Bug 1953787 - Insights does not use latest benchmark for CIS compliance
Summary: Insights does not use latest benchmark for CIS compliance
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: scap-security-guide
Version: 7.9
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: rc
: ---
Assignee: Vojtech Polasek
QA Contact: Milan Lysonek
URL:
Whiteboard:
: 1953748 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-04-26 23:42 UTC by Nikhil Gupta
Modified: 2021-11-30 09:05 UTC (History)
15 users (show)

Fixed In Version: scap-security-guide-0.1.57-1.el7_9
Doc Type: Enhancement
Doc Text:
.Update of CIS profiles in SCAP Security Guide Three new compliance profiles aligned with the Center for Internet Security (CIS) Red Hat Enterprise Linux 7 Benchmark have been introduced to the SCAP Security Guide. All profiles are aligned with the version 3.1.1 of the benchmark. This is a substantial update over the previous version which was aligned with the CIS benchmark version 2.2.0. The CIS RHEL 7 Benchmark provides different configuration recommendations for "Server" and "Workstation" deployments, and defines two levels of configuration, "level 1" and "level 2" for each deployment. The CIS profile previously shipped in RHEL7 represented only the "Server Level 2". The three new profiles complete the scope of the CIS RHEL 7 Benchmark profiles, and you can now more easily evaluate your system against CIS recommendations. All currently available CIS RHEL 7 profiles are: [horizontal] Workstation Level 1:: `xccdf_org.ssgproject.content_profile_cis_workstation_l1` Workstation Level 2:: `xccdf_org.ssgproject.content_profile_cis_workstation_l2` Server Level 1:: `xccdf_org.ssgproject.content_profile_cis_server_l1` Server Level 2:: `xccdf_org.ssgproject.content_profile_cis`
Clone Of:
Environment:
Last Closed: 2021-11-23 17:14:34 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 6393951 0 None None None 2021-11-30 09:05:41 UTC
Red Hat Product Errata RHBA-2021:4781 0 None None None 2021-11-23 17:14:39 UTC

Description Nikhil Gupta 2021-04-26 23:42:43 UTC 
Description of problem:

Current benchmark used by Insights is Red Hat Enterprise Linux 7 Benchmark™, v2.2.0, released 12-27-2017.

We need it to use Level 2 of CIS Red Hat Enterprise Linux 7 Benchmark
v3.0.1 released 09-21-2020.


Version-Release number of selected component (if applicable):
insights-client-3.1.1-1.el7_9.noarch
scap-security-guide-0.1.52-2.el7_9.noarch


How reproducible:
Always


Steps to Reproduce:
1. Install latest scap-security-guide package on RHEL 7
2. Create a CIS compliance policy with RHEL 7 Host


Actual results:

This profile defines a baseline that aligns to the Center for Internet Security® Red Hat Enterprise Linux 7 Benchmark™, v2.2.0, released 12-27-2017.  This profile includes Center for Internet Security® Red Hat Enterprise Linux 7 CIS Benchmarks™ content.


Expected results:

The Benchmark should be updated to the latest version in the 'scap-security-guide' package. Security standards require using the latest benchmark.


Additional info:

# oscap info --profile xccdf_org.ssgproject.content_profile_cis /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

Profile
	Title: CIS Red Hat Enterprise Linux 7 Benchmark
	Id: xccdf_org.ssgproject.content_profile_cis

	Description: This profile defines a baseline that aligns to the Center for Internet Security® Red Hat Enterprise Linux 7 Benchmark™, v2.2.0, released 12-27-2017.  This profile includes Center for Internet Security® Red Hat Enterprise Linux 7 CIS Benchmarks™ content.
Comment 1 Victor M. 2021-04-27 13:06:37 UTC 
Linking JIRA issue for tracking
Comment 9 Vojtech Polasek 2021-04-30 09:59:39 UTC 
*** Bug 1953748 has been marked as a duplicate of this bug. ***
Comment 16 Vojtech Polasek 2021-08-12 14:00:59 UTC 
The profile is upstream:
https://github.com/ComplianceAsCode/content/pull/7108
https://github.com/ComplianceAsCode/content/pull/7111
https://github.com/ComplianceAsCode/content/pull/7112
https://github.com/ComplianceAsCode/content/pull/7134
https://github.com/ComplianceAsCode/content/pull/7193
https://github.com/ComplianceAsCode/content/pull/7219
https://github.com/ComplianceAsCode/content/pull/7237
https://github.com/ComplianceAsCode/content/pull/7259
https://github.com/ComplianceAsCode/content/pull/7382
https://github.com/ComplianceAsCode/content/pull/7384
Comment 47 errata-xmlrpc 2021-11-23 17:14:34 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4781
Note You need to log in before you can comment on or make changes to this bug.