From 97b907ff77f080ecb9ab9ec439afa0cbe203ac9d Mon Sep 17 00:00:00 2001 From: Israel Villar Boillos Date: Wed, 12 Aug 2026 12:51:16 +0100 Subject: [PATCH] controls/cis_debian13: fix section 5 title typos and complete 5.1.13 Verified against CIS Debian Linux 13 Benchmark v1.0.0 PDF: - 5.1.1: fix typo in title (access_to -> access to) - 5.2.6: fix title to match benchmark wording (sudo timestamp_timeout) - 5.3.3.2.2: fix title to match benchmark wording (password length) - 5.1.13: convert pending to automated. The post-quantum KEX audit checks the same KexAlgorithms line as 5.1.12, and the cis_debian13 value of sshd_strong_kex already lists mlkem768x25519-sha256 and sntrup761x25519-sha512@openssh.com first, so the existing rule mapping from 5.1.12 satisfies this control too. --- controls/cis_debian13.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/controls/cis_debian13.yml b/controls/cis_debian13.yml index 697e1fb15b5d..a3bd22328285 100644 --- a/controls/cis_debian13.yml +++ b/controls/cis_debian13.yml @@ -1656,7 +1656,7 @@ controls: - id: 5.1.1 - title: Ensure access_to /etc/ssh/sshd_config is configured (Automated) + title: Ensure access to /etc/ssh/sshd_config is configured (Automated) levels: - l1_server - l1_workstation @@ -1778,7 +1778,14 @@ controls: levels: - l1_server - l1_workstation - status: pending + rules: + - sshd_strong_kex=cis_debian13 + - sshd_use_strong_kex + status: automated + notes: | + Same KexAlgorithms line and rule as 5.1.12. The cis_debian13 value of + sshd_strong_kex already lists the post-quantum algorithms + mlkem768x25519-sha256 and sntrup761x25519-sha512@openssh.com first. - id: 5.1.14 title: Ensure sshd LoginGraceTime is configured (Automated) @@ -1921,7 +1928,7 @@ controls: status: automated - id: 5.2.6 - title: Ensure sudo authentication timeout is configured correctly (Automated) + title: Ensure sudo timestamp_timeout is configured (Automated) levels: - l1_server - l1_workstation @@ -2048,7 +2055,7 @@ controls: status: automated - id: 5.3.3.2.2 - title: Ensure minimum password length is configured (Automated) + title: Ensure password length is configured (Automated) levels: - l1_server - l1_workstation