Skip to main content
Version: Atlas v3.9

RedHat Enterprise Linux 8 Puppet Module (rhel8stig)

Table of Contents

  1. Description
  2. Setup - Getting started with rhel8stig
  3. Usage - Configuration options and additional functionality
  4. Limitations - OS compatibility, etc.
  5. Support - Getting module updates

Description

This Puppet module applies security hardening to Red Hat Enterprise Linux (RHEL) 8 as documented in the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG). See the CHANGELOG for the history of the module to include the current supported STIG release.

The module implements each STIG finding as a separate puppet class, enabling them to be enabled or disabled individually. Puppet classes for STIG findings are named after the vulnerability ID, beginning with a lower-case "v" followed by the ID number. All findings are enforced by default but can be disabled in hiera by using the 'exclude' parameter with an array of class names.

Setup

Required modules

This modules requires 'secfacts' and 'stdlib' in order to function correctly.

What rhel8stig affects

The STIG checklist addresses MANY system components that can impact operational functionality. It is also likely that you are already using Puppet modules to maintain the system configuration. This module attempts to balance strict enforcement of the STIG while avoiding negative operational impacts and potential conflicts with other puppet resources.

Major system components that will be modified:

  • Packages that are required by the STIG will be installed

  • Packages forbidden by the STIG will be removed

  • Kernel parameters and modules will be updated

  • PAM files will be updated

  • SSH files will be updated

  • The system audit configuration will be updated

  • AIDE will be installed and configured

  • SELinux will be set to "enforcing" mode with "targeted" policy

  • FIPS mode will be enabled

  • If FIPS or SELinux changes require a reboot, the host will be rebooted at the end of the Puppet run

Beginning with rhel8stig

Add the module to an environment and assign it to nodes. It is recommended to target a few non-production systems at first to assess the impact to the systems and identify any conflicts with other puppet resources. If there are specific STIG findings that are known to cause issues, disable them in hiera. Note that disabling classes in hiera only prevents puppet from enforcing a change, but the custom facts are still collected to enable accurate reporting. See the REFERENCE for a complete list of classes to include descriptions and any optional parameters.

rhel8stig::exclude:
- v230522 # Mount /var/tmp with 'noexec'
- v230523 # fapolicy module must be configured to employ a deny-all, permit-by-exception policy

There are a few classes with required parameters, so the module will fail unless values are supplied. Ensure you set values for these:

# GRUB password hash (create with 'grub2-mkpasswd-pbkdf2') - This value is referenced by v230234 and v2302345
rhel8stig::v230234::grub_passwd_hash: grub.pbkdf2.sha512...<EXAMPLE_TRUNCATED>
rhel8stig::v230235::grub_passwd_hash: grub.pbkdf2.sha512...<EXAMPLE_TRUNCATED>

# Central syslog server
rhel8stig::v230479::syslog_host: <FQDN/IP>[:PORT]

By default, the v230234 and v230235 classes will use a lookup of 'rhel8stig::grub_passwd_hash' as the GRUB password hash, so you can put a single GRUB password entry in hiera as follows:

# This GRUB password hash is referenced by v230234 and v230235
rhel8stig::grub_passwd_hash: grub.pbkdf2.sha512...<EXAMPLE_TRUNCATED>

You can also use hiera interpolation to refer to other values that may be set anywhere in hiera. For example, make a single hiera key/value entry for the grub password and reference it from the STIG module:

# Site GRUB password
grub_password: <SUPER_GOOD_PASSWORD>

# Refer to the existing 'grub_password' value for the STIG classes:
rhel8stig::v230234::grub_passwd_hash "%{lookup('grub_password')}"
rhel8stig::v230235::grub_passwd_hash "%{lookup('grub_password')}"

Usage

Many of the STIG classes do not attempt to force a configuration chae. Instead, they use facts to report on the compliance status. For example, if the '/home' path is not on a separate filesystem it makes no attempt to re-partition the system. Instead the discrepancy is noted with the logged event:

SECURITY WARNING! "/home" should be on a separate file system

Review the puppet output or reports and address the 'SECURITY WARNING' messages as needed by following this general process:

  1. Modify the build/deployment process to create separate file systems as required
  2. Define new or update existing puppet resources for security settings like mount options, DNS, and NTP servers, etc.
  3. Observe results of previous steps against remaining security warnings from later puppet runs
  4. Verify reported security warnings against collected facts and resources defined in the environment, correcting as needed.
  5. Finally, when unable to resolve findings due to operational requirements, disable the class in hiera to quiet the security warnings.
note

Many of the STIG puppet classes require data from custom facts produced by the "kgi-secfacts" module. Ensure this module is assigned to nodes to manage collection of the basic facts that support this STIG. See the Security Facts (secfacts) documentation for details.

Also, when running the Puppet agent on a node, there may be some warning message indicating that soft limits were exceeded. These can be remediated by adjusting those soft limits in the 'puppet.conf' file on each node. Example:

top_level_facts_soft_limit = 1024
number_of_facts_soft_limit = 6144

Limitations

This module works with RedHat and CentOS 8 only.

  • Table of Contents
  • Description
  • Setup
  • Usage
  • Limitations
  • Table of Contents
  • Classes
    • rhel8stig
    • rhel8stig::v230221
    • rhel8stig::v230222
    • rhel8stig::v230223
    • rhel8stig::v230224
    • rhel8stig::v230225
    • rhel8stig::v230226
    • rhel8stig::v230227
    • rhel8stig::v230228
    • rhel8stig::v230229
    • rhel8stig::v230230
    • rhel8stig::v230231
    • rhel8stig::v230232
    • rhel8stig::v230233
    • rhel8stig::v230234
    • rhel8stig::v230235
    • rhel8stig::v230236
    • rhel8stig::v230237
    • rhel8stig::v230238
    • rhel8stig::v230239
    • rhel8stig::v230240
    • rhel8stig::v230241
    • rhel8stig::v230243
    • rhel8stig::v230244
    • rhel8stig::v230245
    • rhel8stig::v230246
    • rhel8stig::v230247
    • rhel8stig::v230248
    • rhel8stig::v230249
    • rhel8stig::v230250
    • rhel8stig::v230251
    • rhel8stig::v230252
    • rhel8stig::v230253
    • rhel8stig::v230254
    • rhel8stig::v230255
    • rhel8stig::v230256
    • rhel8stig::v230257
    • rhel8stig::v230258
    • rhel8stig::v230259
    • rhel8stig::v230260
    • rhel8stig::v230261
    • rhel8stig::v230262
    • rhel8stig::v230263
    • rhel8stig::v230264
    • rhel8stig::v230265
    • rhel8stig::v230266
    • rhel8stig::v230267
    • rhel8stig::v230268
    • rhel8stig::v230269
    • rhel8stig::v230270
    • rhel8stig::v230271
    • rhel8stig::v230272
    • rhel8stig::v230273
    • rhel8stig::v230274
    • rhel8stig::v230275
    • rhel8stig::v230276
    • rhel8stig::v230277
    • rhel8stig::v230278
    • rhel8stig::v230279
    • rhel8stig::v230280
    • rhel8stig::v230281
    • rhel8stig::v230282
    • rhel8stig::v230283
    • rhel8stig::v230284
    • rhel8stig::v230285
    • rhel8stig::v230286
    • rhel8stig::v230287
    • rhel8stig::v230288
    • rhel8stig::v230289
    • rhel8stig::v230290
    • rhel8stig::v230291
    • rhel8stig::v230292
    • rhel8stig::v230293
    • rhel8stig::v230294
    • rhel8stig::v230295
    • rhel8stig::v230296
    • rhel8stig::v230298
    • rhel8stig::v230299
    • rhel8stig::v230300
    • rhel8stig::v230301
    • rhel8stig::v230302
    • rhel8stig::v230303
    • rhel8stig::v230304
    • rhel8stig::v230305
    • rhel8stig::v230306
    • rhel8stig::v230307
    • rhel8stig::v230308
    • rhel8stig::v230309
    • rhel8stig::v230310
    • rhel8stig::v230311
    • rhel8stig::v230312
    • rhel8stig::v230313
    • rhel8stig::v230314
    • rhel8stig::v230315
    • rhel8stig::v230316
    • rhel8stig::v230317
    • rhel8stig::v230318
    • rhel8stig::v230319
    • rhel8stig::v230320
    • rhel8stig::v230321
    • rhel8stig::v230322
    • rhel8stig::v230323
    • rhel8stig::v230324
    • rhel8stig::v230325
    • rhel8stig::v230326
    • rhel8stig::v230327
    • rhel8stig::v230328
    • rhel8stig::v230329
    • rhel8stig::v230330
    • rhel8stig::v230331
    • rhel8stig::v230332
    • rhel8stig::v230333
    • rhel8stig::v230334
    • rhel8stig::v230335
    • rhel8stig::v230336
    • rhel8stig::v230337
    • rhel8stig::v230338
    • rhel8stig::v230339
    • rhel8stig::v230340
    • rhel8stig::v230341
    • rhel8stig::v230342
    • rhel8stig::v230343
    • rhel8stig::v230344
    • rhel8stig::v230345
    • rhel8stig::v230346
    • rhel8stig::v230347
    • rhel8stig::v230348
    • rhel8stig::v230349
    • rhel8stig::v230350
    • rhel8stig::v230351
    • rhel8stig::v230352
    • rhel8stig::v230353
    • rhel8stig::v230354
    • rhel8stig::v230355
    • rhel8stig::v230356
    • rhel8stig::v230357
    • rhel8stig::v230358
    • rhel8stig::v230359
    • rhel8stig::v230360
    • rhel8stig::v230361
    • rhel8stig::v230362
    • rhel8stig::v230363
    • rhel8stig::v230364
    • rhel8stig::v230365
    • rhel8stig::v230366
    • rhel8stig::v230367
    • rhel8stig::v230368
    • rhel8stig::v230369
    • rhel8stig::v230370
    • rhel8stig::v230371
    • rhel8stig::v230372
    • rhel8stig::v230373
    • rhel8stig::v230374
    • rhel8stig::v230375
    • rhel8stig::v230376
    • rhel8stig::v230377
    • rhel8stig::v230378
    • rhel8stig::v230379
    • rhel8stig::v230380
    • rhel8stig::v230381
    • rhel8stig::v230382
    • rhel8stig::v230383
    • rhel8stig::v230384
    • rhel8stig::v230385
    • rhel8stig::v230386
    • rhel8stig::v230387
    • rhel8stig::v230388
    • rhel8stig::v230389
    • rhel8stig::v230390
    • rhel8stig::v230392
    • rhel8stig::v230393
    • rhel8stig::v230394
    • rhel8stig::v230395
    • rhel8stig::v230396
    • rhel8stig::v230397
    • rhel8stig::v230398
    • rhel8stig::v230399
    • rhel8stig::v230400
    • rhel8stig::v230401
    • rhel8stig::v230402
    • rhel8stig::v230403
    • rhel8stig::v230404
    • rhel8stig::v230405
    • rhel8stig::v230406
    • rhel8stig::v230407
    • rhel8stig::v230408
    • rhel8stig::v230409
    • rhel8stig::v230410
    • rhel8stig::v230411
    • rhel8stig::v230412
    • rhel8stig::v230413
    • rhel8stig::v230414
    • rhel8stig::v230415
    • rhel8stig::v230416
    • rhel8stig::v230417
    • rhel8stig::v230418
    • rhel8stig::v230419
    • rhel8stig::v230420
    • rhel8stig::v230421
    • rhel8stig::v230422
    • rhel8stig::v230423
    • rhel8stig::v230424
    • rhel8stig::v230425
    • rhel8stig::v230426
    • rhel8stig::v230427
    • rhel8stig::v230428
    • rhel8stig::v230429
    • rhel8stig::v230430
    • rhel8stig::v230431
    • rhel8stig::v230432
    • rhel8stig::v230433
    • rhel8stig::v230434
    • rhel8stig::v230435
    • rhel8stig::v230436
    • rhel8stig::v230437
    • rhel8stig::v230438
    • rhel8stig::v230439
    • rhel8stig::v230440
    • rhel8stig::v230441
    • rhel8stig::v230442
    • rhel8stig::v230443
    • rhel8stig::v230444
    • rhel8stig::v230445
    • rhel8stig::v230446
    • rhel8stig::v230447
    • rhel8stig::v230448
    • rhel8stig::v230449
    • rhel8stig::v230450
    • rhel8stig::v230451
    • rhel8stig::v230452
    • rhel8stig::v230453
    • rhel8stig::v230454
    • rhel8stig::v230455
    • rhel8stig::v230456
    • rhel8stig::v230457
    • rhel8stig::v230458
    • rhel8stig::v230459
    • rhel8stig::v230460
    • rhel8stig::v230461
    • rhel8stig::v230462
    • rhel8stig::v230463
    • rhel8stig::v230464
    • rhel8stig::v230465
    • rhel8stig::v230466
    • rhel8stig::v230467
    • rhel8stig::v230468
    • rhel8stig::v230469
    • rhel8stig::v230470
    • rhel8stig::v230471
    • rhel8stig::v230472
    • rhel8stig::v230473
    • rhel8stig::v230474
    • rhel8stig::v230475
    • rhel8stig::v230476
    • rhel8stig::v230477
    • rhel8stig::v230478
    • rhel8stig::v230479
    • rhel8stig::v230480
    • rhel8stig::v230481
    • rhel8stig::v230482
    • rhel8stig::v230483
    • rhel8stig::v230484
    • rhel8stig::v230485
    • rhel8stig::v230486
    • rhel8stig::v230487
    • rhel8stig::v230488
    • rhel8stig::v230489
    • rhel8stig::v230491
    • rhel8stig::v230492
    • rhel8stig::v230493
    • rhel8stig::v230494
    • rhel8stig::v230495
    • rhel8stig::v230496
    • rhel8stig::v230497
    • rhel8stig::v230498
    • rhel8stig::v230499
    • rhel8stig::v230500
    • rhel8stig::v230502
    • rhel8stig::v230503
    • rhel8stig::v230504
    • rhel8stig::v230505
    • rhel8stig::v230506
    • rhel8stig::v230507
    • rhel8stig::v230508
    • rhel8stig::v230509
    • rhel8stig::v230510
    • rhel8stig::v230511
    • rhel8stig::v230512
    • rhel8stig::v230513
    • rhel8stig::v230514
    • rhel8stig::v230515
    • rhel8stig::v230516
    • rhel8stig::v230517
    • rhel8stig::v230518
    • rhel8stig::v230519
    • rhel8stig::v230520
    • rhel8stig::v230521
    • rhel8stig::v230522
    • rhel8stig::v230523
    • rhel8stig::v230524
    • rhel8stig::v230525
    • rhel8stig::v230526
    • rhel8stig::v230527
    • rhel8stig::v230529
    • rhel8stig::v230530
    • rhel8stig::v230531
    • rhel8stig::v230532
    • rhel8stig::v230533
    • rhel8stig::v230534
    • rhel8stig::v230535
    • rhel8stig::v230536
    • rhel8stig::v230537
    • rhel8stig::v230538
    • rhel8stig::v230539
    • rhel8stig::v230540
    • rhel8stig::v230541
    • rhel8stig::v230542
    • rhel8stig::v230543
    • rhel8stig::v230544
    • rhel8stig::v230545
    • rhel8stig::v230546
    • rhel8stig::v230547
    • rhel8stig::v230548
    • rhel8stig::v230549
    • rhel8stig::v230550
    • rhel8stig::v230551
    • rhel8stig::v230552
    • rhel8stig::v230553
    • rhel8stig::v230554
    • rhel8stig::v230555
    • rhel8stig::v230556
    • rhel8stig::v230557
    • rhel8stig::v230558
    • rhel8stig::v230559
    • rhel8stig::v230560
    • rhel8stig::v230561
    • rhel8stig::v237640
    • rhel8stig::v237641
    • rhel8stig::v237642
    • rhel8stig::v237643
    • rhel8stig::v244519
    • rhel8stig::v244521
    • rhel8stig::v244522
    • rhel8stig::v244523
    • rhel8stig::v244524
    • rhel8stig::v244525
    • rhel8stig::v244526
    • rhel8stig::v244527
    • rhel8stig::v244528
    • rhel8stig::v244529
    • rhel8stig::v244530
    • rhel8stig::v244531
    • rhel8stig::v244532
    • rhel8stig::v244533
    • rhel8stig::v244534
    • rhel8stig::v244535
    • rhel8stig::v244536
    • rhel8stig::v244537
    • rhel8stig::v244538
    • rhel8stig::v244539
    • rhel8stig::v244540
    • rhel8stig::v244541
    • rhel8stig::v244542
    • rhel8stig::v244543
    • rhel8stig::v244544
    • rhel8stig::v244545
    • rhel8stig::v244546
    • rhel8stig::v244547
    • rhel8stig::v244548
    • rhel8stig::v244549
    • rhel8stig::v244550
    • rhel8stig::v244551
    • rhel8stig::v244552
    • rhel8stig::v244553
    • rhel8stig::v244554
    • rhel8stig::v245540
    • rhel8stig::v250315
    • rhel8stig::v250316
    • rhel8stig::v250317
    • rhel8stig::v251706
    • rhel8stig::v251707
    • rhel8stig::v251708
    • rhel8stig::v251709
    • rhel8stig::v251710
    • rhel8stig::v251711
    • rhel8stig::v251712
    • rhel8stig::v251713
    • rhel8stig::v251714
    • rhel8stig::v251715
    • rhel8stig::v251716
    • rhel8stig::v251717
    • rhel8stig::v251718
  • Defined types
    • rhel8stig::audit_rule
    • rhel8stig::auditd_setting
    • rhel8stig::dconf_lock
    • rhel8stig::dconf_setting
    • rhel8stig::resolv_conf
    • rhel8stig::rsyslog_setting
    • rhel8stig::sshd_rule
    • rhel8stig::sysctl_rule
  • Changelog