can
+ avoid unintentional or malicious data tampering and reduce the attack surface.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ Once the file system is mounted in read-only mode, files and directories cannot
+ be created, modified, or deleted. Users need to configure it according to the actual
+ scenario. This requirement can be ignored for file mounting necessary for the
+ operation of the operating system.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/files/removed_unnecessary_file_mount_support/rule.yml b/linux_os/guide/system/permissions/files/removed_unnecessary_file_mount_support/rule.yml
new file mode 100644
index 0000000..8c4eff8
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/removed_unnecessary_file_mount_support/rule.yml
@@ -0,0 +1,29 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure to remove unnecessary file system mount support'
+
+description: |-
+ The Linux system supports a variety of file systems, which are
+ loaded into the kernel through ko mode. As a general operating
+ system platform, openEuler will provide various file systems ko,
+ which are stored in the /lib/modules/(kernel version)/kernel/fs/
+ directory and can be loaded through the insmod/modprobe command.
+ Disabling mount support for unnecessary file systems can reduce
+ the attack surface and prevent attackers from attacking the system
+ by exploiting vulnerabilities in some uncommon file systems.
+
+ Users should determine which file systems do not need to be supported
+ based on actual scenarios, and prohibit these file systems from being
+ mounted through configuration. These file systems usually include:
+
+ cramfs、freevxfs、jffs2、hfs、hfsplus、squashfs、udf、vfat、fat、msdos、nfs、ceph、fuse、overlay、xfs
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+
+rationale: |-
+ The removed file system is no longer supported.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml
index cd07fd0..ce86997 100644
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8
+prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,openeuler2203
title: 'Restrict usage of ptrace to descendant processes'
diff --git a/linux_os/guide/system/selinux/disabled_unconfined_service_t_programs/rule.yml b/linux_os/guide/system/selinux/disabled_unconfined_service_t_programs/rule.yml
new file mode 100644
index 0000000..cb8f534
--- /dev/null
+++ b/linux_os/guide/system/selinux/disabled_unconfined_service_t_programs/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Avoid using programms labeled unconfined_service_t'
+
+description: |-
+ The purpose of SELinux setting the unconfined_service_t label
+ is to enable some third-party service processes that are not
+ configured with SELinux policies to run unfettered. By default,
+ when systemd runs a third-party application with the label bin_t
+ or usr_t (generally located in /usr/bin, /opt, etc. directories),
+ the generated process label is unconfined_service_t.
+
+ The difference from other high-privilege labels (such as unconfined_t,
+ initrc_t, etc.) is that unconfined_service_t has very few domain
+ conversion rules, which means that even if the process runs applications
+ that have been configured with SELinux policies, the label of the
+ new process will still be unconfined_service_t. The SELinux policy
+ configured for the process will not take effect. If it is attacked,
+ it will have a greater impact on the system.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ Programs labeled unconfined_service_t are restricted from running.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/software/enabled_seccomp/rule.yml b/linux_os/guide/system/software/enabled_seccomp/rule.yml
new file mode 100644
index 0000000..3e68100
--- /dev/null
+++ b/linux_os/guide/system/software/enabled_seccomp/rule.yml
@@ -0,0 +1,35 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'seccomp should be enabled'
+
+description: |-
+ seccomp (full name: secure computing mode), when it was first introduced into the
+ Linux kernel, limited the system calls available to the process to four types: read,
+ write, _exit, sigreturn. In the original whitelisting method, in addition to the
+ four system calls allowed by the open file descriptor, if other system calls are
+ attempted, the kernel will use SIGKILL or SIGSYS to terminate the process.
+
+ The whitelist method is too restrictive and has little practical effect. In practical
+ applications, more precise restrictions are needed. In order to solve this problem,
+ BPF was introduced. The combination of seccomp and BPF rules allows users to filter
+ system calls using configurable policies. The policy is implemented using Berkeley
+ Packet Filter rules, which can filter any system calls and their parameters.
+
+ The openEuler kernel already provides seccomp function support by default, and also
+ provides the libseccomp peripheral package to help user-mode programs conveniently
+ set seccomp rules.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ seccomp cannot set the opening, closing or rules globally, but is specific to each
+ process. That is, the process can set and enable seccomp by itself, which affects
+ itself and all child threads, but does not affect other processes.
+
+ If seccomp is enabled in a process, there will be a performance loss when making
+ system calls. Users need to determine whether the performance loss is acceptable
+ based on actual business scenarios.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml
index 787d897..6d9c09d 100644
--- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml
@@ -1,6 +1,6 @@
documentation_complete: true
-prodtype: fedora,ocp4,ol8,rhel8
+prodtype: fedora,ocp4,ol8,rhel8,openeuler2203
title: 'Configure System Cryptography Policy'
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/oval/shared.xml
index f9835af..4fb6a78 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/oval/shared.xml
@@ -7,6 +7,7 @@
<platform>multi_platform_fedora</platform>
<platform>multi_platform_ol</platform>
<platform>multi_platform_rhel</platform>
+ <platform>multi_platform_openeuler</platform>
</affected>
<description>The aide database must be initialized.</description>
</metadata>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/enable_aide_detection/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/enable_aide_detection/rule.yml
new file mode 100644
index 0000000..d2e80fa
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/enable_aide_detection/rule.yml
@@ -0,0 +1,29 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'aide intrusion detection should be enabled'
+
+description: |-
+ aide (advanced intrusion detection environment) is an intrusion detection tool that
+ can be used to check the integrity of files and directories in the system and identify
+ files or directories that have been maliciously tampered with. The principle of the
+ integrity check is to first construct a baseline database, which contains some attributes
+ of the file or directory such as permissions, users, etc. When performing the integrity
+ check, the current system status is compared with the baseline database to obtain the
+ check results. Finally, the file or directory changes of the current system are reported,
+ that is, the inspection report.
+
+ Enabling aide intrusion detection can effectively identify malicious tampering with files
+ or directories, thereby improving system integrity and security. The files or directories
+ that need to be checked can be configured as needed, which is highly flexible. Users only
+ need to query the check report to determine whether there is malicious tampering.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ The more files that need to be checked, the longer the checking process will take. If users
+ enable aide, they should configure the inspection strategy appropriately based on their own
+ business scenarios.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/software/integrity/software-integrity/ima_verification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/ima_verification/rule.yml
new file mode 100644
index 0000000..426be91
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/ima_verification/rule.yml
@@ -0,0 +1,47 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'IMA metrics should be enabled'
+
+description: |-
+ IMA (Integrity Measurement Architecture) is an integrity protection function provided
+ by the kernel. When IMA is turned on, it can provide integrity measurements for
+ important files in the system based on user-defined policies. The measurement results
+ can be used locally and remotely. Proof of integrity.
+
+ When the IMA measurement function is not enabled in the system, summary information
+ of key files cannot be recorded in real time, and tampering with file contents or
+ attributes cannot be identified. Functions such as local attestation and remote
+ attestation that protect system integrity rely on the summary value provided by IMA
+ metrics, so they cannot be used, or the integrity protection is incomplete.
+
+ IMA global policy configuration is related to the specific environment. Normally,
+ integrity protection is only targeted at immutable files (such as executable files,
+ dynamic libraries, etc.). If the policy is improperly configured, it may lead to
+ excessive performance and memory overhead. It is recommended that users use their
+ own The situation determines whether to enable IMA and configure the correct policy.
+
+ Note: Since IMA is only the measurement part of the global integrity protection
+ mechanism, complete use requires TPM 2.0 and remote attestation services. This
+ specification only explains and recommends the measurement part of IMA. If the
+ system does not integrate TPM 2.0 and remote attestation services, the IMA measurement
+ function should not be enabled.
+
+ IMA measurement does not support container environments and virtual machine
+ environments, requires UEFI startup, and does not support Legacy mode.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ Turning on IMA metrics will cause a slight increase in system startup time and file
+ access time.
+ If the policy is improperly configured (such as measuring real-time changing log files,
+ temporary files, etc.), the measurement log may grow too fast and occupy too much system
+ memory, and the memory occupied by the measurement log will not be released before the
+ next restart of the system. , thus affecting the normal operation of the business. In
+ addition, because the measured files are constantly changing, the measurement value changes,
+ and the remote certification baseline value cannot be updated synchronously, causing the
+ remote certification to fail and losing the meaning of integrity protection.
+
+severity: low
\ No newline at end of file
diff --git a/linux_os/guide/system/software/sudo/sudoers_disable_low_privileged_configure/rule.yml b/linux_os/guide/system/software/sudo/sudoers_disable_low_privileged_configure/rule.yml
new file mode 100644
index 0000000..788eab7
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_disable_low_privileged_configure/rule.yml
@@ -0,0 +1,18 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure sudoers cannot configure scripts writable by low-privileged users'
+
+description: |-
+ sudo can enable the set ordinary user to execute certain specific programs with root privileges,
+ and the corresponding configuration file is /etc/sudoers. Administrator users can configure
+ corresponding rules to make certain scripts or binary files run with root permissions. Therefore,
+ the scripts configured by sudo should only be writable by root. Scripts that can be written by
+ low-privilege users cannot be configured. If low-privilege users are configured, they can be written
+ by root. script, the user can perform privilege escalation operations by modifying the script.
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/software/system-tools/disabled_SysRq/oval/shared.xml b/linux_os/guide/system/software/system-tools/disabled_SysRq/oval/shared.xml
new file mode 100644
index 0000000..ea4e9cf
--- /dev/null
+++ b/linux_os/guide/system/software/system-tools/disabled_SysRq/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <definition class="compliance" id="disabled_SysRq" version="1">
+ <metadata>
+ <title>Disable use of SysRq key</title>
+ <affected family="unix">
+ <platform>multi_platform_openeuler</platform>
+ </affected>
+ <description>Disable SysRq.</description>
+ </metadata>
+ <criteria>
+ <criterion comment="disable sysrq"
+ test_ref="test_disabled_SysRq" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="disable sysrq"
+ id="test_disabled_SysRq" version="1">
+ <ind:object object_ref="obj_test_disabled_SysRq" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_test_disabled_SysRq" version="1">
+ <ind:filepath>/proc/sys/kernel/sysrq</ind:filepath>
+ <ind:pattern operation="pattern match">0</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/software/system-tools/disabled_SysRq/rule.yml b/linux_os/guide/system/software/system-tools/disabled_SysRq/rule.yml
new file mode 100644
index 0000000..ce7e977
--- /dev/null
+++ b/linux_os/guide/system/software/system-tools/disabled_SysRq/rule.yml
@@ -0,0 +1,20 @@
+
+prodtype: openeuler2203
+
+title: 'Disable use of SysRq key'
+
+description: |-
+
+ SysRq allows users with physical access to access dangerous system-level commands
+ in the computer, and the use of SysRq functions needs to be restricted.
+
+ If the SysRq key is not disabled, the SysRq call can be triggered through the
+ keyboard, which may cause commands to be sent directly to the kernel, affecting
+ the system.
+
+ openEuler prohibits the use of SysRq keys by default.
+
+rationale: |-
+ SysRq related commands cannot be used in the system.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/software/uninstall_debugging_tools/rule.yml b/linux_os/guide/system/software/uninstall_debugging_tools/rule.yml
new file mode 100644
index 0000000..c537c20
--- /dev/null
+++ b/linux_os/guide/system/software/uninstall_debugging_tools/rule.yml
@@ -0,0 +1,23 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure to remove unnecessary file system mount support'
+
+description: |-
+ If the business environment contains debugging scripts and tools, they can
+ easily be exploited and attacked by attackers. Therefore, it is strictly
+ prohibited to install various debugging tools and files in the production
+ environment, including but not limited to: code debugging tools, privilege
+ escalation commands, scripts, and tools used for debugging functions, certificates,
+ and keys used in the debugging phase. Perf tools, point management and piling
+ tools for performance testing, attack scripts and tool scripts for verifying
+ security issues such as CVE, etc. Common open source third-party debugging tools
+ include: strace, gdb, readelf, perf, etc.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/linux_os/guide/system/software/uninstall_development_and_compliation_tools/rule.yml b/linux_os/guide/system/software/uninstall_development_and_compliation_tools/rule.yml
new file mode 100644
index 0000000..f3bfd27
--- /dev/null
+++ b/linux_os/guide/system/software/uninstall_development_and_compliation_tools/rule.yml
@@ -0,0 +1,26 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Make sure to remove unnecessary file system mount support'
+
+description: |-
+ If the business environment contains compilation tools, they can
+ easily be used by attackers to edit, tamper with, and reverse analyze
+ key files in the environment to carry out attacks. Therefore, it is
+ strictly prohibited to install various compilation, decompilation,
+ and binary analysis tools in the production environment, including
+ but not limited to: compilation tools, decompilation tools, compilation
+ environments, etc. Common third-party development and compilation tools
+ include: gcc, cpp, mcpp, flex, cmake, make, rpm-build, ld, ar, etc.
+
+ If the business environment relies on interpreters such as python, lua,
+ and perl during deployment or operation, the interpreter running
+ environment can be retained.
+
+ <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+
+rationale: |-
+ none.
+
+severity: high
\ No newline at end of file
diff --git a/openeuler2203/profiles/standard.profile b/openeuler2203/profiles/standard.profile
index de6890c..543712a 100644
--- a/openeuler2203/profiles/standard.profile
+++ b/openeuler2203/profiles/standard.profile
@@ -164,3 +164,96 @@ selections:
- file_permissions_unauthorized_world_writable
- file_permissions_unauthorized_suid
- file_permissions_unauthorized_sgid
+ - network_sniffing_tools
+ - service_rsyncd_disabled
+ - package_openldap-clients_removed
+ - no_forward_files
+ - sshd_configure_correct_interface
+ - sshd_concurrent_unauthenticated_connections
+ - sshd_configure_concurrent_sessions
+ - sshd_disable_x11_forwarding
+ - sshd_configure_correct_LoginGraceTime
+ - sshd_disable_AllowTcpForwardindg
+ - sshd_prohibit_preset_authorized_keys
+ - network_interface_binding_corrently
+ - iptables_loopback_policy_configured_corrently
+ - iptables_input_policy_configured_corrently
+ - iptables_output_policy_configured_corrently
+ - iptables_association_policy_configured_corrently
+ - service_nftables_enabled
+ - nftables_configure_default_deny_policy
+ - nftables_loopback_policy_configured_corrently
+ - nftables_input_policy_configured_corrently
+ - nftables_output_policy_configured_corrently
+ - nftables_association_policy_configured_corrently
+ - sudoers_disable_low_privileged_configure
+ - no_files_globally_writable_files
+ - removed_unnecessary_file_mount_support
+ - read_only_partitions_no_modified
+ - partitions_mounted_nodev_mode
+ - partitions_mounted_noexec_mode
+ - partitoin_mounted_noexec_or_nodev
+ - partitions_mounted_nosuid_mode
+ - audit_privilege_escalation_command
+ - audit_rule_admin_privilege
+ - recorded_authentication_related_event
+ - rsyslog_files_permissions
+ - uninstall_debugging_tools
+ - uninstall_development_and_compliation_tools
+ - package_xorg-x11-server-common_removed
+ - package_httpd_removed
+ - service_smb_disabled
+ - service_named_disabled
+ - service_nfs-server_disabled
+ - service_rpcbind_disabled
+ - service_dhcpd_disabled
+ - configure_first_logging_change_password
+ - sshd_disable_root_login
+ - diasable_root_accessing_system
+ - wireless_disable_interfaces
+ - sshd_enable_warning_banner
+ - disabled_SysRq
+ - sysctl_kernel_yama_ptrace_scope
+ - disabled_unconfined_service_t_programs
+ - enabled_seccomp
+ - define_ld_lib_path_correctly
+ - define_path_strictly
+ - grub2_audit_argument
+ - grub2_audit_backlog_limit_argument
+ - audit_rules_immutable
+ - auditd_data_retention_max_log_file
+ - auditd_data_retention_max_log_file_action
+ - auditd_data_retention_space_left
+ - auditd_data_retention_space_left_action
+ - auditd_data_retention_admin_space_left
+ - auditd_data_retention_admin_space_left_action
+ - auditd_data_disk_error_action
+ - auditd_data_disk_full_action
+ - audit_rules_sysadmin_actions
+ - audit_rules_session_events
+ - audit_rules_time_adjtimex
+ - audit_rules_time_clock_settime
+ - audit_rules_time_settimeofday
+ - audit_rules_time_stime
+ - audit_rules_time_watch_localtime
+ - audit_rules_mac_modification
+ - audit_rules_networkconfig_modification
+ - audit_rules_successful_file_modification
+ - audit_rules_unsuccessful_file_modification_open
+ - audit_rules_unsuccessful_file_modification_ftruncate
+ - audit_rules_unsuccessful_file_modification_creat
+ - audit_rules_unsuccessful_file_modification_openat
+ - audit_rules_file_deletion_events_rename
+ - audit_rules_file_deletion_events_renameat
+ - audit_rules_file_deletion_events_unlink
+ - audit_rules_file_deletion_events_unlinkat
+ - audit_rules_media_export
+ - configure_service_logging
+ - configure_dump_journald_log
+ - configure_rsyslog_log_rotate
+ - rsyslog_remote_loghost
+ - rsyslog_accept_remote_messages_tcp
+ - rsyslog_accept_remote_messages_udp
+ - enable_aide_detection
+ - service_haveged_enabled
+ - configure_crypto_policy
--
2.42.0.windows.2
Reference in New Issue View Git Blame Copy Permalink