grc.store

Search / complytime/cis-fedora-l1-server-policy / dev-20260527

Release · dev-20260527

complytime/cis-fedora-l1-server-policy Policy

complytime/cis-fedora-l1-server-policy

Automated evaluation policy for the CIS Fedora Linux Level 1 Server Benchmark

Published by ComplyTime

License No license declared

Install

OCI v1.1
$grcli unpack --repository complytime/cis-fedora-l1-server-policy --version dev-20260527

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate
oci.grc.store/complytime/cis-fedora-l1-server-policy:dev-20260527
Manifest digest
sha256:6f20c5f43407176335723a802eb0059554007cc0024c897fb14b95029ed727f1
Signed by
no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading
$grcli verify --repository complytime/cis-fedora-l1-server-policy --version dev-20260527

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer
Digest Media type Size
d31058eb7321… application/vnd.gemara.artifact.v1+yaml 65.3 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "1.1.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "cis-fedora-l1-server-policy",
            "type": "Policy"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "complytime/cis-fedora-l1-server-policy",
            "tag": "dev-20260527"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/complytime-policies",
          "GITHUB_RUN_ATTEMPT": "2",
          "GITHUB_RUN_ID": "26524275168",
          "GITHUB_SHA": "35c30860a105d3c2572aade482dfdaa8a28312cc",
          "GITHUB_WORKFLOW": "Publish to grc.store",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "governance/policies/cis-fedora-l1-server-policy.yaml",
            "uri": "file://governance/policies/cis-fedora-l1-server-policy.yaml",
            "digest": {
              "sha256": "d31058eb7321c91d6d8fccf2f0b91bc62ea8bc840de04d501c620b26d4422e2c"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/complytime-policies@35c30860a105d3c2572aade482dfdaa8a28312cc",
            "digest": {
              "gitCommit": "35c30860a105d3c2572aade482dfdaa8a28312cc"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/complytime-policies/actions/runs/26524275168",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.1.2"
          }
        },
        "metadata": {
          "invocationId": "26524275168-2",
          "startedOn": "2026-05-27T16:29:44.180307428Z",
          "finishedOn": "2026-05-27T16:29:44.663253084Z"
        },
        "byproducts": [
          {
            "name": "cis-fedora-l1-server-policy.yaml",
            "digest": {
              "sha256": "d31058eb7321c91d6d8fccf2f0b91bc62ea8bc840de04d501c620b26d4422e2c"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "cis-fedora-l1-server-policy.yaml",
      "type": "Policy",
      "id": "cis-fedora-l1-server-policy",
      "role": "artifact"
    }
  ]
}

No rich preview yet

This UI can't render Policy artifacts richly yet. The raw content is shown below, and the artifact stays pullable via the coordinate above.

adherence:
  assessment-plans:
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: account_disable_post_pw_expiration
      requirement-id: account_disable_post_pw_expiration
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: account_password_pam_faillock_password_auth
      requirement-id: account_password_pam_faillock_password_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: account_password_pam_faillock_system_auth
      requirement-id: account_password_pam_faillock_system_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: account_unique_id
      requirement-id: account_unique_id
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: account_unique_name
      requirement-id: account_unique_name
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_maximum_age_login_defs
      requirement-id: accounts_maximum_age_login_defs
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_no_uid_except_zero
      requirement-id: accounts_no_uid_except_zero
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_all_shadowed
      requirement-id: accounts_password_all_shadowed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_last_change_is_in_past
      requirement-id: accounts_password_last_change_is_in_past
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_dictcheck
      requirement-id: accounts_password_pam_dictcheck
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_difok
      requirement-id: accounts_password_pam_difok
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_enforce_root
      requirement-id: accounts_password_pam_enforce_root
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_maxrepeat
      requirement-id: accounts_password_pam_maxrepeat
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_minclass
      requirement-id: accounts_password_pam_minclass
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_minlen
      requirement-id: accounts_password_pam_minlen
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_pwhistory_remember_password_auth
      requirement-id: accounts_password_pam_pwhistory_remember_password_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_pwhistory_remember_system_auth
      requirement-id: accounts_password_pam_pwhistory_remember_system_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_pwquality_password_auth
      requirement-id: accounts_password_pam_pwquality_password_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_pam_pwquality_system_auth
      requirement-id: accounts_password_pam_pwquality_system_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_set_max_life_existing
      requirement-id: accounts_password_set_max_life_existing
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_set_warn_age_existing
      requirement-id: accounts_password_set_warn_age_existing
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_password_warn_age_login_defs
      requirement-id: accounts_password_warn_age_login_defs
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_passwords_pam_faillock_deny
      requirement-id: accounts_passwords_pam_faillock_deny
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_passwords_pam_faillock_unlock_time
      requirement-id: accounts_passwords_pam_faillock_unlock_time
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_root_gid_zero
      requirement-id: accounts_root_gid_zero
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_root_path_dirs_no_write
      requirement-id: accounts_root_path_dirs_no_write
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_set_post_pw_existing
      requirement-id: accounts_set_post_pw_existing
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_tmout
      requirement-id: accounts_tmout
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_umask_etc_bashrc
      requirement-id: accounts_umask_etc_bashrc
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_umask_etc_login_defs
      requirement-id: accounts_umask_etc_login_defs
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_umask_etc_profile
      requirement-id: accounts_umask_etc_profile
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_user_dot_group_ownership
      requirement-id: accounts_user_dot_group_ownership
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_user_dot_user_ownership
      requirement-id: accounts_user_dot_user_ownership
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: accounts_user_interactive_home_directory_exists
      requirement-id: accounts_user_interactive_home_directory_exists
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: aide_build_database
      requirement-id: aide_build_database
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: aide_check_audit_tools
      requirement-id: aide_check_audit_tools
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: aide_periodic_cron_checking
      requirement-id: aide_periodic_cron_checking
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: banner_etc_issue_cis
      requirement-id: banner_etc_issue_cis
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: banner_etc_issue_net_cis
      requirement-id: banner_etc_issue_net_cis
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: banner_etc_motd_cis
      requirement-id: banner_etc_motd_cis
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: chronyd_run_as_chrony_user
      requirement-id: chronyd_run_as_chrony_user
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: chronyd_specify_remote_server
      requirement-id: chronyd_specify_remote_server
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: coredump_disable_backtraces
      requirement-id: coredump_disable_backtraces
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: coredump_disable_storage
      requirement-id: coredump_disable_storage
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_db_up_to_date
      requirement-id: dconf_db_up_to_date
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_banner_enabled
      requirement-id: dconf_gnome_banner_enabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_disable_automount
      requirement-id: dconf_gnome_disable_automount
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_disable_automount_open
      requirement-id: dconf_gnome_disable_automount_open
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_disable_autorun
      requirement-id: dconf_gnome_disable_autorun
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_disable_user_list
      requirement-id: dconf_gnome_disable_user_list
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_login_banner_text
      requirement-id: dconf_gnome_login_banner_text
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_screensaver_idle_delay
      requirement-id: dconf_gnome_screensaver_idle_delay
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_screensaver_lock_delay
      requirement-id: dconf_gnome_screensaver_lock_delay
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_screensaver_user_locks
      requirement-id: dconf_gnome_screensaver_user_locks
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dconf_gnome_session_idle_user_locks
      requirement-id: dconf_gnome_session_idle_user_locks
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: dir_perms_world_writable_sticky_bits
      requirement-id: dir_perms_world_writable_sticky_bits
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: disable_host_auth
      requirement-id: disable_host_auth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: disable_users_coredumps
      requirement-id: disable_users_coredumps
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: ensure_gpgcheck_globally_activated
      requirement-id: ensure_gpgcheck_globally_activated
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: ensure_pam_wheel_group_empty
      requirement-id: ensure_pam_wheel_group_empty
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: ensure_root_password_configured
      requirement-id: ensure_root_password_configured
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_at_deny_not_exist
      requirement-id: file_at_deny_not_exist
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_cron_allow_exists
      requirement-id: file_cron_allow_exists
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_cron_deny_not_exist
      requirement-id: file_cron_deny_not_exist
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_at_allow
      requirement-id: file_groupowner_at_allow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_backup_etc_group
      requirement-id: file_groupowner_backup_etc_group
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_backup_etc_gshadow
      requirement-id: file_groupowner_backup_etc_gshadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_backup_etc_passwd
      requirement-id: file_groupowner_backup_etc_passwd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_backup_etc_shadow
      requirement-id: file_groupowner_backup_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_cron_allow
      requirement-id: file_groupowner_cron_allow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_cron_d
      requirement-id: file_groupowner_cron_d
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_cron_daily
      requirement-id: file_groupowner_cron_daily
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_cron_hourly
      requirement-id: file_groupowner_cron_hourly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_cron_monthly
      requirement-id: file_groupowner_cron_monthly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_cron_weekly
      requirement-id: file_groupowner_cron_weekly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_crontab
      requirement-id: file_groupowner_crontab
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_group
      requirement-id: file_groupowner_etc_group
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_gshadow
      requirement-id: file_groupowner_etc_gshadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_issue
      requirement-id: file_groupowner_etc_issue
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_issue_net
      requirement-id: file_groupowner_etc_issue_net
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_motd
      requirement-id: file_groupowner_etc_motd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_passwd
      requirement-id: file_groupowner_etc_passwd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_shadow
      requirement-id: file_groupowner_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_etc_shells
      requirement-id: file_groupowner_etc_shells
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupowner_sshd_config
      requirement-id: file_groupowner_sshd_config
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupownership_sshd_private_key
      requirement-id: file_groupownership_sshd_private_key
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_groupownership_sshd_pub_key
      requirement-id: file_groupownership_sshd_pub_key
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_at_allow
      requirement-id: file_owner_at_allow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_backup_etc_group
      requirement-id: file_owner_backup_etc_group
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_backup_etc_gshadow
      requirement-id: file_owner_backup_etc_gshadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_backup_etc_passwd
      requirement-id: file_owner_backup_etc_passwd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_backup_etc_shadow
      requirement-id: file_owner_backup_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_cron_allow
      requirement-id: file_owner_cron_allow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_cron_d
      requirement-id: file_owner_cron_d
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_cron_daily
      requirement-id: file_owner_cron_daily
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_cron_hourly
      requirement-id: file_owner_cron_hourly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_cron_monthly
      requirement-id: file_owner_cron_monthly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_cron_weekly
      requirement-id: file_owner_cron_weekly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_crontab
      requirement-id: file_owner_crontab
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_group
      requirement-id: file_owner_etc_group
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_gshadow
      requirement-id: file_owner_etc_gshadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_issue
      requirement-id: file_owner_etc_issue
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_issue_net
      requirement-id: file_owner_etc_issue_net
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_motd
      requirement-id: file_owner_etc_motd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_passwd
      requirement-id: file_owner_etc_passwd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_shadow
      requirement-id: file_owner_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_etc_shells
      requirement-id: file_owner_etc_shells
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_owner_sshd_config
      requirement-id: file_owner_sshd_config
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_ownership_home_directories
      requirement-id: file_ownership_home_directories
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_ownership_sshd_private_key
      requirement-id: file_ownership_sshd_private_key
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_ownership_sshd_pub_key
      requirement-id: file_ownership_sshd_pub_key
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permission_user_init_files
      requirement-id: file_permission_user_init_files
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_at_allow
      requirement-id: file_permissions_at_allow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_backup_etc_group
      requirement-id: file_permissions_backup_etc_group
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_backup_etc_gshadow
      requirement-id: file_permissions_backup_etc_gshadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_backup_etc_passwd
      requirement-id: file_permissions_backup_etc_passwd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_backup_etc_shadow
      requirement-id: file_permissions_backup_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_cron_allow
      requirement-id: file_permissions_cron_allow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_cron_d
      requirement-id: file_permissions_cron_d
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_cron_daily
      requirement-id: file_permissions_cron_daily
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_cron_hourly
      requirement-id: file_permissions_cron_hourly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_cron_monthly
      requirement-id: file_permissions_cron_monthly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_cron_weekly
      requirement-id: file_permissions_cron_weekly
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_crontab
      requirement-id: file_permissions_crontab
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_group
      requirement-id: file_permissions_etc_group
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_gshadow
      requirement-id: file_permissions_etc_gshadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_issue
      requirement-id: file_permissions_etc_issue
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_issue_net
      requirement-id: file_permissions_etc_issue_net
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_motd
      requirement-id: file_permissions_etc_motd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_passwd
      requirement-id: file_permissions_etc_passwd
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_shadow
      requirement-id: file_permissions_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_etc_shells
      requirement-id: file_permissions_etc_shells
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_home_directories
      requirement-id: file_permissions_home_directories
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_sshd_config
      requirement-id: file_permissions_sshd_config
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_sshd_private_key
      requirement-id: file_permissions_sshd_private_key
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_sshd_pub_key
      requirement-id: file_permissions_sshd_pub_key
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: file_permissions_unauthorized_world_writable
      requirement-id: file_permissions_unauthorized_world_writable
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: firewalld_loopback_traffic_restricted
      requirement-id: firewalld_loopback_traffic_restricted
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: firewalld_loopback_traffic_trusted
      requirement-id: firewalld_loopback_traffic_trusted
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: gid_passwd_group_same
      requirement-id: gid_passwd_group_same
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: group_unique_id
      requirement-id: group_unique_id
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: group_unique_name
      requirement-id: group_unique_name
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: grub2_enable_selinux
      requirement-id: grub2_enable_selinux
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: grub2_password
      requirement-id: grub2_password
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: has_nonlocal_mta
      requirement-id: has_nonlocal_mta
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: journald_compress
      requirement-id: journald_compress
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: journald_storage
      requirement-id: journald_storage
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_atm_disabled
      requirement-id: kernel_module_atm_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_can_disabled
      requirement-id: kernel_module_can_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_cramfs_disabled
      requirement-id: kernel_module_cramfs_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_dccp_disabled
      requirement-id: kernel_module_dccp_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_firewire-core_disabled
      requirement-id: kernel_module_firewire-core_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_freevxfs_disabled
      requirement-id: kernel_module_freevxfs_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_hfs_disabled
      requirement-id: kernel_module_hfs_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_hfsplus_disabled
      requirement-id: kernel_module_hfsplus_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_jffs2_disabled
      requirement-id: kernel_module_jffs2_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_rds_disabled
      requirement-id: kernel_module_rds_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_tipc_disabled
      requirement-id: kernel_module_tipc_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: kernel_module_usb-storage_disabled
      requirement-id: kernel_module_usb-storage_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_dev_shm_nodev
      requirement-id: mount_option_dev_shm_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_dev_shm_noexec
      requirement-id: mount_option_dev_shm_noexec
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_dev_shm_nosuid
      requirement-id: mount_option_dev_shm_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_home_nodev
      requirement-id: mount_option_home_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_home_nosuid
      requirement-id: mount_option_home_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_tmp_nodev
      requirement-id: mount_option_tmp_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_tmp_noexec
      requirement-id: mount_option_tmp_noexec
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_tmp_nosuid
      requirement-id: mount_option_tmp_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_log_audit_nodev
      requirement-id: mount_option_var_log_audit_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_log_audit_noexec
      requirement-id: mount_option_var_log_audit_noexec
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_log_audit_nosuid
      requirement-id: mount_option_var_log_audit_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_log_nodev
      requirement-id: mount_option_var_log_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_log_noexec
      requirement-id: mount_option_var_log_noexec
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_log_nosuid
      requirement-id: mount_option_var_log_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_nodev
      requirement-id: mount_option_var_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_nosuid
      requirement-id: mount_option_var_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_tmp_nodev
      requirement-id: mount_option_var_tmp_nodev
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_tmp_noexec
      requirement-id: mount_option_var_tmp_noexec
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: mount_option_var_tmp_nosuid
      requirement-id: mount_option_var_tmp_nosuid
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: no_empty_passwords
      requirement-id: no_empty_passwords
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: no_empty_passwords_etc_shadow
      requirement-id: no_empty_passwords_etc_shadow
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: no_forward_files
      requirement-id: no_forward_files
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: no_netrc_files
      requirement-id: no_netrc_files
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: no_password_auth_for_systemaccounts
      requirement-id: no_password_auth_for_systemaccounts
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: no_shelllogin_for_systemaccounts
      requirement-id: no_shelllogin_for_systemaccounts
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_aide_installed
      requirement-id: package_aide_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_bind_removed
      requirement-id: package_bind_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_cron_installed
      requirement-id: package_cron_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_cyrus-imapd_removed
      requirement-id: package_cyrus-imapd_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_dnsmasq_removed
      requirement-id: package_dnsmasq_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_dovecot_removed
      requirement-id: package_dovecot_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_firewalld_installed
      requirement-id: package_firewalld_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_ftp_removed
      requirement-id: package_ftp_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_httpd_removed
      requirement-id: package_httpd_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_kea_removed
      requirement-id: package_kea_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_libselinux_installed
      requirement-id: package_libselinux_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_mcstrans_removed
      requirement-id: package_mcstrans_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_net-snmp_removed
      requirement-id: package_net-snmp_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_nftables_installed
      requirement-id: package_nftables_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_nginx_removed
      requirement-id: package_nginx_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_pam_pwquality_installed
      requirement-id: package_pam_pwquality_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_rsync_removed
      requirement-id: package_rsync_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_samba_removed
      requirement-id: package_samba_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_setroubleshoot_removed
      requirement-id: package_setroubleshoot_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_squid_removed
      requirement-id: package_squid_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_sudo_installed
      requirement-id: package_sudo_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_systemd-journal-remote_installed
      requirement-id: package_systemd-journal-remote_installed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_telnet-server_removed
      requirement-id: package_telnet-server_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_telnet_removed
      requirement-id: package_telnet_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_tftp-server_removed
      requirement-id: package_tftp-server_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_tftp_removed
      requirement-id: package_tftp_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: package_vsftpd_removed
      requirement-id: package_vsftpd_removed
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: partition_for_dev_shm
      requirement-id: partition_for_dev_shm
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: partition_for_tmp
      requirement-id: partition_for_tmp
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: postfix_network_listening_disabled
      requirement-id: postfix_network_listening_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: root_path_no_dot
      requirement-id: root_path_no_dot
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: rsyslog_files_groupownership
      requirement-id: rsyslog_files_groupownership
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: rsyslog_files_ownership
      requirement-id: rsyslog_files_ownership
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: rsyslog_files_permissions
      requirement-id: rsyslog_files_permissions
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: selinux_not_disabled
      requirement-id: selinux_not_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: selinux_policytype
      requirement-id: selinux_policytype
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_autofs_disabled
      requirement-id: service_autofs_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_avahi-daemon_disabled
      requirement-id: service_avahi-daemon_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_bluetooth_disabled
      requirement-id: service_bluetooth_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_crond_enabled
      requirement-id: service_crond_enabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_cups_disabled
      requirement-id: service_cups_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_firewalld_enabled
      requirement-id: service_firewalld_enabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_nfs_disabled
      requirement-id: service_nfs_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_nftables_disabled
      requirement-id: service_nftables_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_rpcbind_disabled
      requirement-id: service_rpcbind_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: service_systemd-journald_enabled
      requirement-id: service_systemd-journald_enabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: set_password_hashing_algorithm_logindefs
      requirement-id: set_password_hashing_algorithm_logindefs
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: set_password_hashing_algorithm_passwordauth
      requirement-id: set_password_hashing_algorithm_passwordauth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: set_password_hashing_algorithm_systemauth
      requirement-id: set_password_hashing_algorithm_systemauth
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: socket_systemd-journal-remote_disabled
      requirement-id: socket_systemd-journal-remote_disabled
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_disable_empty_passwords
      requirement-id: sshd_disable_empty_passwords
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_disable_rhosts
      requirement-id: sshd_disable_rhosts
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_disable_root_login
      requirement-id: sshd_disable_root_login
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_do_not_permit_user_env
      requirement-id: sshd_do_not_permit_user_env
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_enable_pam
      requirement-id: sshd_enable_pam
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_enable_warning_banner_net
      requirement-id: sshd_enable_warning_banner_net
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_limit_user_access
      requirement-id: sshd_limit_user_access
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_idle_timeout
      requirement-id: sshd_set_idle_timeout
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_keepalive
      requirement-id: sshd_set_keepalive
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_login_grace_time
      requirement-id: sshd_set_login_grace_time
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_loglevel_verbose
      requirement-id: sshd_set_loglevel_verbose
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_max_auth_tries
      requirement-id: sshd_set_max_auth_tries
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_max_sessions
      requirement-id: sshd_set_max_sessions
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sshd_set_maxstartups
      requirement-id: sshd_set_maxstartups
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sudo_add_use_pty
      requirement-id: sudo_add_use_pty
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sudo_custom_logfile
      requirement-id: sudo_custom_logfile
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sudo_remove_no_authenticate
      requirement-id: sudo_remove_no_authenticate
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sudo_require_reauthentication
      requirement-id: sudo_require_reauthentication
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_fs_protected_hardlinks
      requirement-id: sysctl_fs_protected_hardlinks
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_fs_protected_symlinks
      requirement-id: sysctl_fs_protected_symlinks
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_fs_suid_dumpable
      requirement-id: sysctl_fs_suid_dumpable
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_kernel_dmesg_restrict
      requirement-id: sysctl_kernel_dmesg_restrict
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_kernel_kptr_restrict
      requirement-id: sysctl_kernel_kptr_restrict
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_kernel_randomize_va_space
      requirement-id: sysctl_kernel_randomize_va_space
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_kernel_yama_ptrace_scope
      requirement-id: sysctl_kernel_yama_ptrace_scope
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_all_accept_redirects
      requirement-id: sysctl_net_ipv4_conf_all_accept_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_all_accept_source_route
      requirement-id: sysctl_net_ipv4_conf_all_accept_source_route
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_all_log_martians
      requirement-id: sysctl_net_ipv4_conf_all_log_martians
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_all_rp_filter
      requirement-id: sysctl_net_ipv4_conf_all_rp_filter
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_all_secure_redirects
      requirement-id: sysctl_net_ipv4_conf_all_secure_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_all_send_redirects
      requirement-id: sysctl_net_ipv4_conf_all_send_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_default_accept_redirects
      requirement-id: sysctl_net_ipv4_conf_default_accept_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_default_accept_source_route
      requirement-id: sysctl_net_ipv4_conf_default_accept_source_route
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_default_log_martians
      requirement-id: sysctl_net_ipv4_conf_default_log_martians
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_default_rp_filter
      requirement-id: sysctl_net_ipv4_conf_default_rp_filter
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_default_secure_redirects
      requirement-id: sysctl_net_ipv4_conf_default_secure_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_conf_default_send_redirects
      requirement-id: sysctl_net_ipv4_conf_default_send_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_icmp_echo_ignore_broadcasts
      requirement-id: sysctl_net_ipv4_icmp_echo_ignore_broadcasts
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_icmp_ignore_bogus_error_responses
      requirement-id: sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv4_tcp_syncookies
      requirement-id: sysctl_net_ipv4_tcp_syncookies
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_all_accept_ra
      requirement-id: sysctl_net_ipv6_conf_all_accept_ra
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_all_accept_redirects
      requirement-id: sysctl_net_ipv6_conf_all_accept_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_all_accept_source_route
      requirement-id: sysctl_net_ipv6_conf_all_accept_source_route
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_all_forwarding
      requirement-id: sysctl_net_ipv6_conf_all_forwarding
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_default_accept_ra
      requirement-id: sysctl_net_ipv6_conf_default_accept_ra
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_default_accept_redirects
      requirement-id: sysctl_net_ipv6_conf_default_accept_redirects
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: sysctl_net_ipv6_conf_default_accept_source_route
      requirement-id: sysctl_net_ipv6_conf_default_accept_source_route
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: use_pam_wheel_group_for_su
      requirement-id: use_pam_wheel_group_for_su
    - evaluation-methods:
        - id: openscap-behavioral
          mode: Automated
          type: Behavioral
      frequency: on-demand
      id: wireless_disable_interfaces
      requirement-id: wireless_disable_interfaces
  enforcement-methods:
    - description: OpenSCAP automated compliance enforcement gate
      executor:
        id: openscap
        name: OpenSCAP
        type: Software
      id: openscap-gate
      mode: Automated
      type: Gate
  evaluation-methods:
    - description: OpenSCAP automated compliance check
      executor:
        id: openscap
        name: OpenSCAP
        type: Software
      id: openscap-behavioral
      mode: Automated
      type: Behavioral
contacts:
  accountable:
    - name: Security Team
  responsible:
    - name: System Administrator
imports:
  catalogs:
    - reference-id: cis-fedora-l1-server
  guidance:
    - reference-id: cis-fedora-l1-guidance
metadata:
  author:
    id: complytime
    name: ComplyTime
    type: Software
  description: Automated evaluation policy for the CIS Fedora Linux Level 1 Server Benchmark
  gemara-version: 1.1.0
  id: cis-fedora-l1-server-policy
  mapping-references:
    - description: Control catalog for CIS Fedora Linux Level 1 Server Benchmark
      id: cis-fedora-l1-server
      title: CIS Fedora Linux - Level 1 Server
      url: https://github.com/complytime/complytime-policies/blob/main/governance/catalogs/cis-fedora-l1-server-catalog.yaml
      version: 1.0.0
    - description: Guidance catalog for CIS Fedora Linux Level 1 Benchmark
      id: cis-fedora-l1-guidance
      title: CIS Fedora Linux - Level 1 Guidance
      url: https://github.com/complytime/complytime-policies/blob/main/governance/guidance/cis-fedora-l1-guidance.yaml
      version: 1.0.0
  type: Policy
  version: dev-20260527
scope:
  in:
    technologies:
      - Fedora Linux
    users:
      - Server administrators
title: CIS Fedora Linux - Level 1 Server Policy