refactor[rules] Added, Removed, Updated rules

- os_authenticated_root_enable, updated check - os_directory_services_configured, removed from stig - os_ess_installed, removed from stig - os_firewall_log_enable, removed from 15.x - os_genmoji_disable, added 800-53 and stig - os_image_generation_disable, added 800-53 and sti.yaml - os_iphone_mirroring_disable - os_password_autofill_disable, added 800-53 and sti - os_ssh_fips_compliant, fixed check/fix - os_ssh_server_alive_count_max_configure, fixed fix - os_ssh_server_alive_interval_configure, fixed fix - os_sshd_fips_compliant, fixed fix/check - os_sudo_log_enforce, added 800-53 and stig - os_writing_tools_disable, added 800-53 and sti - pwpolicy_custom_regex_enforce, updated regex - system_settings_ssh_enable, removed from stig
usnistgov · robertgendler · Dec 16, 2024 · Jul 25, 2024 · Aug 7, 2024 · Aug 7, 2024
commit dc12a59cf9ed4b10a8d5f73c419a10bc464f60c7
diff --git a/rules/os/os_authenticated_root_enable.yaml b/rules/os/os_authenticated_root_enable.yaml
@@ -9,7 +9,7 @@ discussion: |
 
   WARNING: If more than one partition with macOS is detected, the csrutil command will hang awaiting input.
 check: |
-  /usr/bin/csrutil authenticated-root | /usr/bin/grep -c 'enabled'
+  /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;"
 result:
   integer: 1
 fix: |

diff --git a/rules/os/os_directory_services_configured.yaml b/rules/os/os_directory_services_configured.yaml
@@ -14,15 +14,15 @@ references:
   cce:
     - N/A
   cci:
-    - CCI-000366
+    - N/A
   800-53r5:
     - N/A
   800-53r4:
     - N/A
   srg:
-    - SRG-OS-000480-GPOS-00227
+    - N/A
   disa_stig:
-    - APPL-15-000016
+    - N/A
   cis:
     benchmark:
       - N/A
@@ -32,7 +32,6 @@ macOS:
   - '15.0'
 tags:
   - cisv8
-  - stig
 severity: medium
 mobileconfig: false
 mobileconfig_info:
diff --git a/rules/os/os_ess_installed.yaml b/rules/os/os_ess_installed.yaml
diff --git a/rules/os/os_firewall_log_enable.yaml b/rules/os/os_firewall_log_enable.yaml
diff --git a/rules/os/os_gatekeeper_rearm.yaml b/rules/os/os_gatekeeper_rearm.yaml
diff --git a/rules/os/os_genmoji_disable.yaml b/rules/os/os_genmoji_disable.yaml
@@ -15,13 +15,29 @@ references:
   cce:
     - N/A
   cci:
+    - CCI-000381
+    - CCI-001774
+  srg:
+    - SRG-OS-000095-GPOS-00049
+  disa_stig:
     - N/A
   800-53r5:
-    - N/A
+    - AC-20
+    - AC-20(1)
+    - CM-7
+    - CM-7(1)
+    - SC-7(10)
 macOS:
   - '15.0'
 tags:
-  - none
+  - 800-53r5_low
+  - 800-53r5_moderate
+  - 800-53r5_high
+  - cisv8
+  - cnssi-1253_moderate
+  - cnssi-1253_low
+  - cnssi-1253_high
+  - stig
 mobileconfig: true
 mobileconfig_info:
   com.apple.applicationaccess:

diff --git a/rules/os/os_image_generation_disable.yaml b/rules/os/os_image_generation_disable.yaml
@@ -15,13 +15,29 @@ references:
   cce:
     - N/A
   cci:
+    - CCI-000381
+    - CCI-001774
+  srg:
+    - SRG-OS-000095-GPOS-00049
+  disa_stig:
     - N/A
   800-53r5:
-    - N/A
+    - AC-20
+    - AC-20(1)
+    - CM-7
+    - CM-7(1)
+    - SC-7(10)
 macOS:
   - '15.0'
 tags:
-  - none
+  - 800-53r5_low
+  - 800-53r5_moderate
+  - 800-53r5_high
+  - cisv8
+  - cnssi-1253_moderate
+  - cnssi-1253_low
+  - cnssi-1253_high
+  - stig
 mobileconfig: true
 mobileconfig_info:
   com.apple.applicationaccess:

diff --git a/rules/os/os_iphone_mirroring_disable.yaml b/rules/os/os_iphone_mirroring_disable.yaml
@@ -10,7 +10,7 @@ check: |
 result:
   string: 'false'
 fix: |
-  This is implemented by a Configuration Profile.references:
+  This is implemented by a Configuration Profile
 references:
   cce:
     - N/A

diff --git a/rules/os/os_password_autofill_disable.yaml b/rules/os/os_password_autofill_disable.yaml
@@ -17,55 +17,13 @@ references:
   cce:
     - N/A
   cci:
-    - CCI-000381
+    - N/A
   800-53r5:
-    - IA-5(13)
-    - CM-7
-    - CM-7(1)
-    - IA-11
-    - IA-5
-  800-53r4:
-    - IA-5
-    - IA-5(13)
-    - IA-11
-    - CM-7
-    - CM-7(1)
-  disa_stig:
-    - APPL-15-002190
-  srg:
-    - SRG-OS-000095-GPOS-00049
-  800-171r2:
-    - 3.4.6
-    - 3.5.1
-    - 3.5.2
-  cis:
-    benchmark:
-      - N/A
-    controls v8:
-      - 4.1
-      - 4.8
-  cmmc:
-    - CM.L2-3.4.6
-    - CM.L2-3.4.7
-    - IA.L2-3.5.8
-    - IA.L2-3.5.9
+    - N/A
 macOS:
   - '15.0'
 tags:
-  - 800-53r5_low
-  - 800-53r5_moderate
-  - 800-53r5_high
-  - 800-53r4_low
-  - 800-53r4_moderate
-  - 800-53r4_high
-  - 800-171
-  - cisv8
-  - cnssi-1253_moderate
-  - cnssi-1253_low
-  - cnssi-1253_high
-  - cmmc_lvl2
-  - stig
-severity: medium
+  - none
 mobileconfig: true
 mobileconfig_info:
   com.apple.applicationaccess:

diff --git a/rules/os/os_ssh_fips_compliant.yaml b/rules/os/os_ssh_fips_compliant.yaml
@@ -9,29 +9,20 @@ discussion: |
 
   NOTE: For more information on FIPS compliance with the version of SSH included in the macOS, the manual page apple_ssh_and_fips has additional information.
 check: |
-  fips_ssh_config="Host *
-  Ciphers aes128-gcm@openssh.com
+  fips_ssh_config="Ciphers aes128-gcm@openssh.com
   HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com
-  HostKeyAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com
+  HostKeyAlgorithms ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com
   KexAlgorithms ecdh-sha2-nistp256
-  MACs hmac-sha2-256
-  PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com
-  CASignatureAlgorithms ecdsa-sha2-nistp256"
-  /usr/bin/grep -c "$fips_ssh_config" /etc/ssh/ssh_config.d/fips_ssh_config
+  MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-256
+  PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com
+  CASignatureAlgorithms ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com"
+  /usr/bin/grep -c "$fips_ssh_config" /etc/ssh/crypto.conf
 result:
-  integer: 8
+  integer: 7
 fix: |
   [source,bash]
   ----
-  fips_ssh_config="Host *
-  Ciphers aes128-gcm@openssh.com
-  HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com
-  HostKeyAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com
-  KexAlgorithms ecdh-sha2-nistp256
-  MACs hmac-sha2-256
-  PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com
-  CASignatureAlgorithms ecdsa-sha2-nistp256"
-  /bin/echo "${fips_ssh_config}" > /etc/ssh/ssh_config.d/fips_ssh_config
+  /bin/ln -fs /etc/ssh/crypto/fips.conf /etc/ssh/crypto.conf
   ----
 references:
   cce:

diff --git a/rules/os/os_ssh_server_alive_count_max_configure.yaml b/rules/os/os_ssh_server_alive_count_max_configure.yaml
@@ -23,6 +23,9 @@ fix: |
     config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1 | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
     configarray=( ${(f)config} )
     for c in $configarray; do
+      if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
+        continue
+      fi
       /usr/bin/sudo -u $u /usr/bin/grep -q '^ServerAliveCountMax' "$c" && /usr/bin/sed -i '' 's/.*ServerAliveCountMax.*/ServerAliveCountMax $ODV/' "$c" || /bin/echo 'ServerAliveCountMax $ODV' >> "$c"
     done
   done