Skip to content

Add postfix package requirement and audit retention controls to multiple profile controls #14612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Arden97 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add postfix package requirement and audit retention controls to multiple profile controls #14612

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
583ff1a
add auditd_data_retention_action_mail_acct for cis rhel 10
Arden97 Apr 1, 2026
3d1a3d6
add package_postfix_installed to multiple controls
Arden97 Apr 1, 2026
cae6a6e
update profile stability for cis, hipaa, pcidss
Arden97 Apr 1, 2026
f274eeb
adding SLE CCEs in package_postfix_installed
Arden97 Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions controls/hipaa.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1248,6 +1248,7 @@ controls:
- auditd_data_retention_max_log_file_action
- auditd_data_retention_max_log_file_action_stig
- auditd_data_retention_space_left_action
- package_postfix_installed
- package_rsyslog_installed
- service_rsyslog_enabled
- partition_for_var_log_audit
Expand Down
1 change: 1 addition & 0 deletions controls/pcidss_3.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@
data environment, and specifically deny all other traffic.
levels:
- base
automated: yes

Check warning on line 92 in controls/pcidss_3.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed Controls and Profiles Files 

92:24 [truthy] truthy value should be one of [false, true]
status: pending
rules: []

Expand Down Expand Up @@ -2130,6 +2130,7 @@
- auditd_data_retention_space_left
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_action_mail_acct
- package_postfix_installed

- id: Req-10.8
title: 10.8 Ensure that security policies and operational procedures for monitoring all access
Expand Down
1 change: 1 addition & 0 deletions controls/pcidss_4.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2967,6 +2967,7 @@ controls:
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_space_left
- auditd_data_retention_space_left_action
- package_postfix_installed
- package_logrotate_installed
- timer_logrotate_enabled
related_rules:
Expand Down
1 change: 1 addition & 0 deletions controls/srg_gpos/SRG-OS-000046-GPOS-00022.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
controls:
- id: SRG-OS-000046-GPOS-00022

Check failure on line 2 in controls/srg_gpos/SRG-OS-000046-GPOS-00022.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed Controls and Profiles Files 

2:8 [hyphens] too many spaces after hyphen
levels:
- medium
title: {{{ full_name }}} must alert the ISSO and SA (at a minimum) in the event

Check failure on line 5 in controls/srg_gpos/SRG-OS-000046-GPOS-00022.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed Controls and Profiles Files 

5:34 syntax error: expected <block end>, but found '<scalar>' (syntax)

Check failure on line 5 in controls/srg_gpos/SRG-OS-000046-GPOS-00022.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed Controls and Profiles Files 

5:29 [braces] too many spaces inside braces

Check failure on line 5 in controls/srg_gpos/SRG-OS-000046-GPOS-00022.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed Controls and Profiles Files 

5:19 [braces] too many spaces inside braces
of an audit processing failure.
rules:
- package_postfix_installed
- postfix_client_configure_mail_alias
- postfix_client_configure_mail_alias_postmaster
- var_postfix_root_mail_alias=mil_sysadmin
Expand Down
3 changes: 3 additions & 0 deletions linux_os/guide/services/mail/package_postfix_installed/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ severity: medium
identifiers:
cce@rhel8: CCE-85983-5
cce@rhel9: CCE-85984-3
cce@rhel10: CCE-86466-0
cce@sle12: CCE-92326-8
cce@sle15: CCE-92614-7

references:
srg: SRG-OS-000046-GPOS-00022
Expand Down
3 changes: 3 additions & 0 deletions products/rhel10/controls/cis_rhel10.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2621,8 +2621,11 @@ controls:
- l2_workstation
status: automated
rules:
- auditd_data_retention_action_mail_acct
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_space_left_action
- package_postfix_installed
- var_auditd_action_mail_acct=root
- var_auditd_admin_space_left_action=cis_rhel10
- var_auditd_space_left_action=cis_rhel10

Expand Down
1 change: 1 addition & 0 deletions products/rhel9/controls/cis_rhel9.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2560,6 +2560,7 @@ controls:
- auditd_data_retention_action_mail_acct
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_space_left_action
- package_postfix_installed
- var_auditd_action_mail_acct=root
- var_auditd_admin_space_left_action=cis_rhel9
- var_auditd_space_left_action=cis_rhel9
Expand Down
1 change: 0 additions & 1 deletion shared/references/cce-redhat-avail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
CCE-86466-0
CCE-86468-6
CCE-86482-7
CCE-86483-5
Expand Down
1 change: 0 additions & 1 deletion shared/references/cce-sle12-avail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
CCE-92326-8
CCE-92327-6
CCE-92328-4
CCE-92329-2
Expand Down
1 change: 0 additions & 1 deletion shared/references/cce-sle15-avail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
CCE-92614-7
CCE-92615-4
CCE-92616-2
CCE-92617-0
Expand Down
3 changes: 3 additions & 0 deletions tests/data/profile_stability/rhel10/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ audit_rules_usergroup_modification_shadow
audit_sudo_log_events
auditd_data_disk_error_action
auditd_data_disk_full_action
auditd_data_retention_action_mail_acct
auditd_data_retention_admin_space_left_action
auditd_data_retention_max_log_file
auditd_data_retention_max_log_file_action
Expand Down Expand Up @@ -336,6 +337,7 @@ package_net-snmp_removed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_setroubleshoot_removed
Expand Down Expand Up @@ -469,6 +471,7 @@ var_accounts_passwords_pam_faillock_unlock_time=900
var_accounts_tmout=15_min
var_accounts_user_umask=027
var_audit_backlog_limit=8192
var_auditd_action_mail_acct=root
var_auditd_admin_space_left_action=cis_rhel10
var_auditd_disk_error_action=cis_rhel10
var_auditd_disk_full_action=cis_rhel10
Expand Down
3 changes: 3 additions & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ audit_rules_usergroup_modification_shadow
audit_sudo_log_events
auditd_data_disk_error_action
auditd_data_disk_full_action
auditd_data_retention_action_mail_acct
auditd_data_retention_admin_space_left_action
auditd_data_retention_max_log_file
auditd_data_retention_max_log_file_action
Expand Down Expand Up @@ -335,6 +336,7 @@ package_net-snmp_removed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_squid_removed
Expand Down Expand Up @@ -465,6 +467,7 @@ var_accounts_passwords_pam_faillock_unlock_time=900
var_accounts_tmout=15_min
var_accounts_user_umask=027
var_audit_backlog_limit=8192
var_auditd_action_mail_acct=root
var_auditd_admin_space_left_action=cis_rhel10
var_auditd_disk_error_action=cis_rhel10
var_auditd_disk_full_action=cis_rhel10
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ no_direct_root_logins
no_empty_passwords
package_audit_installed
package_cron_installed
package_postfix_installed
package_rsyslog_installed
package_sequoia-sq_installed
package_telnet-server_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@ package_libselinux_installed
package_logrotate_installed
package_net-snmp_removed
package_nftables_installed
package_postfix_installed
package_sequoia-sq_installed
package_sudo_installed
package_telnet-server_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/stig.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,6 +380,7 @@ package_pcsc-lite-ccid_installed
package_pcsc-lite_installed
package_policycoreutils-python-utils_installed
package_policycoreutils_installed
package_postfix_installed
package_rsyslog-gnutls_installed
package_rsyslog_installed
package_s-nail_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/stig_gui.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,6 +377,7 @@ package_pcsc-lite-ccid_installed
package_pcsc-lite_installed
package_policycoreutils-python-utils_installed
package_policycoreutils_installed
package_postfix_installed
package_rsyslog-gnutls_installed
package_rsyslog_installed
package_s-nail_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ libreswan_approved_tunnels
no_direct_root_logins
no_empty_passwords
no_rsh_trust_files
package_postfix_installed
package_telnet-server_removed
package_telnet_removed
package_xinetd_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,7 @@ package_libselinux_installed
package_logrotate_installed
package_net-snmp_removed
package_nftables_installed
package_postfix_installed
package_sudo_installed
package_telnet-server_removed
package_telnet_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,7 @@ package_nftables_installed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_setroubleshoot_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,7 @@ package_nftables_installed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_squid_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ no_direct_root_logins
no_empty_passwords
no_rsh_trust_files
package_cron_installed
package_postfix_installed
package_telnet-server_removed
package_telnet_removed
require_singleuser_auth
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,7 @@ package_libselinux_installed
package_logrotate_installed
package_net-snmp_removed
package_nftables_installed
package_postfix_installed
package_sudo_installed
package_telnet-server_removed
package_telnet_removed
Expand Down
Loading