Update RHEL 8 CIS profile #14269
Update RHEL 8 CIS profile #14269
Conversation
jan-cerny
requested review from
a team,
Mab879 and
matusmarhefka
as code owners
jan-cerny
added
the
Highlight
jan-cerny
added
Update Profile
ATEX Test ResultsTest artifacts have been submitted to Testing Farm. Results: View Test Results This comment was automatically generated by the ATEX workflow. |
jan-cerny
force-pushed
the
rhel8_cis
branch
4 times, most recently
from
7857e49 to
14b394a
Compare
|
@jan-cerny: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| dir_perms_world_writable_sticky_bits | ||
| disable_host_auth | ||
| disable_users_coredumps | ||
| enable_authselect |
There was a problem hiding this comment.
Seems the workstation profiles are missing enable_authselect is that intentional?
There was a problem hiding this comment.
The authselect situation is complicated for me. Currently I'm trying to learn about authselect and understand how it should work in CIS profiles. So far I found that in RHEL 8 we had enable_authselect but in RHEL 10 we don't. Moreover, authselect is somehow related to the fails in testing farm jobs that are reported by CI. The remediation in rule accounts_password_pam_pwhistory_use_authtok seems to be wrong and conflicts with authselect. I will try to fix it. The addition of enable_authselect to server profiles is an experiment and once it will be more clear I plan to consistently either add or remove it from all 4 profiles.
openshift-ci
bot
added
the
do-not-merge/work-in-progress
Update RHEL 8 CIS control file and profiles according to the version 4.0.0 of the RHEL 8 CIS Benchmark.
The remediations shouldn't update the /etc/pam.d/system-auth and /etc/pam.d/password-auth directly, it would conflict with authselect. The remediations need to update the authselect profile instead, and then let authselect to modify the files in /etc/pam.d/.
|
This PR is blocked by #14275 and will be rebased after that one is merged. |
2 participants
Update RHEL 8 CIS control file and profiles according to the version 4.0.0 of the RHEL 8 CIS Benchmark.