Merge pull request #10527 from rumch-se/drop_pam_rules_from_sle

Drop of unsupported rules from SLE 12/15 profiles
ComplianceAsCode · May 14, 2023 · 1e0a6c4 · 1e0a6c4
2 parents c7f1475 + 21adb5b
commit 1e0a6c4
Show file tree

Hide file tree

Showing 16 changed files with 17 additions and 20 deletions.
diff --git a/...pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/ansible/shared.yml b/...pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
 # reboot = false
 # strategy = restrict
 # complexity = low

diff --git a/.../accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml b/.../accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2204
+prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4,ubuntu2204
 
 title: 'Lock Accounts After Failed Password Attempts'
 

diff --git a/...ocking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/ansible/shared.yml b/...ocking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
 # reboot = false
 # strategy = restrict
 # complexity = low

diff --git a/...am/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/bash/shared.sh b/...am/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
 
 {{{ bash_pam_faillock_enable() }}}
 {{{ bash_pam_faillock_parameter_value("even_deny_root", "") }}}
diff --git a/...unts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml b/...unts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4,sle12,sle15
+prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4
 
 title: 'Configure the root Account for Failed Password Attempts'
 

diff --git a/...king_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml b/...king_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
 # reboot = false
 # strategy = restrict
 # complexity = low

diff --git a/.../locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh b/.../locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
 
 {{{ bash_instantiate_variables("var_accounts_passwords_pam_faillock_unlock_time") }}}
 

diff --git a/...ts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/...ts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2204
+prodtype: fedora,ol7,ol8,ol9,rhel7,rhel8,rhel9,rhv4,ubuntu2204
 
 title: 'Set Lockout Time for Failed Password Attempts'
 

diff --git a/products/sle12/profiles/anssi_bp28_enhanced.profile b/products/sle12/profiles/anssi_bp28_enhanced.profile
@@ -23,3 +23,4 @@ description: |-
 
 selections:
     - anssi:all:enhanced
+
diff --git a/products/sle12/profiles/anssi_bp28_intermediary.profile b/products/sle12/profiles/anssi_bp28_intermediary.profile
@@ -22,5 +22,4 @@ description: |-
     Manual review is required to assess if the installed services are minimal.
 
 selections:
-  - anssi:all:intermediary
-
+    - anssi:all:intermediary
diff --git a/products/sle12/profiles/anssi_bp28_minimal.profile b/products/sle12/profiles/anssi_bp28_minimal.profile
@@ -22,5 +22,4 @@ description: |-
     Manual review is required to assess if the installed services are minimal.
 
 selections:
-  - anssi:all:minimal
-
+    - anssi:all:minimal
diff --git a/products/sle12/profiles/pci-dss-4.profile b/products/sle12/profiles/pci-dss-4.profile
@@ -77,4 +77,3 @@ selections:
     -  sshd_use_approved_ciphers
     -  sshd_use_approved_macs
     -  sysctl_fs_suid_dumpable
-
diff --git a/products/sle12/profiles/pci-dss.profile b/products/sle12/profiles/pci-dss.profile
@@ -13,4 +13,3 @@ description: |-
 
 selections:
     - pcidss_3:all:base
-
diff --git a/products/sle15/profiles/anssi_bp28_intermediary.profile b/products/sle15/profiles/anssi_bp28_intermediary.profile
@@ -22,4 +22,4 @@ description: |-
     Manual review is required to assess if the installed services are minimal.
 
 selections:
-  - anssi:all:intermediary
+    - anssi:all:intermediary
diff --git a/products/sle15/profiles/anssi_bp28_minimal.profile b/products/sle15/profiles/anssi_bp28_minimal.profile
@@ -22,5 +22,4 @@ description: |-
     Manual review is required to assess if the installed services are minimal.
 
 selections:
-  - anssi:all:minimal
-
+    - anssi:all:minimal
diff --git a/products/sle15/profiles/pci-dss-4.profile b/products/sle15/profiles/pci-dss-4.profile
@@ -13,6 +13,7 @@ description: |-
 
 selections:
     -  pcidss_4:all:base
-    -  '!service_ntp_enabled'
-    -  '!service_ntpd_enabled'
-    -  '!service_timesyncd_enabled'
+    # remove some rules from profile
+    - '!service_ntp_enabled'
+    - '!service_ntpd_enabled'
+    - '!service_timesyncd_enabled'
Original file line number	Diff line number	Diff line change
Expand Up		@@ -23,3 +23,4 @@ description: \|-

		selections:
		- anssi:all:enhanced
Original file line number	Diff line number	Diff line change
Expand Up		@@ -77,4 +77,3 @@ selections:
		- sshd_use_approved_ciphers
		- sshd_use_approved_macs
		- sysctl_fs_suid_dumpable
Original file line number	Diff line number	Diff line change
Expand Up		@@ -13,4 +13,3 @@ description: \|-

		selections:
		- pcidss_3:all:base