It's that time again where I do everyone's homework and cross my fingers that my post doesn't end up being eaten by "Reddit's filters" this time! The observant among you will see these summaries posted elsewhere when I get some time at home. I also yeeted the header formatting (sorry!) because I read somewhere that the platform's moronic AI likes to trip on heavy header usage when it's detecting content it thinks was made by another AI. Heh.

Let's see how this goes!

RHEL 10 V1R2 Changes

Added Rules

• None

Removed Rules

• None

Stuff that might bite you

• RHEL-10-700920: Updates fix text for 10 minutes of inactivity instead of 15 regarding interactive login shells. Removes CCI 000057. If you were confused at all about inactivity timeouts, 10 appears to be the new 15 for most cases.
• RHEL-10-700750: Updates title, check text, and fix text values for 10 minutes instead of 15, and 600 seconds instead of 900 seconds regarding graphical logon sessions with GNOME.

Rule ID and Check Changes

• RHEL-10-200691: Changes postfix alias maps to use lmdb instead of hash, changes alias name from isso to ISSO.
• RHEL-10-500040: Updates check text to reference space_left instead of admin_space_left.
• RHEL-10-500410: Updates check text to reference init_module and finit_module system calls instead of incorrectly referencing delete_module.
• RHEL-10-600730: Updates check text to deliver usernames and password hashes to evaluate instead of just returning the hashes. Also, for those paying attention, the example user is nsauser instead of the disauser introduced in last quarter's changes.
• RHEL-10-600750: Updates check text value to sha512 instead of yescrypt. I hope none of you guys fell for that one. :)
• RHEL-10-200530: Adds the actual check command dnf list --installed firewalld, which was omitted in the original text. This one also removes a couple of CCIs so that it just references CCI 00382 now.

Rule ID, Check, and Fix Changes

• RHEL-10-701130: Adds check syntax to allow for values in sysctl.d, requires that the file end in .conf, and updates fix text to place the compliant values in /etc/sysctl.d/99-kernel_randomize_va_space.conf. I don't know about you guys, but I find it easier to stick them in something like 99-RHEL-10-701130.conf so I know at a glance what control a file is meant to address.

Rule ID, Title, and Vuln Discussion

• RHEL-10-200611: Updates title to reference pcscd socket instead of pcscd service and makes some changes to the word salad in the Vuln Discussion.

RHEL 9 V2R9 Changes

Added Rules

• None

Removed Rules

• RHEL-09-255130: sshd compression = no

Stuff that might bite you

• RHEL-09-653110: Updates check and fix text to require 0600 permissions instead of 0640 for audit.rules and auditd.conf, as well as any drop-in files.

Rule ID Changes Only

• RHEL-09-213010
• RHEL-09-213015
• RHEL-09-213025
• RHEL-09-213075
• RHEL-09-213080

Rule ID and Title Changes

• RHEL-09-611180: Updates title to reference pcscd socket instead of service.

Rule ID and Check Changes

• RHEL-09-232040: Removes sample check output.
• RHEL-09-411070: Updates check text command to give the assessor prettier output to evaluate. There is no material change regarding compliance posture.
• RHEL-09-671015: Updates check text to deliver usernames and password hashes to evaluate instead of just returning the hashes. Also, for those paying attention, the example user is nsauser instead of the disauser introduced in last quarter's changes. Also includes minor title change.

Rule ID, Check, and Fix Changes

• RHEL-09-211045: Updates check and fix so that the filename ends in .conf.
• RHEL-09-213070: Adds check syntax to allow for values in sysctl.d, requires that the file end in .conf, and updates fix text to place the compliant values in /etc/sysctl.d/99-kernel_randomize_va_space.conf.
• RHEL-09-215015: Updates check and fix text to reference the vsftpd package.
• RHEL-09-654225: Updates the audit.rules syntax, which is consistent with what we see in the RHEL 10 STIG. Be mindful that the rule converts from one line to two because it covers both b32 and b64. In RHEL 10, rules in the old format break auditd.
• RHEL-09-654230: Updates the audit.rules syntax, see above.
• RHEL-09-654235: Updates the audit.rules syntax, see above.
• RHEL-09-654240: Updates the audit.rules syntax, see above.
• RHEL-09-654245: Updates the audit.rules syntax, see above.
• RHEL-09-654250: Updates the audit.rules syntax, see above.
• RHEL-09-654255: Updates the audit.rules syntax, see above.
• RHEL-09-654220: Updates the audit.rules syntax, see above.
• RHEL-09-654215: Updates the audit.rules syntax, see above.
• RHEL-09-654097: Updates the audit.rules syntax, see above.
• RHEL-09-255120: Updates title, check, and fix to change ssh private key permissions from 0640 to 0600.

Rule ID and Vuln Discussion

• RHEL-09-611010: Removes references to /etc/pam.d/password-auth and /etc/pam.d/system-auth from vul discussion since the setting is actually handled over in /etc/security/pwquality.conf or one of its drop files.

RHEL 8 V2R8 Changes

Added Rules

• RHEL-08-040287: (CAT 2) net.ipv4.conf.default.rp_filter = 1 must be in sysctl.conf or an associated drop file.
• RHEL-08-040221: (CAT 2) net.ipv4.conf.all.log_martians = 1 must be in sysctl.conf or an associated drop file.
• RHEL-08-040222: (CAT 2) net.ipv4.conf.default.log_martians = 1 must be in sysctl.conf or an associated drop file.

Removed Rules

• None

Rule ID Changes Only

• RHEL-08-040286

Rule ID, Check, and Fix Changes

• RHEL-08-040172: Updates check and fix so that the filename ends in .conf.
• RHEL-08-010296: Corrects typo in MAC list for openssh crypto backend.
• RHEL-08-010120: Updates check text to deliver usernames and password hashes to evaluate instead of just returning the hashes. Also, for those paying attention, the example user is nsauser instead of the disauser introduced in last quarter's changes. Also includes minor title change.
• RHEL-08-010490: Updates title, check, and fix to change ssh private key permissions from 0640 to 0600.
• RHEL-08-020060: Updates title, check text, and fix text values for 10 minutes instead of 15, and 600 seconds instead of 900 seconds regarding graphical logon sessions with GNOME.
• RHEL-08-030610: Updates check and fix text to require 0600 permissions instead of 0640 for audit.rules and auditd.conf, as well as any drop-in files.
• RHEL-08-010371: Updates check and fix text to configure dnf.conf to use localpkg_gpgcheck=1 instead of localpkg_gpgcheck=True.
• RHEL-08-010430:: Adds check syntax to allow for values in sysctl.d, requires that the file end in .conf, and updates fix text to place the compliant values in /etc/sysctl.d/99-kernel_randomize_va_space.conf.
• RHEL-08-040285: Makes editorial changes to check in fix text to call out reverse path filtering on all IPv4 interfaces. The substance of the check and fix do not actually change.
• RHEL-08-040137: Inclusive language and other editorial (hyphenation) changes. This rule is still basically deny perm=any all : all as your final rule for fapolicyd.

Rule ID and Vuln Discussion

• RHEL-08-040220: Updates title to specifically address IPv4 ICMP redirect messages. There is also a blank line added to the vun discussion and another removed from the check text.