--- /dev/null
+# OSSEC Linux Audit - (C) 2017 OSSEC Project
+#
+# Released under the same license as OSSEC.
+# More details at the LICENSE file included with OSSEC or online
+# at: https://github.com/ossec/ossec-hids/blob/master/LICENSE
+#
+# [Application name] [any or all] [reference]
+# type:<entry name>;
+#
+# Type can be:
+# - f (for file or directory)
+# - p (process running)
+# - d (any file inside the directory)
+#
+# Additional values:
+# For the registry , use "->" to look for a specific entry and another
+# "->" to look for the value.
+# For files, use "->" to look for a specific value in the file.
+#
+# Values can be preceeded by: =: (for equal) - default
+# r: (for ossec regexes)
+# >: (for strcmp greater)
+# <: (for strcmp lower)
+# Multiple patterns can be specified by using " && " between them.
+# (All of them must match for it to return true).
+
+# CIS Checks for Solaris 11
+# Based on Center for Internet Security Benchmark for Solaris 11 Benchmark v1.1.0 https://workbench.cisecurity.org/benchmarks/410
+#
+$home_dirs=/usr2/home/*,/home/*,/home,/*/home/*,/*/home,/;
+#
+#
+#2.1 Disable Local-only Graphical Login Environment
+[CIS - Solaris 11 Configuration - 2.1 Disable Local-only Graphical Login Environment] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:gdm;
+p:cde;
+#
+#
+#2.2 Configure sendmail Service for Local-Only Mode
+[CIS - Solaris 11 Configuration - 2.2 Configure sendmail Service for Local-Only Mode] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:!/etc/mail/local.cf;
+#
+#
+#2.3 Disable RPC Encryption Key
+[CIS - Solaris 11 Configuration - 2.3 Disable RPC Encryption Key] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:keyserv;
+#
+#
+#2.4 Disable NIS Server Services
+[CIS - Solaris 11 Configuration - 2.4 Disable NIS Server Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:ypserv;
+p:ypbind;
+p:ypxfr;
+p:rpc.yppasswdd;
+p:rpc.ypupdated;
+f:/etc/init.d/nis;
+#
+#
+#2.5 Disable NIS Client Services
+[CIS - Solaris 11 Configuration - 2.5 Disable NIS Client Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:ypserv;
+p:ypbind;
+p:ypxfr;
+p:rpc.yppasswdd;
+p:rpc.ypupdated;
+f:/etc/init.d/nis;
+#
+#
+#2.6 Disable Kerberos TGT Expiration Warning
+[CIS - Solaris 11 Configuration - 2.6 Disable Kerberos TGT Expiration Warning] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:ktkt_warnd;
+#
+#
+#2.7 Disable Generic Security Services (GSS)
+[CIS - Solaris 11 Configuration - 2.7 Disable Generic Security Services (GSS)] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:gssd;
+#
+#
+#2.8 Disable Removable Volume Manager
+[CIS - Solaris 11 Configuration - 2.8 Disable Removable Volume Manager] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:smserverd;
+#
+#
+#2.9 Disable automount Service
+[CIS - Solaris 11 Configuration - 2.9 Disable automount Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:automountd;
+#
+#
+#2.10 Disable Apache Service
+[CIS - Solaris 11 Configuration - 2.10 Disable Apache Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:apache;
+p:httpd;
+#
+#
+#2.11 Disable Local-only RPC Port Mapping Service
+[CIS - Solaris 11 Configuration - 2.11 Disable Local-only RPC Port Mapping Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:rpcbind;
+#
+#
+#2.12 Configure TCP Wrappers
+[CIS - Solaris 11 Configuration - 2.12 Configure TCP Wrappers] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:!/etc/hosts.allow;
+f:!/etc/hosts.deny;
+#
+#
+#2.13 Disable Telnet Service
+[CIS - Solaris 11 Configuration - 2.13 Disable Telnet Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+p:telnetd;
+#
+#
+#3.1 Restrict Core Dumps to Protected Directory
+[CIS - Solaris 11 Configuration - 3.1 Restrict Core Dumps to Protected Directory] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/coreadm.conf -> !r:^COREADM_GLOB_PATTERN\p\.+;
+f:/etc/coreadm.conf -> !r:^COREADM_GLOB_CONTENT\pdefault;
+f:/etc/coreadm.conf -> !r:^COREADM_INIT_PATTERN\pcore;
+f:/etc/coreadm.conf -> !r:^COREADM_INIT_CONTENT\pdefault;
+f:/etc/coreadm.conf -> !r:^COREADM_GLOB_ENABLED\pyes|^COREADM_GLOB_ENABLED\pno;
+f:/etc/coreadm.conf -> !r:^COREADM_PROC_ENABLED\pno;
+f:/etc/coreadm.conf -> !r:^COREADM_GLOB_SETID_ENABLED\pyes|^COREADM_GLOB_SETID_ENABLED\pno;
+f:/etc/coreadm.conf -> !r:^COREADM_PROC_SETID_ENABLED\pno;
+f:/etc/coreadm.conf -> !r:^COREADM_GLOB_LOG_ENABLED\pyes;
+#
+#
+#3.2 Enable Stack Protection
+[CIS - Solaris 11 Configuration - 3.2 Enable Stack Protection] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:!/etc/system;
+f:/etc/system -> !r:^\s*\t*noexec_user_stack\p1;
+f:/etc/system -> !r:^# && r:\s*\t*noexec_user_stack\p0;
+f:/etc/system -> !r:^\s*\t*noexec_user_stack_log\p1;
+f:/etc/system -> !r:^# && r:\s*\t*noexec_user_stack_log\p0;
+#
+#
+#3.3 Enable Strong TCP Sequence Number Generation
+[CIS - Solaris 11 Configuration - 3.3 Enable Strong TCP Sequence Number Generation] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/inetinit -> !r:^TCP_STRONG_ISS\p2;
+f:/etc/default/inetinit -> !r:^# && r:TCP_STRONG_ISS\p1;
+#
+#
+#4.1 Create CIS Audit Class
+[CIS - Solaris 11 Configuration - 4.1 Create CIS Audit Class] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/security/audit_class -> !r:0x\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d\d:cis:\.+;
+#
+#
+#4.2 Enable Auditing of Incoming Network Connections
+[CIS - Solaris 11 Configuration - 4.2 Enable Auditing of Incoming Network Connections] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/security/audit_event -> !r:^\d+:AUE_ACCEPT:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_CONNECT:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SOCKACCEPT:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SOCKCONNECT:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_inetd_connect:\.+cis\.*;
+#
+#
+#4.3 Enable Auditing of File Metadata Modification Events
+[CIS - Solaris 11 Configuration - 4.3 Enable Auditing of File Metadata Modification Events] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/security/audit_event -> !r:^\d+:AUE_CHMOD:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_CHOWN:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_FCHOWN:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_FCHMOD:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_LCHOWN:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_ACLSET:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_FACLSET:\.+cis\.*;
+#
+#
+#4.4 Enable Auditing of Process and Privilege Events
+[CIS - Solaris 11 Configuration - 4.4 Enable Auditing of Process and Privilege Events] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/security/audit_event -> !r:^\d+:AUE_CHROOT:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETREUID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETREGID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_FCHROOT:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_PFEXEC:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETUID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_NICE:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETGID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_PRIOCNTLSYS:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETEGID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETEUID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETPRIV:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETSID:\.+cis\.*;
+f:/etc/security/audit_event -> !r:^\d+:AUE_SETPGID:\.+cis\.*;
+#
+#
+#4.5 Configure Solaris Auditing
+[CIS - Solaris 11 Configuration - 4.5 Configure Solaris Auditing] [any] [https://workbench.cisecurity.org/benchmarks/410]
+d:/var/spool/cron/crontabs -> !r:/usr/sbin/audit -n;
+#
+#
+#5.1 Default Service File Creation Mask
+[CIS - Solaris 11 Configuration - 5.1 Default Service File Creation Mask] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/profile -> !r:^umask\s*\d\d\d;
+#
+#
+#6.2 Disable "nobody" Access for RPC Encryption Key Storage Service
+[CIS - Solaris 11 Configuration - 6.2 Disable "nobody" Access for RPC Encryption Key Storage Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f!:/etc/default/keyserv;
+f:/etc/default/keyserv -> !r:^ENABLE\.NOBODY\.KEYS\pNO;
+f:/etc/default/keyserv -> !r:^# && r:ENABLE\.NOBODY\.KEYS\pYES;
+#
+#
+#6.3 Disable X11 Forwarding for SSH
+[CIS - Solaris 11 Configuration - 6.3 Disable X11 Forwarding for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ssh/sshd_config -> !r:^X11Forwarding\s*no;
+f:/etc/ssh/sshd_config -> !r:^# && r:X11Forwarding\s*yes;
+#
+#
+#6.4 Limit Consecutive Login Attempts for SSH
+[CIS - Solaris 11 Configuration - 6.4 Limit Consecutive Login Attempts for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ssh/sshd_config -> !r:^MaxAuthTries\s*3;
+f:/etc/ssh/sshd_config -> !r:^# && r:MaxAuthTries\s*3\d+;
+#
+#
+#6.5 Disable Rhost-based Authentication for SSH
+[CIS - Solaris 11 Configuration - 6.5 Disable Rhost-based Authentication for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ssh/sshd_config -> !r:^IgnoreRhosts\s*yes;
+f:/etc/ssh/sshd_config -> !r:^# && r:IgnoreRhosts\s*no;
+#
+#
+#6.6 Disable root login for SSH
+[CIS - Solaris 11 Configuration - 6.6 Disable root login for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ssh/sshd_config -> !r:^PermitRootLogin\s*no;
+f:/etc/ssh/sshd_config -> !r:^# && r:PermitRootLogin\s*yes;
+#
+#
+#6.7 Blocking Authentication Using Empty/Null Passwords for SSH
+[CIS - Solaris 11 Configuration - 6.7 Blocking Authentication Using Empty/Null Passwords for SSH] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ssh/sshd_config -> !r:^PermitEmptyPasswords\s*no;
+f:/etc/ssh/sshd_config -> !r:^# && r:PermitEmptyPasswords\s*yes;
+#
+#
+#6.8 Disable Host-based Authentication for Login-based Services
+[CIS - Solaris 11 Configuration - 6.8 Disable Host-based Authentication for Login-based Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/pam.conf -> !r:^rlogin\s*\t*auth sufficient\s*\t*pam_rhosts_auth.so.1;
+f:/etc/pam.conf -> !r:^rsh\s*\t*auth sufficient\s*\t*pam_rhosts_auth.so.1;
+#
+#
+#6.9 Restrict FTP Use
+[CIS - Solaris 11 Configuration - 6.9 Restrict FTP Use] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ftpd/ftpusers -> !r:^root;
+f:/etc/ftpd/ftpusers -> !r:^daemon;
+f:/etc/ftpd/ftpusers -> !r:^bin;
+f:/etc/ftpd/ftpusers -> !r:^sys;
+f:/etc/ftpd/ftpusers -> !r:^adm;
+f:/etc/ftpd/ftpusers -> !r:^uucp;
+f:/etc/ftpd/ftpusers -> !r:^nuucp;
+f:/etc/ftpd/ftpusers -> !r:^smmsp;
+f:/etc/ftpd/ftpusers -> !r:^listen;
+f:/etc/ftpd/ftpusers -> !r:^gdm;
+f:/etc/ftpd/ftpusers -> !r:^lp;
+f:/etc/ftpd/ftpusers -> !r:^webservd;
+f:/etc/ftpd/ftpusers -> !r:^postgres;
+f:/etc/ftpd/ftpusers -> !r:^svctag;
+f:/etc/ftpd/ftpusers -> !r:^openldap;
+f:/etc/ftpd/ftpusers -> !r:^unknown;
+f:/etc/ftpd/ftpusers -> !r:^aiuser;
+f:/etc/ftpd/ftpusers -> !r:^nobody;
+f:/etc/ftpd/ftpusers -> !r:^nobody4;
+f:/etc/ftpd/ftpusers -> !r:^noaccess;
+#
+#
+#6.10 Set Delay between Failed Login Attempts to 4
+[CIS - Solaris 11 Configuration - 6.10 Set Delay between Failed Login Attempts to 4] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/login -> !r:^SLEEPTIME\p4;
+f:/etc/default/login -> !r:^# && r:SLEEPTIME\p4\d;
+#
+#
+#6.11 Remove Autologin Capabilities from the GNOME desktop
+[CIS - Solaris 11 Configuration - 6.11 Remove Autologin Capabilities from the GNOME desktop] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/pam.conf -> !r:^# && r:gdm-autologin;
+#
+#
+#6.12 Set Default Screen Lock for GNOME Users
+[CIS - Solaris 11 Configuration - 6.12 Set Default Screen Lock for GNOME Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/usr/share/X11/app-defaults/XScreensaver -> !r:^*timeout:\s*\t*0:10:00;
+f:/usr/share/X11/app-defaults/XScreensaver -> !r:^*locktimeout:\s*\t*0:00:00;
+f:/usr/share/X11/app-defaults/XScreensaver -> !r:^*lock:\s*\t*true;
+#
+#
+#6.13 Restrict at/cron to Authorized Users
+[CIS - Solaris 11 Configuration - 6.13 Restrict at/cron to Authorized Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/cron.d/cron.deny;
+f:/etc/cron.d/at.deny;
+f:!/etc/cron.d/cron.allow;
+f:/etc/cron.d/cron.allow -> !r:^root$;
+f:!/etc/cron.d/at.allow;
+f:/etc/cron.d/at.allow -> !r:^# && r:\w;
+#
+#
+#6.14 Restrict root Login to System Console
+[CIS - Solaris 11 Configuration - 6.14 Restrict root Login to System Console] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/login -> !r:^CONSOLE\p/dev/console;
+#
+#
+#6.15 Set Retry Limit for Account Lockout
+[CIS - Solaris 11 Configuration - 6.14 Restrict root Login to System Console] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/login -> !r:^RETRIES\p3;
+f:/etc/default/login -> !r:^# && r:RETRIES\p3\d;
+f:/etc/security/policy.conf -> !r:^LOCK_AFTER_RETRIES\pyes;
+f:/etc/security/policy.conf -> !r:^# && r:LOCK_AFTER_RETRIES\pno;
+#
+#
+#6.17 Secure the GRUB Menu (Intel)
+[CIS - Solaris 11 Configuration - 6.17 Secure the GRUB Menu (Intel)] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/rpool/boot/grub/menu.lst -> !r:^password\s*--md5;
+#
+#
+#7.1 Set Password Expiration Parameters on Active Accounts
+[CIS - Solaris 11 Configuration - 7.1 Set Password Expiration Parameters on Active Accounts] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/passwd -> !r:^maxweeks\p13;
+f:/etc/default/passwd -> !r:^# &&r:maxweeks\p13\d;
+f:/etc/default/passwd -> !r:^minweeks\p1;
+f:/etc/default/passwd -> !r:^# &&r:minweeks\p1\d;
+f:/etc/default/passwd -> !r:^warnweeks\p4;
+f:/etc/default/passwd -> !r:^# &&r:warnweeks\p4\d;
+#
+#
+#7.2 Set Strong Password Creation Policies
+[CIS - Solaris 11 Configuration - 7.2 Set Strong Password Creation Policies] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/passwd -> !r:^passlength\p8;
+f:/etc/default/passwd -> !r:^# && r:passlength\p8\d;
+f:/etc/default/passwd -> !r:^namecheck\pyes;
+f:/etc/default/passwd -> !r:^# && r:namecheck\pno;
+f:/etc/default/passwd -> !r:^history\p10;
+f:/etc/default/passwd -> !r:^# && r:history\p10\d;
+f:/etc/default/passwd -> !r:^mindiff\p3;
+f:/etc/default/passwd -> !r:^# && r:mindiff\p3\d;
+f:/etc/default/passwd -> !r:^minalpha\p2;
+f:/etc/default/passwd -> !r:^# && r:minalpha\p2\d;
+f:/etc/default/passwd -> !r:^minupper\p1;
+f:/etc/default/passwd -> !r:^# && r:minupper\p1\d;
+f:/etc/default/passwd -> !r:^minlower\p1;
+f:/etc/default/passwd -> !r:^# && r:minlower\p1\d;
+f:/etc/default/passwd -> !r:^minnonalpha\p1;
+f:/etc/default/passwd -> !r:^# && r:minnonalpha\p1\d;
+f:/etc/default/passwd -> !r:^maxrepeats\p0;
+f:/etc/default/passwd -> !r:^# && r:maxrepeats\p0\d;
+f:/etc/default/passwd -> !r:^whitespace\pyes;
+f:/etc/default/passwd -> !r:^# && r:whitespace\pno;
+f:/etc/default/passwd -> !r:^dictiondbdir\p/var/passwd;
+f:/etc/default/passwd -> !r:^dictionlist\p/usr/share/lib/dict/words;
+#
+#
+#7.3 Set Default umask for users
+[CIS - Solaris 11 Configuration - 7.3 Set Default umask for users] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/login -> !r:^umask\p027|^umask\p077;
+f:/etc/default/login -> !r:^# && r:umask\p026;
+f:/etc/default/login -> !r:^# && r:umask\p022;
+#
+#
+#7.4 Set Default File Creation Mask for FTP Users
+[CIS - Solaris 11 Configuration - 7.4 Set Default File Creation Mask for FTP Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/proftpd.conf -> !r:^umask\s*027;
+f:/etc/proftpd.conf -> !r:^# && r:umask\s*026;
+f:/etc/proftpd.conf -> !r:^# && r:umask\s*022;
+#
+#
+#7.5 Set "mesg n" as Default for All Users
+[CIS - Solaris 11 Configuration - 7.5 Set "mesg n" as Default for All Users] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/.login -> !r:^mesg\s*n;
+f:/etc/profile -> !r:^mesg\s*n;
+#
+#
+#8.1 Create Warnings for Standard Login Services
+[CIS - Solaris 11 Configuration - 8.1 Create Warnings for Standard Login Services] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/issue -> r:SunOS;
+f:/etc/issue -> r:Oracle;
+f:/etc/issue -> r:solaris;
+f:/etc/issue -> !r:Authorized users only. All activity may be monitored and reported;
+f:/etc/motd -> r:SunOS;
+f:/etc/motd -> r:Oracle;
+f:/etc/motd -> r:solaris;
+f:/etc/motd -> !r:Authorized users only. All activity may be monitored and reported;
+#
+#
+#8.2 Enable a Warning Banner for the SSH Service
+[CIS - Solaris 11 Configuration - 8.2 Enable a Warning Banner for the SSH Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/ssh/sshd_config -> !r:^Banner\s*/etc/issue;
+#
+#
+#8.3 Enable a Warning Banner for the GNOME Service
+[CIS - Solaris 11 Configuration - 8.3 Enable a Warning Banner for the GNOME Service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/gdm/Init/Default -> !r:^/usr/bin/zenity\s\.;
+#
+#
+#8.4 Enable a Warning Banner for the FTP service
+[CIS - Solaris 11 Configuration - 8.4 Enable a Warning Banner for the FTP service] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/proftpd.conf -> !r:^DisplayConnect\s+/etc/issue;
+#
+#
+#8.5 Check that the Banner Setting for telnet is Null
+[CIS - Solaris 11 Configuration - 8.5 Check that the Banner Setting for telnet is Null] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/default/telnetd -> !r:^# && r:BANNER=\.;
+f:/etc/default/telnetd -> !r:BANNER=$;
+#
+#
+#9.3 Verify System Account Default Passwords
+[CIS - Solaris 11 Configuration - 9.3 Verify System Account Default Passwords] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/shadow -> r:daemon && !r::NL:|:NP:;
+f:/etc/shadow -> r:lp && !r::NL:|:NP:;
+f:/etc/shadow -> r:adm && !r::NL:|:NP:;
+f:/etc/shadow -> r:bin && !r::NL:|:NP:;
+f:/etc/shadow -> r:gdm && !r::\p*LK\p*:;
+f:/etc/shadow -> r:noaccess && !r::\p*LK\p*:;
+f:/etc/shadow -> r:nobody && !r::\p*LK\p*:;
+f:/etc/shadow -> r:nobody4 && !r::\p*LK\p*:;
+f:/etc/shadow -> r:openldap && !r::\p*LK\p*:;
+f:/etc/shadow -> r:unknown && !r::\p*LK\p*:;
+f:/etc/shadow -> r:webservd && !r::\p*LK\p*:;
+f:/etc/shadow -> r:mysql && !r::NL:|:NP:;
+f:/etc/shadow -> r:nuuc && !r::NL:|:NP:;
+f:/etc/shadow -> r:postgres && !r::NL:|:NP:;
+f:/etc/shadow -> r:smmsp && !r::NL:|:NP:;
+f:/etc/shadow -> r:sys && !r::NL:|:NP:;
+f:/etc/shadow -> r:uucp && !r::NL:|:NP:;
+f:/etc/shadow -> r:aiuser && !r::\p*LK\p*:;
+f:/etc/shadow -> r:dhcpserv && !r::\p*LK\p*:;
+f:/etc/shadow -> r:dladm && !r::\p*LK\p*:;
+f:/etc/shadow -> r:ftp && !r::\p*LK\p*:;
+f:/etc/shadow -> r:netadm && !r::\p*LK\p*:;
+f:/etc/shadow -> r:netcfg && !r::\p*LK\p*:;
+f:/etc/shadow -> r:pkg5srv && !r::\p*LK\p*:;
+f:/etc/shadow -> r:svctag && !r::\p*LK\p*:;
+f:/etc/shadow -> r:xvm && !r::\p*LK\p*:;
+f:/etc/shadow -> r:upnp && !r::NL:|:NP:;
+f:/etc/shadow -> r:zfssnap && !r::NL:|:NP:;
+#
+#
+#9.4 Ensure Password Fields are Not Empty
+[CIS - Solaris 11 Configuration - 9.4 Ensure Password Fields are Not Empty] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/shadow -> r:\.+::\.+\w+\.*$;
+#
+#
+#9.5 Verify No UID 0 Accounts Exist Other than root
+[CIS - Solaris 11 Configuration - 9.5 Verify No UID 0 Accounts Exist Other than root] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/passwd -> !r:^root && r::\.:0:\.*;
+#
+#
+#9.6 Ensure root PATH Integrity
+[CIS - Solaris 11 Configuration - Ensure root PATH Integrity] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/profile -> r:.;
+f:/etc/environment -> r:.;
+f:/.profile -> r:.;
+f:/.bash_profile -> r:.;
+f:/.bashrc -> r:.;
+f:/etc/profile -> r:::;
+f:/etc/environment -> r:::;
+f:/.profile -> r:::;
+f:/.bash_profile -> r:::;
+f:/.bashrc -> r:::;
+f:/etc/profile -> r::$;
+f:/etc/environment -> r::$;
+f:/.profile -> r::$;
+f:/.bash_profile -> r::$;
+f:/.bashrc -> r::$;
+#
+#
+#9.10 Check for Presence of User .rhosts Files
+[CIS - Solaris 11 Configuration - 9.10 Check for Presence of User .rhosts Files] [any] [https://workbench.cisecurity.org/benchmarks/410]
+d:$home_dirs -> ^.rhosts$;
+#
+#
+#9.12 Check That Users Are Assigned Home Directories
+[CIS - Solaris 11 Configuration - 9.12 Check That Users Are Assigned Home Directories] [any] [https://workbench.cisecurity.org/benchmarks/410]
+f:/etc/passwd -> \w+:\.*:\d*:\d*:\.*:\S+:\.*;
+#
+#
+#9.20 Check for Presence of User .netrc Files
+[CIS - Solaris 11 Configuration - 9.20 Check for Presence of User .netrc Files] [any] [https://workbench.cisecurity.org/benchmarks/410]
+d:$home_dirs -> ^.netrc$;
+#
+#
+#9.21 Check for Presence of User .forward Files
+[CIS - Solaris 11 Configuration - 9.21 Check for Presence of User .forward Files] [any] [https://workbench.cisecurity.org/benchmarks/410]
+d:$home_dirs -> ^.forward$;
+#
+#
+#
projects / ossec-hids.git / blobdiff