Release notes

v1.6.1

Released 16 May 2023

• Fixed an issue that occasionally caused compliance scan failures for users who applied Center for Internet Security (CIS) controls in a Red Hat Enterprise Linux (RHEL) 7 environment. The issue occurred because CIS Control 4.1.15 ‘Ensure system administrator command executions sudo are collected’ did not apply auditd configuration entries. The issue is fixed to ensure that scans run as expected.
• Fixed an issue that prevented CIS Control 4.1.3.7 ‘Ensure unsuccessful file access attempts are collected’ from being enforced. The issue affected users on RHEL 8, AlmaLinux 8, and Oracle Linux 8 systems. The control is now enforced to ensure that information is collected about unsuccessful attempts to access files. These unsuccessful attempts can indicate that an unauthorized user or process is trying to gain access to the system.
• Fixed an error that could cause system operations to halt unexpectedly for users on RHEL 7. The issue was caused by an incorrect default setting for CIS Control 4.1.2.3 ‘Ensure system is disabled when audit logs are full.’ The incorrect default setting could cause system operations to halt when disk space for audit logs runs low. The control is now correctly enforced as recommended by CIS: when disk space runs low, an email is sent to the address specified by the 'action_mail_acct' parameter.
• Implemented a fix to help ensure that the use of privileged programs is monitored on all partitions on RHEL 7 operating systems. Previously, CIS Control 4.1.3.10 ‘Ensure use of privileged commands is collected’ was not fully enforced. The control was only partially enforced because the find command did not descend into all partitions. The fix helps to ensure that all partitions are monitored so that unauthorized use of privileged programs is detected.
• Fixed an issue that occasionally caused the 10-cem_priv_commands.rules file to be blank. This issue affected users on RHEL operating systems. The issue is fixed to ensure that CEM operates as expected when the user specifies a value of true for the audit_privileged_commands option:
  • If privileged commands exist, the 10-cem_priv_commands.rules file displays the audit rule for that control.
  • If privileged commands do not exist or the privileged commands are ignored, a 10-cem_priv_commands.rules file is not created.
• Fixed an issue that caused a failure to remove the Automatic Bug Reporting Tool (ABRT). In CEM for Linux v1.6.0, when the remove_automatic_bug_report_tools class was specified to remove ABRT, the tool remained installed. The problem is resolved to ensure that ABRT packages can be removed based on the class specification without further user intervention.

v1.6.0

Released 28 March 2023

• Enforcement of Center for Internet Security (CIS) Benchmarks on three new operating systems:
  • CIS Benchmark for AlmaLinux 8, v2.0.0, levels 1 and 2
  • CIS Benchmark for Oracle Linux 7, v3.1.1, levels 1 and 2
  • CIS Benchmark for Oracle Linux 8, v2.0.0, levels 1 and 2
• For users who enforce the US Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) standard on Red Hat Enterprise Linux (RHEL) operating systems, CEM now supports several controls that are designed to secure graphical user interfaces (GUIs). The following new GUI controls are enforced:
  • Control V-204397 - The Red Hat Enterprise Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.
  • Control V-204398 - The Red Hat Enterprise Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.
  • Control V-204399 - The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.
  • Control V-204400 - The Red Hat Enterprise Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface.
  • Control V-204402 - The Red Hat Enterprise Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.
  • Control V-204403 - The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.
  • Control V-204404 - The Red Hat Enterprise Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.
  • Control V-204432 - The Red Hat Enterprise Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.
  • Control V-204433 - The Red Hat Enterprise Linux operating system must not allow an unrestricted logon to the system.
  • Control V-204456 - The Red Hat Enterprise Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled in the Graphical User Interface.
  • Control V-214937 - The Red Hat Enterprise Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
  • Control V-219059 - The Red Hat Enterprise Linux operating system must disable the graphical user interface automounter unless required.
  • Control V-251718 - The graphical display manager must not be the default target on RHEL 8 unless approved.
  • Control V-230530 - The x86 Ctrl-Alt-Delete key sequence in RHEL 8 must be disabled if a graphical user interface is installed.
  • Control V-230553 - The graphical display manager must not be installed on RHEL 8 unless approved.
  • Control V-244519 - RHEL 8 must display a banner before granting local or remote access to the system via a graphical user logon.
  • Control V-244535 - RHEL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated.
  • Control V-244536 - RHEL 8 must disable the user list at logon for graphical user interfaces.
  • Control V-244538 - RHEL 8 must prevent a user from overriding the session idle-delay setting for the graphical user interface.
  • Control V-244539 - RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
  • Control V-230347 - RHEL 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions.
  • Control V-230351 - RHEL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed.
  • Control V-230352 - RHEL 8 must automatically lock graphical user sessions after 15 minutes of inactivity.
  • Control V-230354 - RHEL 8 must prevent a user from overriding the session lock-delay setting for the graphical user interface.
  • Control V-230329 - Unattended or automatic logon via the RHEL 8 graphical user interface must not be allowed.
  • Control V-230226 - RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
  • Control V-204393 - The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
  • Control V-204394 - The Red Hat Enterprise Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
  • Control V-204396 - The Red Hat Enterprise Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.
• The ability to enable controls that are designed to secure a GNOME desktop environment. Users who enforce the DISA STIG standard on a RHEL 7 or 8 operating system can set the top-level manage_gnome option to true to enforce all relevant controls in a GNOME desktop environment. Users who enforce CIS controls in RHEL 7 or 8 or CentOS environments must also specify manage_gnome=true to enable controls for GNOME. For CIS users, the following GNOME controls are added:
  • 1.8.1 - Ensure GNOME Display Manager is removed
  • 1.8.2 - Ensure GDM login banner is configured
  • 1.8.3 - Ensure last logged in user display is disabled
  • 1.8.4 - Ensure XDCMP is not enabled
  • 1.8.5 - Ensure automatic mounting of removable media is disabled

• The implementation for DISA STIG Control V-204600 was changed to ensure that the StrictModes=yes setting is explicitly applied to the Secure Shell (SSH) configuration. This setting helps to protect SSH keys. If file system permissions for SSH keys are too lax, SSH authentication fails. The change affects users who enforce DISA STIG in a RHEL 7 environment.

• An issue that caused invalid permissions to be assigned to the audit directory. This issue affected users who enforced the DISA STIG standard on RHEL operating systems. The issue was related to STIG Control V-230471, which helps to ensure that only users with sufficient permissions can specify which events will be audited. The correct permissions are now set on the audit directory.
• An issue that prevented proper enforcement of STIG Controls V-204614 and V-204615, which are designed to prevent man-in-the-middle attacks. The controls are enforced on RHEL systems to specify whether redirect messages sent with the Internet Control Message Protocol (ICMP) using Internet Control version 4 (IPv4) can be accepted. This issue is corrected to ensure that the ICMP redirect messages are disabled by default for both IPv4 and IPv6.
• A CEM configuration issue for users who enforce the DISA STIG standard in a RHEL 8 environment. In CEM for Linux v1.5.0, the base class cem_linux::utils::packages::linux::sudo was not included for STIG use in the data/RedHat/RedHat/8.yaml file. The omission resulted in additional configuration steps for some users. The YAML file is now updated to include the missing sudo class.
• A scan issue for users who enforce the DISA STIG standard on RHEL operating systems. Previously, Controls V-204427 (5.4.12) and V-204428 (5.4.13) were reported as failing in Puppet Comply. Failures were reported even when CEM appeared to correctly enforce the controls. These controls help to protect systems against unauthorized access by limiting the number of failed login attempts. Scans for the controls now report accurate results.

v1.5.2

Released 9 March 2023

• An issue that prevented the CEM for Linux v1.5.1 reference topics from being displayed on Puppet Forge. With the v1.5.2 release, the Reference tab is restored. The topics on the Reference tab for v1.5.2 are applicable to both the v1.5.2 and v1.5.1 releases.

v1.5.1

Released 7 March 2023

• A change was introduced to simplify configuration in Red Hat Enterprise Linux (RHEL) 8 environments where the US Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) standard is enforced. The update applies to DISA STIG control V-230339, which is designed to limit login attempts and thus help to prevent brute-force attacks. The default directory where login failure records are kept can now be changed.

• An issue that prevented the OpenSSH server process from starting on RHEL 8 systems. The issue affected users who enforced the DISA STIG standard. When a value of FUTURE was set for cryptographic policies to help prevent malware attacks, the OpenSSH process failed with the following error message:

  Extra argument FUTURE.

• An issue that prevented users from running the system account task from the Puppet Enterprise (PE) console. Previously, attempts to run the task resulted in error messages about missing metadata. With the fix applied, users can run the cem_linux::system_account task from the PE console to view system accounts.
• An issue that caused an error message pertaining to the audit.rules file. The issue was seen on RHEL operating systems after an upgrade to CEM for Linux v1.5.0. The following error message was issued:

  Could not stat /etc/audit/rules.d/audit.rules

  To resolve the issue, the CEM for Linux module was updated to reference all existing files in /etc/audit/rules.d/ directory.

• An issue that caused a failure to audit sudo log files. When events pertaining to a sudo log file are collected, system administrators can review the events to detect whether unauthorized commands were run. The issue, which affected users on RHEL 8 systems, was caused by a failure to enforce Center for Internet Security (CIS) Control 4.1.3.3. The control is now enforced.
• A failure to enable GNU Privacy Guard (GPG) checks for downloaded packages on RHEL 8 operating systems. CIS Benchmark Control 1.2.3 ("Ensure gpgcheck is globally activated") is designed to ensure that downloaded packages from the RPM package management tool are checked. However, these checks failed to occur because the repo_files parameter associated with the CIS control does not specify the YUM files that are used to manage RHEL packages. The fix ensures that GPG checks will be enabled on a per-repository basis for each file that is listed in the repo_files parameter.
• An issue that can cause configuration problems in RHEL 8 environments where DISA STIG standards are enforced. Because of the issue, the following top-level parameters for the Grub2 bootloader could not be set: cem_linux::regenerate_grub2_config, cem_linux::set_grub2_password, cem_linux::grub2_superuser, and cem_linux::grub2_superuser_password. The issue was resolved to ensure that the parameters can be set, and the values are applied.
• A configuration issue that affects the security of messages when DISA STIG standards are applied in a RHEL 8 environment. The issue pertains to STIG control V-230245, which is designed to ensure that unauthorized persons cannot access system messages. Security is enforced by setting a permissions mode for access to the /var/log/messages file. The issue occurred because the resource data for STIG control V-230245 specified a value of directory instead of file. The issue was fixed to ensure that permissions are set for the messages file. The fix also ensures that a /var/log/messages directory is not created inadvertently.
• An issue that can cause configuration problems for users who attempt to enforce the DISA STIG standard in a RHEL 8 environment. The issue was caused by extraneous text in the cem_linux/manifests/utils/bootloader/grub2/fips.pp file. The extraneous text, a Universal Unique Identifier of 6484, is now removed.

v1.5.0

Released 14 February 2023

• Enforcement of the DISA STIG standard on Red Hat Enterprise Linux (RHEL) 8 operating systems:
  • The Security Technical Implementation Guide (STIG) standard was developed by the US Defense Information Systems Agency (DISA). DISA STIG compliance is required for some infrastructures managed by the US government. On RHEL 8, the following DISA STIG standard is supported: Red Hat Enterprise Linux 8 STIG, Version 1, Release 8.
  • For the RHEL 8 operating system, STIG can be enabled by adding the following Hiera data to the control repository:

    cem_linux::benchmark: 'stig'

  • STIG supports Mission Assurance Category (MAC) levels 1, 2, and 3 and their associated “public,” “sensitive,” and “classified” profiles. STIG controls can be configured with their vulnerability ID (V-nnn) or rule ID (SV-nnn).
  • For a list of supported STIG controls and configurations, see the CEM Linux Reference.
• New top-level configuration option, disable_package_gpgcheck. By enabling this option, you disable GNU Privacy Guard (GPG) checks of downloaded packages. Disabling GPG checks can be helpful in rare cases if you enable more stringent system encryption standards, such as the Federal Information Processing Standards (FIPS). These standards can introduce stricter criteria than are normally available for GPG package signatures. If GPG and more stringent criteria are applied simultaneously, package downloads can fail. Specify the disable_package_gpgcheck=true setting only when necessary. Enabling this option can make your infrastructure less secure.

• An error that occasionally prevented system startups and that caused failures of the Internet Control Message Protocol (ICMP) was resolved. The error was identified in the Puppet manifest file disable_icmp_redirects.pp, which specifies whether messages sent with ICMP can be redirected. In the file, extraneous text is now commented out.
• An issue with the cem::utils::boot_fstab_entry class was fixed to help ensure that Puppet runs would not overwrite user-specified settings.

v1.4.3

Released 15 December 2022

• Fixed an issue that resulted in catalog compilation errors on the Red Hat Enterprise Linux (RHEL) 7 operating system. The issue, caused by a duplicate instance of control V-204450 in the YAML file, resulted in error messages like the following:

  Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server 
  Error: Evaluation Error: Error while evaluating a Function Call, CEM: 
  cem_create_resources: failed  
  resource: class

• Fixed an issue related to Center for Internet Security (CIS) Control 4.1.3.6 in a RHEL 8 environment. When Control 4.1.3.6 is enabled, privileged programs are monitored to determine whether unauthorized users are trying to gain access. However, when Control 4.1.3.6 was enabled on systems using the Postfix mail transfer agent, two setuid binary files (postdrop and postqueue) were not being added to the auditd monitor list. The issue is corrected so that scans can run successfully.
• Fixed an issue related to CIS Control 1.5.3 in a RHEL environment. Control 1.5.3 is designed to ensure that address space layout randomization (ASLR) is enabled. ASLR randomly arranges the address space of data areas in processes to help protect system security. Enforcement for Control 1.5.3 was available in a RHEL 7 environment but was missing from RHEL 8. The control is now available to RHEL 8 users.
• Fixed an issue that affects users of the RHEL 7 operating system and pertains to control V-204444. When enabled, the control helps to prevent non-privileged users from initiating privileged functions such as disabling, circumventing, or altering security safeguards. However, after a system administrator specified the privileged users (resources) for control V-204444 and scans were run, the Puppet agent overwrote the resource list on each run. The issue is fixed to ensure that the resource list is not overwritten.
• Fixed an issue that caused scan failures for CIS Control 4.1.16, ‘Ensure kernel module loading and unloading is collected,’ in a RHEL 7 environment. When this control is enforced, the process of loading and unloading kernel modules is monitored to help detect unauthorized access to the system. Users of RHEL 7 found that Control 4.1.16 failed scans even when the control was correctly configured. The issue is corrected so that scans can run successfully.

v1.4.2

Released 8 November 2022

• Added the ability to configure multiple rsyslog remote hosts to CEM for Linux. In previous releases, only single remote hosts were fully configurable. This software update simplifies the process of using the rsyslog software utility to forward logs to remote servers.
• Added an audit script for the V-204392 control, which is included in a Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) standard. The DISA STIG control helps to ensure that file permissions, ownership, and group membership of system files and commands match vendor values. You can use the new audit script to troubleshoot issues related to the control.

• Updated the Advanced Intrusion Detection Environment (AIDE) utility class to add support for the cron scheduling utility. As a result, AIDE scans can be scheduled by using a cron task rather than systemd timers.
• Updated CEM for Linux to ensure that the nullok option cannot be included in the system-auth file. The nullok option determines whether users can access a service with a blank password. This software update is designed to prevent unauthorized access to the system.

• Fixed an issue that prevented certificates from being checked for Public Key Infrastructure (PKI) authentication. This software update affects users who are enforcing DISA STIG controls on a Red Hat Enterprise Linux (RHEL) operating system.
• Fixed an issue to help ensure that any new password must contain at least 8 characters that differ from the previous password. This software update affects users who are enforcing DISA STIG controls on a RHEL operating system.
• Fixed an issue related to the Center for Internet Security (CIS) Red Hat Enterprise Linux 8 Benchmark 2.0.0, Control 3.3.2: Ensure ICMP redirects are not accepted. This software update helps to ensure that the control is enforced so that Internet Control and Error Message Protocol redirects are prevented.
• Fixed an issue that caused the cem_semanage fact to run and log errors on an unsupported operating system, RHEL 6. semanage is a Security-Enhanced Linux (SELinux) management tool.
• Fixed an issue that caused catalog compilation errors when users selected the Network Time Protocol (NTP) synchronization service.

v1.4.1

Released 24 October 2022

• Fixed an issue that prevented the cem_mount_info fact from resolving on Puppet Enterprise (PE) versions 2019.x.x. The issue prompted the following error message:

  Facter: error while resolving custom facts...

  To resolve the issue, you can install CEM Linux v1.4.1. To help avoid the issue, you can install the latest version of PE.

v1.4.0

Released 20 October 2022

v1.3.2

Released 8 September 2022

v1.3.1

Released 18 August 2022

v1.3.0

Released 3 August 2022

v1.2.0

Released 24 May 2022

v1.1.4

Released 25 March 2022

v1.1.3

Released 24 March 2022

v1.1.2

Released 16 March 2022

v1.1.1

Released 25 January 2022

v1.1.0

Released 14 December 2021

v1.0.0

Released 28 September 2021

This is the initial public release of CEM for Linux.