RHEL 8.3.0 failing selected rules about secure_linux_cis HOT 4 OPEN

What kind of failures do you see? Can you provide the error messages?

from secure_linux_cis.

Hi @bjvrielink,

Thanks for asking. Apologies for the late reply.

Here are the error messages I'm gettting and the rules which I believe relate to them:

<ensure_nftables_is_not_enabled>

<ensure_no****_option_set_on_tmp_partition>

<ensure_mail_transfer_agent_is_configured_for_local_only_mode>

from secure_linux_cis.

The nftables error is most likely because the nftables package is not installed (which should be fine). Puppet cannot mask a service that simply does not exist. We should work around this and make the service resource conditional depending on the presence of the nftables package.

I guess the tmp errors are because /tmp is not specified in /etc/fstab but instead as a systemd unit. Although the CIS guidelines only mention /etc/fstab in the remediation section, I do not think enforcing the use of /etc/fstab only is the way to go. I'm not sure how easy this would be to fix.

The Postfix error is because a bug in the Postfix Puppet module, see voxpupuli/puppet-postfix#261

from secure_linux_cis.

The postfix bug should be fixed in versions >= 1.10.0 of the Postfix module.

from secure_linux_cis.