Отчет CIS

Оглавление

01 Inventory and Control of Enterprise Assets

02 Inventory and Control of Software Assets

03 Data Protection

04 Secure Configuration of Enterprise Assets and Software

05 Account Management

06 Access Control Management

07 Continuous Vulnerability Management

08 Audit Log Management

09 Email and Web Browser Protections

10 Malware Defenses

11 Data Recovery

12 Network Infrastructure Management

13 Network Monitoring and Defense

14 Security Awareness and Skills Training

15 Service Provider Management

16 Application Software Security

17 Incident Response Management

18 Penetration Testing

Операционная система	Имя хоста	Идентификатор uuid	Дистрибутив	Таймзона	Версия	Тип актива
REDOS7	sysop.4check.ru	c164cf2c-8777-11e2-b726-0cb109b73600	REDOS	MSK	7.3	Server

5.5.1 | Ensure password creation requirements are configured | enforce

Command: passwd_create: exit-status: matches expectation: 0

Ожидаемое значение	Полученное значение	Результат проверки
0	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
5.2				1	1

5.5.1 | Ensure password creation requirements are configured | enforce

Command: passwd_create: stdout: Expected "object: *bytes.Reader" to have patterns ["/^password\\s+requisite\\s+pam_pwquality.so\\stry_first_pass\\slocal_users_only\\senforce_for_root\\sretry=3/"] the missing elements were ["/^password\\s+requisite\\s+pam_pwquality.so\\stry_first_pass\\slocal_users_only\\senforce_for_root\\sretry=3/"]

Ожидаемое значение	Полученное значение	Результат проверки
[ ' / ^ p a s s w o r d \ \ s + r e q u i s i t e \ \ s + p a m _ p w q u a l i t y . s o \ \ s t r y _ f i r s t _ p a s s \ \ s l o c a l _ u s e r s _ o n l y \ \ s e n f o r c e _ f o r _ r o o t \ \ s r e t r y = 3 / ' ]	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
5.2				1	1

5.5.1 | Ensure password creation requirements are configured | pwquality

File: /etc/security/pwquality.conf: exists: matches expectation: true

Ожидаемое значение	Полученное значение	Результат проверки
True	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
5.2				1	1

5.5.1 | Ensure password creation requirements are configured | pwquality

File: /etc/security/pwquality.conf: contains: Error HavePatterns matcher expects patterns to be a string. got: : 14

Ожидаемое значение	Полученное значение	Результат проверки
[ 1 4 , 4 ]	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
5.2				1	1

5.5.3 | Ensure password reuse is limited

Command: pwreuse_pamd_system_auth: exit-status: Expected 1 to be numerically eq 0

Ожидаемое значение	Полученное значение	Результат проверки
0	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
5.2				1	1

5.5.3 | Ensure password reuse is limited

Command: pwreuse_pamd_system_auth: stdout: Expected "object: *bytes.Reader" to have patterns ["/^password\\s+(sufficient|requisite)\\s+pam_pwhistory.so\\stry_first_pass\\slocal_users_only\\senforce_for_root\\sretry=3\\sremember=5/","/^password\\s+(sufficient|requisite)\\s+pam_unix.so\\ssha512\\sshadow\\stry_first_pass\\suse_authtok\\sremember=5/"] the missing elements were ["/^password\\s+(sufficient|requisite)\\s+pam_pwhistory.so\\stry_first_pass\\slocal_users_only\\senforce_for_root\\sretry=3\\sremember=5/","/^password\\s+(sufficient|requisite)\\s+pam_unix.so\\ssha512\\sshadow\\stry_first_pass\\suse_authtok\\sremember=5/"]

Ожидаемое значение	Полученное значение	Результат проверки
[ ' / ^ p a s s w o r d \ \ s + ( s u f f i c i e n t \| r e q u i s i t e ) \ \ s + p a m _ p w h i s t o r y . s o \ \ s t r y _ f i r s t _ p a s s \ \ s l o c a l _ u s e r s _ o n l y \ \ s e n f o r c e _ f o r _ r o o t \ \ s r e t r y = 3 \ \ s r e m e m b e r = 5 / ' , ' / ^ p a s s w o r d \ \ s + ( s u f f i c i e n t \| r e q u i s i t e ) \ \ s + p a m _ u n i x . s o \ \ s s h a 5 1 2 \ \ s s h a d o w \ \ s t r y _ f i r s t _ p a s s \ \ s u s e _ a u t h t o k \ \ s r e m e m b e r = 5 / ' ]	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
5.2				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | login.defs

File: /etc/login.defs: exists: matches expectation: true

Ожидаемое значение	Полученное значение	Результат проверки
True	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | login.defs

File: /etc/login.defs: contents: matches expectation: ["/^ENCRYPT_METHOD SHA512/","!/^ENCRYPT_METHOD MD5/"]

Ожидаемое значение	Полученное значение	Результат проверки
[ ' / ^ E N C R Y P T _ M E T H O D S H A 5 1 2 / ' , ' ! / ^ E N C R Y P T _ M E T H O D M D 5 / ' ]	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | passwd-auth

File: /etc/libuser.conf: exists: matches expectation: true

Ожидаемое значение	Полученное значение	Результат проверки
True	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | passwd-auth

File: /etc/libuser.conf: contents: Expected "object: *os.File" to have patterns ["/^crypt_style = sha512/","!/^crypt_style = md5/"] the missing elements were ["/^crypt_style = sha512/"]

Ожидаемое значение	Полученное значение	Результат проверки
[ ' / ^ c r y p t _ s t y l e = s h a 5 1 2 / ' , ' ! / ^ c r y p t _ s t y l e = m d 5 / ' ]	[ ' ! / ^ c r y p t _ s t y l e = m d 5 / ' ]

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | passwd-auth

File: /etc/pam.d/password-auth: exists: matches expectation: true

Ожидаемое значение	Полученное значение	Результат проверки
True	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | passwd-auth

File: /etc/pam.d/password-auth: contents: Expected "object: *os.File" to have patterns ["/^password\\s+sufficient\\s+pam_unix.so sha512 shadow try_first_pass use_authtok/","/^password\\s+sufficient\\s+pam_unix.so sha512 shadow nullok try_first_pass use_authtok/"] the missing elements were ["/^password\\s+sufficient\\s+pam_unix.so sha512 shadow try_first_pass use_authtok/"]

Ожидаемое значение	Полученное значение	Результат проверки
[ ' / ^ p a s s w o r d \ \ s + s u f f i c i e n t \ \ s + p a m _ u n i x . s o s h a 5 1 2 s h a d o w t r y _ f i r s t _ p a s s u s e _ a u t h t o k / ' , ' / ^ p a s s w o r d \ \ s + s u f f i c i e n t \ \ s + p a m _ u n i x . s o s h a 5 1 2 s h a d o w n u l l o k t r y _ f i r s t _ p a s s u s e _ a u t h t o k / ' ]	[ ' / ^ p a s s w o r d \ \ s + s u f f i c i e n t \ \ s + p a m _ u n i x . s o s h a 5 1 2 s h a d o w n u l l o k t r y _ f i r s t _ p a s s u s e _ a u t h t o k / ' ]

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | system-auth

Command: pamd_system_auth_sha: exit-status: matches expectation: 0

Ожидаемое значение	Полученное значение	Результат проверки
0	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1

5.5.4 | Ensure password hashing algorithm is SHA-512 | system-auth

Command: pamd_system_auth_sha: stdout: Expected "object: *bytes.Reader" to have patterns ["/^password\\s+sufficient\\s+pam_unix.so sha512 shadow try_first_pass use_authtok remember=5/"] the missing elements were ["/^password\\s+sufficient\\s+pam_unix.so sha512 shadow try_first_pass use_authtok remember=5/"]

Ожидаемое значение	Полученное значение	Результат проверки
[ ' / ^ p a s s w o r d \ \ s + s u f f i c i e n t \ \ s + p a m _ u n i x . s o s h a 5 1 2 s h a d o w t r y _ f i r s t _ p a s s u s e _ a u t h t o k r e m e m b e r = 5 / ' ]	None

Группа стандарта реализации

CISv8	CISv8_IG1	CISv8_IG2	CISv8_IG3	server	workstation
3.11				1	1