Re: [RFC cip-dev][isar-cip-core][PATCH 03/14] Add cip-cis-rules to apply hardening configuration to the system
Jan Kiszka <[email protected]> Mon, 27 Jul 2026 17:31:43 +0200
| Newsgroups | org.cip-project.lists.cip-dev |
|---|---|
| Message-ID | <[email protected]> |
On 24.07.26 14:39, Quirin Gylstorff wrote: > From: Quirin Gylstorff <[email protected]> > > This package uses the configuration from `cip-cis-rules-config` > to generate a Debian package containing the selected hardening > rules. > > Co-Authored-by: Clara Kowalsky <[email protected]> > Co-Authored-by: Felix Moessbauer <[email protected]> > Co-Authored-by: Christoph Steiger <[email protected]> > Signed-off-by: Quirin Gylstorff <[email protected]> > --- > .../cip-cis-rules/cip-cis-rules_1.0.0.bb | 19 + > .../conf.d/cis-2.2.1.3-chrony-ntp-server.conf | 4 + > .../cis-5.2.10-disable-root-login.cfg | 2 + > ...2.11-disable-sshd-permitemptypasswords.cfg | 2 + > .../cis-5.2.12-disable-sshd-setenv.cfg | 2 + > .../cis-5.2.13-sshd-ciphers.cfg | 2 + > .../cis-5.2.14-ssh-cry-mac.cfg | 2 + > .../cis-5.2.15-ssh-cry-kex.cfg | 2 + > .../cis-5.2.16-sshd-idle-timeout.cfg | 2 + > .../cis-5.2.17-sshd-login-grace-time.cfg | 2 + > .../cis-5.2.18-sshd-limit-access.cfg | 2 + > .../cis-5.2.19-ssh-banner.cfg | 2 + > .../cis-5.2.20-enable-ssh-pam.cfg | 2 + > ....2.21-disable-ssh-allow-tcp-forwarding.cfg | 2 + > .../cis-5.2.22-configure-ssh-max-startups.cfg | 2 + > .../cis-5.2.23-limit-ssh-max-sessions.cfg | 2 + > .../cis-5.2.4-sshd-protocol.cfg | 2 + > .../cis-5.2.5-sshd-loglevel.cfg | 2 + > .../cis-5.2.6-disable-x11-forwarding.cfg | 2 + > .../cis-5.2.7-sshd-maxauthtries.cfg | 2 + > .../cis-5.2.8-enable-sshd-ignorerhosts.cfg | 2 + > ...9-disable-sshd-hostbasedauthentication.cfg | 2 + > .../cis-5.3.1-enable-pwquality.cfg | 2 + > .../cip-cis-rules/configuration/cis-1.1.21.sh | 6 + > .../cip-cis-rules/configuration/cis-1.5.1.sh | 8 + > .../configuration/cis-1.8.1.1.sh | 7 + > .../configuration/cis-1.8.1.2.sh | 7 + > .../configuration/cis-1.8.1.3.sh | 7 + > .../configuration/cis-1.8.1.4.sh | 8 + > .../configuration/cis-1.8.1.5.sh | 8 + > .../configuration/cis-1.8.1.6.sh | 8 + > .../configuration/cis-2.2.1.2.sh | 9 + > .../cip-cis-rules/configuration/cis-4.2.3.sh | 6 + > .../cip-cis-rules/configuration/cis-4.4.sh | 9 + > .../cip-cis-rules/configuration/cis-5.1.2.sh | 8 + > .../cip-cis-rules/configuration/cis-5.1.3.sh | 8 + > .../cip-cis-rules/configuration/cis-5.1.4.sh | 8 + > .../cip-cis-rules/configuration/cis-5.1.5.sh | 8 + > .../cip-cis-rules/configuration/cis-5.1.6.sh | 8 + > .../cip-cis-rules/configuration/cis-5.1.7.sh | 8 + > .../cip-cis-rules/configuration/cis-5.2.1.sh | 8 + > .../cip-cis-rules/configuration/cis-5.2.2.sh | 6 + > .../cip-cis-rules/configuration/cis-5.2.3.sh | 6 + > .../cip-cis-rules/configuration/cis-5.3.2.sh | 10 + > .../cip-cis-rules/configuration/cis-5.3.3.sh | 7 + > .../configuration/cis-5.4.1.1.sh | 23 ++ > .../configuration/cis-5.4.1.2.sh | 17 + > .../configuration/cis-5.4.1.3.sh | 17 + > .../cip-cis-rules/configuration/cis-5.5.sh | 19 + > .../cip-cis-rules/configuration/cis-5.6.sh | 9 + > .../debian/cip-cis-rules.postinst | 30 ++ > .../files/cip-cis-rules/debian/control | 31 ++ > .../files/cip-cis-rules/debian/rules | 20 ++ > .../debian/scripts/package-enable-configs.py | 332 ++++++++++++++++++ > .../debian/scripts/rule-packages.json | 61 ++++ > .../cis-1.1.1.1-disable-freevxfs.conf | 3 + > .../modprobe.d/cis-1.1.1.2-disable-jffs2.conf | 3 + > .../modprobe.d/cis-1.1.1.3-disable-hfs.conf | 3 + > .../cis-1.1.1.4-disable-hfsplus.conf | 3 + > .../cis-1.1.1.5-disable-squashfs.conf | 3 + > .../modprobe.d/cis-1.1.1.6-disable-udf.conf | 3 + > .../modprobe.d/cis-1.1.1.7-restrict-fat.conf | 5 + > .../cis-1.1.1.8-disable-cramfs.conf | 3 + > .../cis-1.1.23-disable-usb-storage.conf | 3 + > .../pam-configs/cis-5.3.2-faillock | 6 + > .../pam-configs/cis-5.3.2-faillock_notify | 9 + > .../pam-configs/cis-5.3.3-pwhistory | 6 + > .../pam.d/cis-5.3.4-acc-pam-sha512 | 3 + > .../cis-1.6.4-restrict-core-dumps.conf | 3 + > .../cis-5.3.1-enable-pwquality.conf | 7 + > .../cis-5.2.10-disable-root-login.conf | 3 + > ....11-disable-sshd-permitemptypasswords.conf | 3 + > .../cis-5.2.12-disable-sshd-setenv.conf | 3 + > .../cis-5.2.13-sshd-ciphers.conf | 3 + > .../sshd_config.d/cis-5.2.14-ssh-cry-mac.conf | 3 + > .../sshd_config.d/cis-5.2.15-ssh-cry-kex.conf | 3 + > .../cis-5.2.16-sshd-idle-timeout.conf | 4 + > .../cis-5.2.17-sshd-login-grace-time.conf | 3 + > .../cis-5.2.18-sshd-limit-access.conf | 10 + > .../sshd_config.d/cis-5.2.19-ssh-banner.conf | 3 + > .../cis-5.2.20-enable-ssh-pam.conf | 3 + > ...2.21-disable-ssh-allow-tcp-forwarding.conf | 3 + > ...cis-5.2.22-configure-ssh-max-startups.conf | 3 + > .../cis-5.2.23-limit-ssh-max-sessions.conf | 3 + > .../cis-5.2.4-sshd-protocol.conf | 3 + > .../cis-5.2.5-sshd-loglevel.conf | 3 + > .../cis-5.2.6-disable-x11-forwarding.conf | 3 + > .../cis-5.2.7-sshd-maxauthtries.conf | 3 + > .../cis-5.2.8-enable-sshd-ignorerhosts.conf | 3 + > ...-disable-sshd-hostbasedauthentication.conf | 3 + > .../sudoers.d/cis-1.3.2-pty-sudo | 3 + > .../sudoers.d/cis-1.3.3-logfile-sudo | 3 + > ...-1.6.2-enable-randomized-vm-placement.conf | 3 + > .../sysctl.d/cis-1.6.4-suid-dumpable.conf | 3 + > .../sysctl.d/cis-3.1.1-disable-ipv6.conf | 5 + > ...s-3.2.1-disable-send-packet-redirects.conf | 4 + > .../cis-3.2.2-disable-ip-forwarding.conf | 4 + > ...s-3.3.1-disable-source-routed-packets.conf | 6 + > .../cis-3.3.2-disable-icmp-redirect.conf | 6 + > ...is-3.3.3-disable-secure-icmp-redirect.conf | 4 + > .../cis-3.3.4-log-martian-packets.conf | 4 + > .../cis-3.3.5-ignore-broadcast-requests.conf | 3 + > ...6-enable-bad-error-message-protection.conf | 3 + > ...-3.3.7-enable-source-route-validation.conf | 4 + > .../cis-3.3.8-enable-tcp-syn-cookies.conf | 3 + > ...3.9-disable-ipv6-router-advertisement.conf | 4 + > 106 files changed, 985 insertions(+) > create mode 100644 recipes-security/cip-cis-rules/cip-cis-rules_1.0.0.bb > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/chrony/conf.d/cis-2.2.1.3-chrony-ntp-server.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.10-disable-root-login.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.11-disable-sshd-permitemptypasswords.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.12-disable-sshd-setenv.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.13-sshd-ciphers.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.14-ssh-cry-mac.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.15-ssh-cry-kex.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.16-sshd-idle-timeout.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.17-sshd-login-grace-time.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.18-sshd-limit-access.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.19-ssh-banner.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.20-enable-ssh-pam.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.21-disable-ssh-allow-tcp-forwarding.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.22-configure-ssh-max-startups.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.23-limit-ssh-max-sessions.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.4-sshd-protocol.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.5-sshd-loglevel.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.6-disable-x11-forwarding.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.7-sshd-maxauthtries.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.8-enable-sshd-ignorerhosts.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.2.9-disable-sshd-hostbasedauthentication.cfg > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/conf.d-overrides/cis-5.3.1-enable-pwquality.cfg > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.1.21.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.5.1.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.8.1.1.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.8.1.2.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.8.1.3.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.8.1.4.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.8.1.5.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-1.8.1.6.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-2.2.1.2.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-4.2.3.sh > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-4.4.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.1.2.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.1.3.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.1.4.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.1.5.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.1.6.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.1.7.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.2.1.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.2.2.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.2.3.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.3.2.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.3.3.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.4.1.1.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.4.1.2.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.4.1.3.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.5.sh > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/configuration/cis-5.6.sh > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/debian/cip-cis-rules.postinst > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/debian/control > create mode 100755 recipes-security/cip-cis-rules/files/cip-cis-rules/debian/rules > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/debian/scripts/package-enable-configs.py > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/debian/scripts/rule-packages.json > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.1-disable-freevxfs.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.2-disable-jffs2.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.3-disable-hfs.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.4-disable-hfsplus.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.5-disable-squashfs.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.6-disable-udf.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.7-restrict-fat.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.1.8-disable-cramfs.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/modprobe.d/cis-1.1.23-disable-usb-storage.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/pam-configs/cis-5.3.2-faillock > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/pam-configs/cis-5.3.2-faillock_notify > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/pam-configs/cis-5.3.3-pwhistory > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/pam.d/cis-5.3.4-acc-pam-sha512 > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/security/limits.d/cis-1.6.4-restrict-core-dumps.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/security/pwquality.conf.d/cis-5.3.1-enable-pwquality.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.10-disable-root-login.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.11-disable-sshd-permitemptypasswords.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.12-disable-sshd-setenv.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.13-sshd-ciphers.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.14-ssh-cry-mac.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.15-ssh-cry-kex.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.16-sshd-idle-timeout.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.17-sshd-login-grace-time.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.18-sshd-limit-access.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.19-ssh-banner.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.20-enable-ssh-pam.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.21-disable-ssh-allow-tcp-forwarding.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.22-configure-ssh-max-startups.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.23-limit-ssh-max-sessions.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.4-sshd-protocol.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.5-sshd-loglevel.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.6-disable-x11-forwarding.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.7-sshd-maxauthtries.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.8-enable-sshd-ignorerhosts.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sshd_config.d/cis-5.2.9-disable-sshd-hostbasedauthentication.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sudoers.d/cis-1.3.2-pty-sudo > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sudoers.d/cis-1.3.3-logfile-sudo > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-1.6.2-enable-randomized-vm-placement.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-1.6.4-suid-dumpable.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.1.1-disable-ipv6.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.2.1-disable-send-packet-redirects.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.2.2-disable-ip-forwarding.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.1-disable-source-routed-packets.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.2-disable-icmp-redirect.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.3-disable-secure-icmp-redirect.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.4-log-martian-packets.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.5-ignore-broadcast-requests.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.6-enable-bad-error-message-protection.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.7-enable-source-route-validation.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.8-enable-tcp-syn-cookies.conf > create mode 100644 recipes-security/cip-cis-rules/files/cip-cis-rules/sysctl.d/cis-3.3.9-disable-ipv6-router-advertisement.conf > I just learned offline that this huge set of file artifacts is actually not necessarily limited to isar-cip-core. That first of all raises the question if there could also be a useful separate repo for those that assemble their Debian rootfs without isar-cip-core but would still like to benefit from them. The second question is if all of those rules are direct translations from CIS, and just the filtering of what we implement is CIP-specific. Or of some may also contain deviations from upstream CIS, and that is what makes them CIP-specific. In the latter case, those should be marked / documented so that they become maintainable. Oh, and it seems that are no copyright notices on most of the files. That could make your next "Is this a proper OSS project?" validation quite stressful [1]. Please check also the rest of the series again, only released this here. Jan [1] https://lore.kernel.org/cip-dev/[email protected]/ -- Siemens AG, Foundational Technologies Linux Expert Center