Add CIS Level 1 profiles for Ubuntu 26.04

CMakeLists.txt

@@ -151,7 +151,7 @@ find_program(XMLLINT_EXECUTABLE NAMES xmllint REQUIRED)
 find_program(XSLTPROC_EXECUTABLE NAMES xsltproc REQUIRED)
 find_program(YAMLLINT_EXECUTABLE NAMES yamllint)
 
-if(SSG_PRODUCT_FEDORA OR SSG_PRODUCT_RHEL8 OR SSG_PRODUCT_RHEL9 OR SSG_PRODUCT_RHEL10 OR SSG_PRODUCT_UBUNTU2004 OR SSG_PRODUCT_UBUNTU2204 OR SSG_PRODUCT_UBUNTU2404)
+if(SSG_PRODUCT_FEDORA OR SSG_PRODUCT_RHEL8 OR SSG_PRODUCT_RHEL9 OR SSG_PRODUCT_RHEL10 OR SSG_PRODUCT_UBUNTU2004 OR SSG_PRODUCT_UBUNTU2204 OR SSG_PRODUCT_UBUNTU2404 OR SSG_PRODUCT_UBUNTU2604)
 set(SSG_SCE_ENABLED ON)
 endif()
 

components/apt.yml

@@ -7,7 +7,13 @@ rules:
 - apt_conf_disallow_unauthenticated
 - apt_conf_disable_recommends
 - apt_conf_disable_suggests
+- apt_configure_allow_downgrade_to_insecure_repositories
+- apt_configure_allow_insecure_repositories
+- apt_configure_allow_weak_repositories
+- apt_configure_check_date
 - apt_disable_weak_dependencies
+- apt_sources_list_d_https
+- apt_sources_list_https
 - apt_sources_list_official
 - directory_groupowner_apt_auth_conf_d
 - directory_groupowner_apt_sources_list_d
@@ -30,4 +36,3 @@ rules:
 - file_permissions_apt_auth_conf_d
 - file_permissions_apt_gpg_keys
 - file_permissions_apt_sources_list_d
-

components/coreutils.yml

@@ -2,6 +2,9 @@ name: coreutils
 packages:
 - coreutils
 rules:
+- accounts_user_dot_dirs_groupownership
+- accounts_user_dot_dirs_ownership
+- accounts_user_dot_dirs_permissions
 - accounts_user_dot_group_ownership
 - accounts_user_dot_no_world_writable_programs
 - accounts_user_dot_user_ownership

components/cracklib-runtime.yml

@@ -0,0 +1,5 @@
+name: cracklib-runtime
+packages:
+- cracklib-runtime
+rules:
+- package_cracklib-runtime_installed

components/openssh.yml

@@ -51,6 +51,7 @@ rules:
 - sshd_allow_only_protocol2
 - sshd_disable_compression
 - sshd_disable_empty_passwords
+- sshd_disable_empty_passwords_default
 - sshd_disable_forwarding
 - sshd_disable_gssapi_auth
 - sshd_disable_kerb_auth
@@ -77,6 +78,7 @@ rules:
 - sshd_set_idle_timeout
 - sshd_set_keepalive
 - sshd_set_keepalive_0
+- sshd_set_keepalive_positive
 - sshd_set_login_grace_time
 - sshd_set_loglevel_info
 - sshd_set_loglevel_verbose
@@ -92,6 +94,7 @@ rules:
 - sshd_use_priv_separation
 - sshd_use_strong_ciphers
 - sshd_use_strong_kex
+- sshd_use_strong_kex_ubuntu2604
 - sshd_use_strong_macs
 - sshd_use_strong_rng
 - sshd_x11_use_localhost

components/pam.yml

@@ -126,6 +126,7 @@ rules:
 - file_permissions_etc_issue
 - file_permissions_etc_issue_net
 - file_permissions_etc_motd
+- file_permissions_pam_motd
 - file_permissions_lastlog
 - group_unique_id
 - group_unique_name
@@ -157,6 +158,7 @@ rules:
 - package_pcsc-lite_installed
 - package_screen_installed
 - pam_disable_automatic_configuration
+- pam_motd_configured
 - passwd_system-auth_substack
 - policy_temp_passwords_immediate_change
 - prevent_direct_root_logins

components/sudo.yml

@@ -19,6 +19,7 @@ rules:
 - sudo_add_umask
 - sudo_add_use_pty
 - sudo_custom_logfile
+- sudo_logging_ubuntu2604
 - sudo_dedicated_group
 - sudo_remove_no_authenticate
 - sudo_remove_nopasswd

components/update-notifier-common.yml

@@ -0,0 +1,6 @@
+name: update-notifier-common
+packages:
+- update-notifier-common
+rules:
+- service_update-notifier-motd_disabled
+- timer_update-notifier-motd_disabled

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/bash/shared.sh

@@ -0,0 +1,23 @@
+# platform = multi_platform_ubuntu
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+config_file=/etc/apt/apt.conf.d/99-cis-repository-security
+option='Acquire::AllowDowngradeToInsecureRepositories'
+option_pattern='(Acquire::)?AllowDowngradeToInsecureRepositories'
+setting='Acquire::AllowDowngradeToInsecureRepositories "0";'
+
+touch "$config_file"
+
+# Remove existing definitions before writing the required value. Otherwise,
+# APT file precedence could leave a conflicting definition in effect.
+while IFS= read -r -d '' apt_conf_file; do
+    sed -ri "/^[[:space:]]*${option_pattern}[[:space:]]+/Id" "$apt_conf_file"
+done < <(find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -print0 2>/dev/null)
+
+if [ -s "$config_file" ] && [ -n "$(tail -c 1 "$config_file")" ]; then
+    printf '\n' >> "$config_file"
+fi
+printf '%s\n' "$setting" >> "$config_file"

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/rule.yml

@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Disable APT AllowDowngradeToInsecureRepositories'
+
+description: |-
+    Configure the effective APT setting with
+    <tt>Acquire::AllowDowngradeToInsecureRepositories "0";</tt>.
+
+rationale: |-
+    A repository that loses authentication must not silently remain usable.
+
+severity: high

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/sce/shared.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+# check-import = stdout
+
+explicit=false
+for config_file in /etc/apt/apt.conf /etc/apt/apt.conf.d/*; do
+    [[ -f "$config_file" ]] || continue
+    [[ "$config_file" == /etc/apt/apt.conf || ${config_file##*/} =~ ^[A-Za-z0-9_-]+$ ]] || continue
+    grep -Piq '^[\h]*(Acquire::)?AllowDowngradeToInsecureRepositories\h+' "$config_file" && explicit=true
+done
+
+if [[ "$explicit" == true ]] && apt-config dump 2>/dev/null | grep -Piq '^Acquire::AllowDowngradeToInsecureRepositories\s+"?(0|false|no|without|off)"?;$'; then
+    exit "$XCCDF_RESULT_PASS"
+fi
+
+echo 'Acquire::AllowDowngradeToInsecureRepositories is not explicitly configured with a disabled value.'
+exit "$XCCDF_RESULT_FAIL"

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/commented_only.fail.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*(Acquire::)?AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+echo '# Acquire::AllowDowngradeToInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowDowngradeToInsecureRepositories "0";' >> /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/missing.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*(Acquire::)?AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/nested_correct_value.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = Ubuntu 26.04
+
+mkdir -p /etc/apt/apt.conf.d
+printf '%s\n' 'Acquire {' '  AllowDowngradeToInsecureRepositories "0";' '};' > /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/nested_wrong_value.fail.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+printf '%s\n' 'Acquire {' '  AllowDowngradeToInsecureRepositories "1";' '};' > /etc/apt/apt.conf.d/70-cac-test

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/wrong_value.fail.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowDowngradeToInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/wrong_value_unquoted_dir.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+# APT accepts case-insensitive option names and unquoted values.
+echo 'acquire::allowdowngradetoinsecurerepositories 1;' >> /etc/apt/apt.conf.d/70-cac-test

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/bash/shared.sh

@@ -0,0 +1,23 @@
+# platform = multi_platform_ubuntu
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+config_file=/etc/apt/apt.conf.d/99-cis-repository-security
+option='Acquire::AllowInsecureRepositories'
+option_pattern='(Acquire::)?AllowInsecureRepositories'
+setting='Acquire::AllowInsecureRepositories "0";'
+
+touch "$config_file"
+
+# Remove existing definitions before writing the required value. Otherwise,
+# APT file precedence could leave a conflicting definition in effect.
+while IFS= read -r -d '' apt_conf_file; do
+    sed -ri "/^[[:space:]]*${option_pattern}[[:space:]]+/Id" "$apt_conf_file"
+done < <(find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -print0 2>/dev/null)
+
+if [ -s "$config_file" ] && [ -n "$(tail -c 1 "$config_file")" ]; then
+    printf '\n' >> "$config_file"
+fi
+printf '%s\n' "$setting" >> "$config_file"

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/rule.yml

@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Disable APT AllowInsecureRepositories'
+
+description: |-
+    Configure the effective APT setting with
+    <tt>Acquire::AllowInsecureRepositories "0";</tt>.
+
+rationale: |-
+    Insecure repositories do not provide authenticated package metadata.
+
+severity: high

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/sce/shared.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+# check-import = stdout
+
+explicit=false
+for config_file in /etc/apt/apt.conf /etc/apt/apt.conf.d/*; do
+    [[ -f "$config_file" ]] || continue
+    [[ "$config_file" == /etc/apt/apt.conf || ${config_file##*/} =~ ^[A-Za-z0-9_-]+$ ]] || continue
+    grep -Piq '^[\h]*(Acquire::)?AllowInsecureRepositories\h+' "$config_file" && explicit=true
+done
+
+if [[ "$explicit" == true ]] && apt-config dump 2>/dev/null | grep -Piq '^Acquire::AllowInsecureRepositories\s+"?(0|false|no|without|off)"?;$'; then
+    exit "$XCCDF_RESULT_PASS"
+fi
+
+echo 'Acquire::AllowInsecureRepositories is not explicitly configured with a disabled value.'
+exit "$XCCDF_RESULT_FAIL"

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/commented_only.fail.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*(Acquire::)?AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+echo '# Acquire::AllowInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowInsecureRepositories "0";' >> /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/missing.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*(Acquire::)?AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/nested_correct_value.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = Ubuntu 26.04
+
+mkdir -p /etc/apt/apt.conf.d
+printf '%s\n' 'Acquire {' '  AllowInsecureRepositories "0";' '};' > /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/nested_wrong_value.fail.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+printf '%s\n' 'Acquire {' '  AllowInsecureRepositories "1";' '};' > /etc/apt/apt.conf.d/70-cac-test

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/wrong_value.fail.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/wrong_value_unquoted_dir.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+# APT accepts case-insensitive option names and unquoted values.
+echo 'acquire::allowinsecurerepositories 1;' >> /etc/apt/apt.conf.d/70-cac-test

linux_os/guide/services/apt/apt_configure_allow_weak_repositories/bash/shared.sh

@@ -0,0 +1,23 @@
+# platform = multi_platform_ubuntu
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+config_file=/etc/apt/apt.conf.d/99-cis-repository-security
+option='Acquire::AllowWeakRepositories'
+option_pattern='(Acquire::)?AllowWeakRepositories'
+setting='Acquire::AllowWeakRepositories "0";'
+
+touch "$config_file"
+
+# Remove existing definitions before writing the required value. Otherwise,
+# APT file precedence could leave a conflicting definition in effect.
+while IFS= read -r -d '' apt_conf_file; do
+    sed -ri "/^[[:space:]]*${option_pattern}[[:space:]]+/Id" "$apt_conf_file"
+done < <(find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -print0 2>/dev/null)
+
+if [ -s "$config_file" ] && [ -n "$(tail -c 1 "$config_file")" ]; then
+    printf '\n' >> "$config_file"
+fi
+printf '%s\n' "$setting" >> "$config_file"

linux_os/guide/services/apt/apt_configure_allow_weak_repositories/rule.yml

@@ -0,0 +1,13 @@
+documentation_complete: true
+
+title: 'Disable APT AllowWeakRepositories'
+
+description: |-
+    Configure the effective APT setting with
+    <tt>Acquire::AllowWeakRepositories "0";</tt>.
+
+rationale: |-
+    Weak repositories use package metadata authentication that does not meet
+    current cryptographic requirements.
+
+severity: high

linux_os/guide/services/apt/apt_configure_allow_weak_repositories/sce/shared.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+# check-import = stdout
+
+explicit=false
+for config_file in /etc/apt/apt.conf /etc/apt/apt.conf.d/*; do
+    [[ -f "$config_file" ]] || continue
+    [[ "$config_file" == /etc/apt/apt.conf || ${config_file##*/} =~ ^[A-Za-z0-9_-]+$ ]] || continue
+    grep -Piq '^[\h]*(Acquire::)?AllowWeakRepositories\h+' "$config_file" && explicit=true
+done
+
+if [[ "$explicit" == true ]] && apt-config dump 2>/dev/null | grep -Piq '^Acquire::AllowWeakRepositories\s+"?(0|false|no|without|off)"?;$'; then
+    exit "$XCCDF_RESULT_PASS"
+fi
+
+echo 'Acquire::AllowWeakRepositories is not explicitly configured with a disabled value.'
+exit "$XCCDF_RESULT_FAIL"

linux_os/guide/services/apt/apt_configure_allow_weak_repositories/tests/commented_only.fail.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*(Acquire::)?AllowWeakRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+echo '# Acquire::AllowWeakRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_weak_repositories/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowWeakRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowWeakRepositories "0";' >> /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_weak_repositories/tests/missing.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*(Acquire::)?AllowWeakRepositories[[:space:]]+/Id' {} + 2>/dev/null || true