+++ /dev/null
-# OSSEC Linux Audit - (C) 2017 OSSEC Project
-#
-# Released under the same license as OSSEC.
-# More details at the LICENSE file included with OSSEC or online
-# at: https://github.com/ossec/ossec-hids/blob/master/LICENSE
-#
-# [Application name] [any or all] [reference]
-# type:<entry name>;
-#
-# Type can be:
-# - f (for file or directory)
-# - p (process running)
-# - d (any file inside the directory)
-#
-# Additional values:
-# For the registry , use "->" to look for a specific entry and another
-# "->" to look for the value.
-# For files, use "->" to look for a specific value in the file.
-#
-# Values can be preceeded by: =: (for equal) - default
-# r: (for ossec regexes)
-# >: (for strcmp greater)
-# <: (for strcmp lower)
-# Multiple patterns can be specified by using " && " between them.
-# (All of them must match for it to return true).
-
-# CIS Checks for Solaris 11
-# Based on Center for Internet Security Benchmark for Solaris 11 Benchmark v1.1.0 https://workbench.cisecurity.org/benchmarks/410
-#
-$home_dirs=/usr2/home/*,/home/*,/home,/*/home/*,/*/home,/;
-#
-#
-#2.1 Disable Local-only Graphical Login Environment
-[CIS - Solaris 11 Configuration - 2.1 Disable Local-only Graphical Login Environment] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:gdm;
-p:cde;
-#
-#
-#2.2 Configure sendmail Service for Local-Only Mode
-[CIS - Solaris 11 Configuration - 2.2 Configure sendmail Service for Local-Only Mode] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:!/etc/mail/local.cf;
-#
-#
-#2.3 Disable RPC Encryption Key
-[CIS - Solaris 11 Configuration - 2.3 Disable RPC Encryption Key] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:keyserv;
-#
-#
-#2.4 Disable NIS Server Services
-[CIS - Solaris 11 Configuration - 2.4 Disable NIS Server Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:ypserv;
-p:ypbind;
-p:ypxfr;
-p:rpc.yppasswdd;
-p:rpc.ypupdated;
-f:/etc/init.d/nis;
-#
-#
-#2.5 Disable NIS Client Services
-[CIS - Solaris 11 Configuration - 2.5 Disable NIS Client Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:ypserv;
-p:ypbind;
-p:ypxfr;
-p:rpc.yppasswdd;
-p:rpc.ypupdated;
-f:/etc/init.d/nis;
-#
-#
-#2.6 Disable Kerberos TGT Expiration Warning
-[CIS - Solaris 11 Configuration - 2.6 Disable Kerberos TGT Expiration Warning] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:ktkt_warnd;
-#
-#
-#2.7 Disable Generic Security Services (GSS)
-[CIS - Solaris 11 Configuration - 2.7 Disable Generic Security Services (GSS)] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:gssd;
-#
-#
-#2.8 Disable Removable Volume Manager
-[CIS - Solaris 11 Configuration - 2.8 Disable Removable Volume Manager] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:smserverd;
-#
-#
-#2.9 Disable automount Service
-[CIS - Solaris 11 Configuration - 2.9 Disable automount Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:automountd;
-#
-#
-#2.10 Disable Apache Service
-[CIS - Solaris 11 Configuration - 2.10 Disable Apache Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:apache;
-p:httpd;
-#
-#
-#2.11 Disable Local-only RPC Port Mapping Service
-[CIS - Solaris 11 Configuration - 2.11 Disable Local-only RPC Port Mapping Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:rpcbind;
-#
-#
-#2.12 Configure TCP Wrappers
-[CIS - Solaris 11 Configuration - 2.12 Configure TCP Wrappers] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:!/etc/hosts.allow;
-f:!/etc/hosts.deny;
-#
-#
-#2.13 Disable Telnet Service
-[CIS - Solaris 11 Configuration - 2.13 Disable Telnet Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-p:telnetd;
-#
-#
-#3.1 Restrict Core Dumps to Protected Directory
-[CIS - Solaris 11 Configuration - 3.1 Restrict Core Dumps to Protected Directory] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/coreadm.conf -> !r:^COREADM_GLOB_PATTERN\p\.+;
-f:/etc/coreadm.conf -> !r:^COREADM_GLOB_CONTENT\pdefault;
-f:/etc/coreadm.conf -> !r:^COREADM_INIT_PATTERN\pcore;
-f:/etc/coreadm.conf -> !r:^COREADM_INIT_CONTENT\pdefault;
-f:/etc/coreadm.conf -> !r:^COREADM_GLOB_ENABLED\pyes|^COREADM_GLOB_ENABLED\pno;
-f:/etc/coreadm.conf -> !r:^COREADM_PROC_ENABLED\pno;
-f:/etc/coreadm.conf -> !r:^COREADM_GLOB_SETID_ENABLED\pyes|^COREADM_GLOB_SETID_ENABLED\pno;
-f:/etc/coreadm.conf -> !r:^COREADM_PROC_SETID_ENABLED\pno;
-f:/etc/coreadm.conf -> !r:^COREADM_GLOB_LOG_ENABLED\pyes;
-#
-#
-#3.2 Enable Stack Protection
-[CIS - Solaris 11 Configuration - 3.2 Enable Stack Protection] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:!/etc/system;
-f:/etc/system -> !r:^\s*\t*noexec_user_stack\p1;
-f:/etc/system -> !r:^# && r:\s*\t*noexec_user_stack\p0;
-f:/etc/system -> !r:^\s*\t*noexec_user_stack_log\p1;
-f:/etc/system -> !r:^# && r:\s*\t*noexec_user_stack_log\p0;
-#
-#
-#3.3 Enable Strong TCP Sequence Number Generation
-[CIS - Solaris 11 Configuration - 3.3 Enable Strong TCP Sequence Number Generation] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/inetinit -> !r:^TCP_STRONG_ISS\p2;
-f:/etc/default/inetinit -> !r:^# && r:TCP_STRONG_ISS\p1;
-#
-#
-#4.1 Create CIS Audit Class
-[CIS - Solaris 11 Configuration - 4.1 Create CIS Audit Class] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/security/audit_class -> !r:0x\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d:cis:\.+;
-#
-#
-#4.2 Enable Auditing of Incoming Network Connections
-[CIS - Solaris 11 Configuration - 4.2 Enable Auditing of Incoming Network Connections] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/security/audit_event -> !r:^\d+:AUE_ACCEPT:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_CONNECT:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SOCKACCEPT:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SOCKCONNECT:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_inetd_connect:\.+cis\.*;
-#
-#
-#4.3 Enable Auditing of File Metadata Modification Events
-[CIS - Solaris 11 Configuration - 4.3 Enable Auditing of File Metadata Modification Events] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/security/audit_event -> !r:^\d+:AUE_CHMOD:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_CHOWN:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_FCHOWN:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_FCHMOD:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_LCHOWN:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_ACLSET:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_FACLSET:\.+cis\.*;
-#
-#
-#4.4 Enable Auditing of Process and Privilege Events
-[CIS - Solaris 11 Configuration - 4.4 Enable Auditing of Process and Privilege Events] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/security/audit_event -> !r:^\d+:AUE_CHROOT:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETREUID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETREGID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_FCHROOT:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_PFEXEC:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETUID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_NICE:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETGID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_PRIOCNTLSYS:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETEGID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETEUID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETPRIV:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETSID:\.+cis\.*;
-f:/etc/security/audit_event -> !r:^\d+:AUE_SETPGID:\.+cis\.*;
-#
-#
-#4.5 Configure Solaris Auditing
-[CIS - Solaris 11 Configuration - 4.5 Configure Solaris Auditing] [any] [https://workbench.cisecurity.org/benchmarks/410]
-d:/var/spool/cron/crontabs -> !r:/usr/sbin/audit -n;
-#
-#
-#5.1 Default Service File Creation Mask
-[CIS - Solaris 11 Configuration - 5.1 Default Service File Creation Mask] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/profile -> !r:^umask\s*\d\d\d;
-#
-#
-#6.2 Disable "nobody" Access for RPC Encryption Key Storage Service
-[CIS - Solaris 11 Configuration - 6.2 Disable "nobody" Access for RPC Encryption Key Storage Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f!:/etc/default/keyserv;
-f:/etc/default/keyserv -> !r:^ENABLE\.NOBODY\.KEYS\pNO;
-f:/etc/default/keyserv -> !r:^# && r:ENABLE\.NOBODY\.KEYS\pYES;
-#
-#
-#6.3 Disable X11 Forwarding for SSH
-[CIS - Solaris 11 Configuration - 6.3 Disable X11 Forwarding for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ssh/sshd_config -> !r:^X11Forwarding\s*no;
-f:/etc/ssh/sshd_config -> !r:^# && r:X11Forwarding\s*yes;
-#
-#
-#6.4 Limit Consecutive Login Attempts for SSH
-[CIS - Solaris 11 Configuration - 6.4 Limit Consecutive Login Attempts for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ssh/sshd_config -> !r:^MaxAuthTries\s*3;
-f:/etc/ssh/sshd_config -> !r:^# && r:MaxAuthTries\s*3\d+;
-#
-#
-#6.5 Disable Rhost-based Authentication for SSH
-[CIS - Solaris 11 Configuration - 6.5 Disable Rhost-based Authentication for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ssh/sshd_config -> !r:^IgnoreRhosts\s*yes;
-f:/etc/ssh/sshd_config -> !r:^# && r:IgnoreRhosts\s*no;
-#
-#
-#6.6 Disable root login for SSH
-[CIS - Solaris 11 Configuration - 6.6 Disable root login for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ssh/sshd_config -> !r:^PermitRootLogin\s*no;
-f:/etc/ssh/sshd_config -> !r:^# && r:PermitRootLogin\s*yes;
-#
-#
-#6.7 Blocking Authentication Using Empty/Null Passwords for SSH
-[CIS - Solaris 11 Configuration - 6.7 Blocking Authentication Using Empty/Null Passwords for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ssh/sshd_config -> !r:^PermitEmptyPasswords\s*no;
-f:/etc/ssh/sshd_config -> !r:^# && r:PermitEmptyPasswords\s*yes;
-#
-#
-#6.8 Disable Host-based Authentication for Login-based Services
-[CIS - Solaris 11 Configuration - 6.8 Disable Host-based Authentication for Login-based Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/pam.conf -> !r:^rlogin\s*\t*auth sufficient\s*\t*pam_rhosts_auth.so.1;
-f:/etc/pam.conf -> !r:^rsh\s*\t*auth sufficient\s*\t*pam_rhosts_auth.so.1;
-#
-#
-#6.9 Restrict FTP Use
-[CIS - Solaris 11 Configuration - 6.9 Restrict FTP Use] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ftpd/ftpusers -> !r:^root;
-f:/etc/ftpd/ftpusers -> !r:^daemon;
-f:/etc/ftpd/ftpusers -> !r:^bin;
-f:/etc/ftpd/ftpusers -> !r:^sys;
-f:/etc/ftpd/ftpusers -> !r:^adm;
-f:/etc/ftpd/ftpusers -> !r:^uucp;
-f:/etc/ftpd/ftpusers -> !r:^nuucp;
-f:/etc/ftpd/ftpusers -> !r:^smmsp;
-f:/etc/ftpd/ftpusers -> !r:^listen;
-f:/etc/ftpd/ftpusers -> !r:^gdm;
-f:/etc/ftpd/ftpusers -> !r:^lp;
-f:/etc/ftpd/ftpusers -> !r:^webservd;
-f:/etc/ftpd/ftpusers -> !r:^postgres;
-f:/etc/ftpd/ftpusers -> !r:^svctag;
-f:/etc/ftpd/ftpusers -> !r:^openldap;
-f:/etc/ftpd/ftpusers -> !r:^unknown;
-f:/etc/ftpd/ftpusers -> !r:^aiuser;
-f:/etc/ftpd/ftpusers -> !r:^nobody;
-f:/etc/ftpd/ftpusers -> !r:^nobody4;
-f:/etc/ftpd/ftpusers -> !r:^noaccess;
-#
-#
-#6.10 Set Delay between Failed Login Attempts to 4
-[CIS - Solaris 11 Configuration - 6.10 Set Delay between Failed Login Attempts to 4] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/login -> !r:^SLEEPTIME\p4;
-f:/etc/default/login -> !r:^# && r:SLEEPTIME\p4\d;
-#
-#
-#6.11 Remove Autologin Capabilities from the GNOME desktop
-[CIS - Solaris 11 Configuration - 6.11 Remove Autologin Capabilities from the GNOME desktop] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/pam.conf -> !r:^# && r:gdm-autologin;
-#
-#
-#6.12 Set Default Screen Lock for GNOME Users
-[CIS - Solaris 11 Configuration - 6.12 Set Default Screen Lock for GNOME Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/usr/share/X11/app-defaults/XScreensaver -> !r:^*timeout:\s*\t*0:10:00;
-f:/usr/share/X11/app-defaults/XScreensaver -> !r:^*locktimeout:\s*\t*0:00:00;
-f:/usr/share/X11/app-defaults/XScreensaver -> !r:^*lock:\s*\t*true;
-#
-#
-#6.13 Restrict at/cron to Authorized Users
-[CIS - Solaris 11 Configuration - 6.13 Restrict at/cron to Authorized Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/cron.d/cron.deny;
-f:/etc/cron.d/at.deny;
-f:!/etc/cron.d/cron.allow;
-f:/etc/cron.d/cron.allow -> !r:^root$;
-f:!/etc/cron.d/at.allow;
-f:/etc/cron.d/at.allow -> !r:^# && r:\w;
-#
-#
-#6.14 Restrict root Login to System Console
-[CIS - Solaris 11 Configuration - 6.14 Restrict root Login to System Console] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/login -> !r:^CONSOLE\p/dev/console;
-#
-#
-#6.15 Set Retry Limit for Account Lockout
-[CIS - Solaris 11 Configuration - 6.14 Restrict root Login to System Console] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/login -> !r:^RETRIES\p3;
-f:/etc/default/login -> !r:^# && r:RETRIES\p3\d;
-f:/etc/security/policy.conf -> !r:^LOCK_AFTER_RETRIES\pyes;
-f:/etc/security/policy.conf -> !r:^# && r:LOCK_AFTER_RETRIES\pno;
-#
-#
-#6.17 Secure the GRUB Menu (Intel)
-[CIS - Solaris 11 Configuration - 6.17 Secure the GRUB Menu (Intel)] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/rpool/boot/grub/menu.lst -> !r:^password\s*--md5;
-#
-#
-#7.1 Set Password Expiration Parameters on Active Accounts
-[CIS - Solaris 11 Configuration - 7.1 Set Password Expiration Parameters on Active Accounts] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/passwd -> !r:^maxweeks\p13;
-f:/etc/default/passwd -> !r:^# &&r:maxweeks\p13\d;
-f:/etc/default/passwd -> !r:^minweeks\p1;
-f:/etc/default/passwd -> !r:^# &&r:minweeks\p1\d;
-f:/etc/default/passwd -> !r:^warnweeks\p4;
-f:/etc/default/passwd -> !r:^# &&r:warnweeks\p4\d;
-#
-#
-#7.2 Set Strong Password Creation Policies
-[CIS - Solaris 11 Configuration - 7.2 Set Strong Password Creation Policies] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/passwd -> !r:^passlength\p8;
-f:/etc/default/passwd -> !r:^# && r:passlength\p8\d;
-f:/etc/default/passwd -> !r:^namecheck\pyes;
-f:/etc/default/passwd -> !r:^# && r:namecheck\pno;
-f:/etc/default/passwd -> !r:^history\p10;
-f:/etc/default/passwd -> !r:^# && r:history\p10\d;
-f:/etc/default/passwd -> !r:^mindiff\p3;
-f:/etc/default/passwd -> !r:^# && r:mindiff\p3\d;
-f:/etc/default/passwd -> !r:^minalpha\p2;
-f:/etc/default/passwd -> !r:^# && r:minalpha\p2\d;
-f:/etc/default/passwd -> !r:^minupper\p1;
-f:/etc/default/passwd -> !r:^# && r:minupper\p1\d;
-f:/etc/default/passwd -> !r:^minlower\p1;
-f:/etc/default/passwd -> !r:^# && r:minlower\p1\d;
-f:/etc/default/passwd -> !r:^minnonalpha\p1;
-f:/etc/default/passwd -> !r:^# && r:minnonalpha\p1\d;
-f:/etc/default/passwd -> !r:^maxrepeats\p0;
-f:/etc/default/passwd -> !r:^# && r:maxrepeats\p0\d;
-f:/etc/default/passwd -> !r:^whitespace\pyes;
-f:/etc/default/passwd -> !r:^# && r:whitespace\pno;
-f:/etc/default/passwd -> !r:^dictiondbdir\p/var/passwd;
-f:/etc/default/passwd -> !r:^dictionlist\p/usr/share/lib/dict/words;
-#
-#
-#7.3 Set Default umask for users
-[CIS - Solaris 11 Configuration - 7.3 Set Default umask for users] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/login -> !r:^umask\p027|^umask\p077;
-f:/etc/default/login -> !r:^# && r:umask\p026;
-f:/etc/default/login -> !r:^# && r:umask\p022;
-#
-#
-#7.4 Set Default File Creation Mask for FTP Users
-[CIS - Solaris 11 Configuration - 7.4 Set Default File Creation Mask for FTP Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/proftpd.conf -> !r:^umask\s*027;
-f:/etc/proftpd.conf -> !r:^# && r:umask\s*026;
-f:/etc/proftpd.conf -> !r:^# && r:umask\s*022;
-#
-#
-#7.5 Set "mesg n" as Default for All Users
-[CIS - Solaris 11 Configuration - 7.5 Set "mesg n" as Default for All Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/.login -> !r:^mesg\s*n;
-f:/etc/profile -> !r:^mesg\s*n;
-#
-#
-#8.1 Create Warnings for Standard Login Services
-[CIS - Solaris 11 Configuration - 8.1 Create Warnings for Standard Login Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/issue -> r:SunOS;
-f:/etc/issue -> r:Oracle;
-f:/etc/issue -> r:solaris;
-f:/etc/issue -> !r:Authorized users only. All activity may be monitored and reported;
-f:/etc/motd -> r:SunOS;
-f:/etc/motd -> r:Oracle;
-f:/etc/motd -> r:solaris;
-f:/etc/motd -> !r:Authorized users only. All activity may be monitored and reported;
-#
-#
-#8.2 Enable a Warning Banner for the SSH Service
-[CIS - Solaris 11 Configuration - 8.2 Enable a Warning Banner for the SSH Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/ssh/sshd_config -> !r:^Banner\s*/etc/issue;
-#
-#
-#8.3 Enable a Warning Banner for the GNOME Service
-[CIS - Solaris 11 Configuration - 8.3 Enable a Warning Banner for the GNOME Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/gdm/Init/Default -> !r:^/usr/bin/zenity\s\.;
-#
-#
-#8.4 Enable a Warning Banner for the FTP service
-[CIS - Solaris 11 Configuration - 8.4 Enable a Warning Banner for the FTP service] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/proftpd.conf -> !r:^DisplayConnect\s+/etc/issue;
-#
-#
-#8.5 Check that the Banner Setting for telnet is Null
-[CIS - Solaris 11 Configuration - 8.5 Check that the Banner Setting for telnet is Null] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/default/telnetd -> !r:^# && r:BANNER=\.;
-f:/etc/default/telnetd -> !r:BANNER=$;
-#
-#
-#9.3 Verify System Account Default Passwords
-[CIS - Solaris 11 Configuration - 9.3 Verify System Account Default Passwords] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/shadow -> r:daemon && !r::NL:|:NP:;
-f:/etc/shadow -> r:lp && !r::NL:|:NP:;
-f:/etc/shadow -> r:adm && !r::NL:|:NP:;
-f:/etc/shadow -> r:bin && !r::NL:|:NP:;
-f:/etc/shadow -> r:gdm && !r::\p*LK\p*:;
-f:/etc/shadow -> r:noaccess && !r::\p*LK\p*:;
-f:/etc/shadow -> r:nobody && !r::\p*LK\p*:;
-f:/etc/shadow -> r:nobody4 && !r::\p*LK\p*:;
-f:/etc/shadow -> r:openldap && !r::\p*LK\p*:;
-f:/etc/shadow -> r:unknown && !r::\p*LK\p*:;
-f:/etc/shadow -> r:webservd && !r::\p*LK\p*:;
-f:/etc/shadow -> r:mysql && !r::NL:|:NP:;
-f:/etc/shadow -> r:nuuc && !r::NL:|:NP:;
-f:/etc/shadow -> r:postgres && !r::NL:|:NP:;
-f:/etc/shadow -> r:smmsp && !r::NL:|:NP:;
-f:/etc/shadow -> r:sys && !r::NL:|:NP:;
-f:/etc/shadow -> r:uucp && !r::NL:|:NP:;
-f:/etc/shadow -> r:aiuser && !r::\p*LK\p*:;
-f:/etc/shadow -> r:dhcpserv && !r::\p*LK\p*:;
-f:/etc/shadow -> r:dladm && !r::\p*LK\p*:;
-f:/etc/shadow -> r:ftp && !r::\p*LK\p*:;
-f:/etc/shadow -> r:netadm && !r::\p*LK\p*:;
-f:/etc/shadow -> r:netcfg && !r::\p*LK\p*:;
-f:/etc/shadow -> r:pkg5srv && !r::\p*LK\p*:;
-f:/etc/shadow -> r:svctag && !r::\p*LK\p*:;
-f:/etc/shadow -> r:xvm && !r::\p*LK\p*:;
-f:/etc/shadow -> r:upnp && !r::NL:|:NP:;
-f:/etc/shadow -> r:zfssnap && !r::NL:|:NP:;
-#
-#
-#9.4 Ensure Password Fields are Not Empty
-[CIS - Solaris 11 Configuration - 9.4 Ensure Password Fields are Not Empty] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/shadow -> r:\.+::\.+\w+\.*$;
-#
-#
-#9.5 Verify No UID 0 Accounts Exist Other than root
-[CIS - Solaris 11 Configuration - 9.5 Verify No UID 0 Accounts Exist Other than root] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/passwd -> !r:^root && r::\.:0:\.*;
-#
-#
-#9.6 Ensure root PATH Integrity
-[CIS - Solaris 11 Configuration - Ensure root PATH Integrity] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/profile -> r:.;
-f:/etc/environment -> r:.;
-f:/.profile -> r:.;
-f:/.bash_profile -> r:.;
-f:/.bashrc -> r:.;
-f:/etc/profile -> r:::;
-f:/etc/environment -> r:::;
-f:/.profile -> r:::;
-f:/.bash_profile -> r:::;
-f:/.bashrc -> r:::;
-f:/etc/profile -> r::$;
-f:/etc/environment -> r::$;
-f:/.profile -> r::$;
-f:/.bash_profile -> r::$;
-f:/.bashrc -> r::$;
-#
-#
-#9.10 Check for Presence of User .rhosts Files
-[CIS - Solaris 11 Configuration - 9.10 Check for Presence of User .rhosts Files] [any] [https://workbench.cisecurity.org/benchmarks/410]
-d:$home_dirs -> ^.rhosts$;
-#
-#
-#9.12 Check That Users Are Assigned Home Directories
-[CIS - Solaris 11 Configuration - 9.12 Check That Users Are Assigned Home Directories] [any] [https://workbench.cisecurity.org/benchmarks/410]
-f:/etc/passwd -> \w+:\.*:\d*:\d*:\.*:\S+:\.*;
-#
-#
-#9.20 Check for Presence of User .netrc Files
-[CIS - Solaris 11 Configuration - 9.20 Check for Presence of User .netrc Files] [any] [https://workbench.cisecurity.org/benchmarks/410]
-d:$home_dirs -> ^.netrc$;
-#
-#
-#9.21 Check for Presence of User .forward Files
-[CIS - Solaris 11 Configuration - 9.21 Check for Presence of User .forward Files] [any] [https://workbench.cisecurity.org/benchmarks/410]
-d:$home_dirs -> ^.forward$;
-#
-#
-#
projects / ossec-hids.git / blobdiff