Feature: cisOS
Description
A sub-feature of cis that configures OS settings per CIS benchmark requirements. Must be used with the cis feature.
What it does
Sets pwquality options, file permissions, login options, PAM configuration, and udev rules per CIS benchmark requirements. Configures kernel command line parameters to enable process auditing at boot, sets audit backlog limits, and manages logrotate policies for btmp and wtmp. Also configures sysstat and SELinux settings.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Applies CIS OS-level configuration: file permissions, login settings, and udev rules. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
file.include/etc/kernel/cmdline.d/10-audit-proc.cfg (file.include) | Enables process auditing (audit=1) in the kernel command line per CIS benchmark. |
file.include/etc/kernel/cmdline.d/20-audit-backlog.cfg (file.include) | Sets the kernel audit backlog limit per CIS benchmark. |
file.include/etc/kernel/postinst.d/zz-kernel-cmdline (file.include) | Regenerates the kernel command line after kernel updates. |
file.include/etc/kernel/postinst.d/zz-kernel-install (file.include) | Runs kernel install hooks after kernel package updates. |
file.include/etc/kernel/postinst.d/zz-update-syslinux (file.include) | Updates the syslinux bootloader after kernel installs. |
file.include/etc/kernel/postrm.d/zz-kernel-remove (file.include) | Runs kernel removal hooks after kernel package removal. |
file.include/etc/kernel/postrm.d/zz-update-syslinux (file.include) | Updates the syslinux bootloader after kernel removal. |
file.include/etc/logrotate.d/btmp (file.include) | Logrotate configuration for /var/log/btmp (failed login attempts) per CIS benchmark. |
file.include/etc/logrotate.d/wtmp (file.include) | Logrotate configuration for /var/log/wtmp (login records) per CIS benchmark. |
file.include/etc/pam.d/common-account (file.include) | PAM account configuration enforcing CIS account management requirements. |
file.include/etc/pam.d/common-auth (file.include) | PAM authentication configuration enforcing CIS authentication requirements. |
file.include/etc/security/limits.conf (file.include) | Sets system resource limits per CIS benchmark requirements. |
file.include/etc/selinux/config (file.include) | SELinux configuration per CIS benchmark requirements. |
file.include/etc/sysstat/sysstat (file.include) | Enables sysstat data collection per CIS benchmark requirements. |
file.include/usr/lib/tmpfiles.d/var.conf (file.include) | tmpfiles.d configuration ensuring correct permissions on /var directories per CIS benchmark. |
Related features
This feature has no include or exclude relationships.