Add CIS Level 1 profiles for Ubuntu 26.04

CMakeLists.txt

@@ -151,7 +151,7 @@ find_program(XMLLINT_EXECUTABLE NAMES xmllint REQUIRED)
 find_program(XSLTPROC_EXECUTABLE NAMES xsltproc REQUIRED)
 find_program(YAMLLINT_EXECUTABLE NAMES yamllint)
 
-if(SSG_PRODUCT_FEDORA OR SSG_PRODUCT_RHEL8 OR SSG_PRODUCT_RHEL9 OR SSG_PRODUCT_RHEL10 OR SSG_PRODUCT_UBUNTU2004 OR SSG_PRODUCT_UBUNTU2204 OR SSG_PRODUCT_UBUNTU2404)
+if(SSG_PRODUCT_FEDORA OR SSG_PRODUCT_RHEL8 OR SSG_PRODUCT_RHEL9 OR SSG_PRODUCT_RHEL10 OR SSG_PRODUCT_UBUNTU2004 OR SSG_PRODUCT_UBUNTU2204 OR SSG_PRODUCT_UBUNTU2404 OR SSG_PRODUCT_UBUNTU2604)
 set(SSG_SCE_ENABLED ON)
 endif()
 

components/apt.yml

@@ -1,33 +1,38 @@
 groups:
-- apt
+  - apt
 name: apt
 packages:
-- apt
+  - apt
 rules:
-- apt_conf_disallow_unauthenticated
-- apt_conf_disable_recommends
-- apt_conf_disable_suggests
-- apt_disable_weak_dependencies
-- apt_sources_list_official
-- directory_groupowner_apt_auth_conf_d
-- directory_groupowner_apt_sources_list_d
-- directory_groupowner_apt_trusted_gpg_d
-- directory_groupowner_usr_share_keyrings
-- directory_owner_apt_auth_conf_d
-- directory_owner_apt_sources_list_d
-- directory_owner_apt_trusted_gpg_d
-- directory_owner_usr_share_keyrings
-- directory_permissions_apt_auth_conf_d
-- directory_permissions_apt_sources_list_d
-- directory_permissions_apt_trusted_gpg_d
-- directory_permissions_usr_share_keyrings
-- file_groupowner_apt_auth_conf_d
-- file_groupowner_apt_gpg_keys
-- file_groupowner_apt_sources_list_d
-- file_owner_apt_auth_conf_d
-- file_owner_apt_gpg_keys
-- file_owner_apt_sources_list_d
-- file_permissions_apt_auth_conf_d
-- file_permissions_apt_gpg_keys
-- file_permissions_apt_sources_list_d
-
+  - apt_conf_disallow_unauthenticated
+  - apt_conf_disable_recommends
+  - apt_conf_disable_suggests
+  - apt_configure_allow_downgrade_to_insecure_repositories
+  - apt_configure_allow_insecure_repositories
+  - apt_configure_allow_weak_repositories
+  - apt_configure_check_date
+  - apt_disable_weak_dependencies
+  - apt_sources_list_d_https
+  - apt_sources_list_https
+  - apt_sources_list_official
+  - directory_groupowner_apt_auth_conf_d
+  - directory_groupowner_apt_sources_list_d
+  - directory_groupowner_apt_trusted_gpg_d
+  - directory_groupowner_usr_share_keyrings
+  - directory_owner_apt_auth_conf_d
+  - directory_owner_apt_sources_list_d
+  - directory_owner_apt_trusted_gpg_d
+  - directory_owner_usr_share_keyrings
+  - directory_permissions_apt_auth_conf_d
+  - directory_permissions_apt_sources_list_d
+  - directory_permissions_apt_trusted_gpg_d
+  - directory_permissions_usr_share_keyrings
+  - file_groupowner_apt_auth_conf_d
+  - file_groupowner_apt_gpg_keys
+  - file_groupowner_apt_sources_list_d
+  - file_owner_apt_auth_conf_d
+  - file_owner_apt_gpg_keys
+  - file_owner_apt_sources_list_d
+  - file_permissions_apt_auth_conf_d
+  - file_permissions_apt_gpg_keys
+  - file_permissions_apt_sources_list_d

components/coreutils.yml

@@ -1,10 +1,13 @@
 name: coreutils
 packages:
-- coreutils
+  - coreutils
 rules:
-- accounts_user_dot_group_ownership
-- accounts_user_dot_no_world_writable_programs
-- accounts_user_dot_user_ownership
-- accounts_users_home_files_groupownership
-- accounts_users_home_files_ownership
-- accounts_users_home_files_permissions
+  - accounts_user_dot_dirs_groupownership
+  - accounts_user_dot_dirs_ownership
+  - accounts_user_dot_dirs_permissions
+  - accounts_user_dot_group_ownership
+  - accounts_user_dot_no_world_writable_programs
+  - accounts_user_dot_user_ownership
+  - accounts_users_home_files_groupownership
+  - accounts_users_home_files_ownership
+  - accounts_users_home_files_permissions

components/cracklib-runtime.yml

@@ -0,0 +1,5 @@
+name: cracklib-runtime
+packages:
+  - cracklib-runtime
+rules:
+  - package_cracklib-runtime_installed

components/openssh.yml

@@ -1,103 +1,106 @@
 groups:
-- ssh
-- ssh_client
-- ssh_server
-- sshd_strengthen_firewall
+  - ssh
+  - ssh_client
+  - ssh_server
+  - sshd_strengthen_firewall
 name: openssh
 packages:
-- openssh
-- openssh-clients
-- openssh-server
+  - openssh
+  - openssh-clients
+  - openssh-server
 rules:
-- configure_custom_crypto_policy_cis
-- directory_groupowner_sshd_config_d
-- directory_owner_sshd_config_d
-- directory_permissions_sshd_config_d
-- disable_host_auth
-- file_groupowner_etc_sysconfig_sshd
-- file_groupowner_sshd_config
-- file_groupowner_sshd_drop_in_config
-- file_groupownership_sshd_private_key
-- file_groupownership_sshd_pub_key
-- file_owner_etc_sysconfig_sshd
-- file_owner_sshd_config
-- file_owner_sshd_drop_in_config
-- file_ownership_sshd_private_key
-- file_ownership_sshd_pub_key
-- file_permissions_etc_sysconfig_sshd
-- file_permissions_sshd_config
-- file_permissions_sshd_config_not_modified
-- file_permissions_sshd_drop_in_config
-- file_permissions_sshd_private_key
-- file_permissions_sshd_pub_key
-- file_sshd_50_redhat_exists
-- firewalld_sshd_disabled
-- firewalld_sshd_port_enabled
-- iptables_sshd_disabled
-- package_openssh-clients_installed
-- package_openssh-server_installed
-- package_openssh-server_removed
-- package_openssh_installed
-- package_openssh_removed
-- service_sshd_disabled
-- service_sshd_enabled
-- ssh_client_rekey_limit
-- ssh_client_use_strong_rng_csh
-- ssh_client_use_strong_rng_sh
-- ssh_client_use_approved_ciphers_ordered_stig
-- ssh_keys_passphrase_protected
-- ssh_private_keys_have_passcode
-- ssh_use_approved_macs_ordered_stig
-- sshd_allow_only_protocol2
-- sshd_disable_compression
-- sshd_disable_empty_passwords
-- sshd_disable_forwarding
-- sshd_disable_gssapi_auth
-- sshd_disable_kerb_auth
-- sshd_disable_pubkey_auth
-- sshd_disable_rhosts
-- sshd_disable_rhosts_rsa
-- sshd_disable_root_login
-- sshd_disable_root_password_login
-- sshd_disable_tcp_forwarding
-- sshd_disable_user_known_hosts
-- sshd_disable_x11_forwarding
-- sshd_do_not_permit_user_env
-- sshd_enable_gssapi_auth
-- sshd_enable_pam
-- sshd_enable_pubkey_auth
-- sshd_enable_strictmodes
-- sshd_enable_warning_banner
-- sshd_enable_warning_banner_net
-- sshd_enable_x11_forwarding
-- sshd_limit_user_access
-- sshd_print_last_log
-- sshd_set_allow_groups
-- sshd_rekey_limit
-- sshd_set_idle_timeout
-- sshd_set_keepalive
-- sshd_set_keepalive_0
-- sshd_set_login_grace_time
-- sshd_set_loglevel_info
-- sshd_set_loglevel_verbose
-- sshd_set_max_auth_tries
-- sshd_set_max_sessions
-- sshd_set_maxstartups
-- sshd_use_approved_ciphers
-- sshd_use_approved_ciphers_ordered_stig
-- sshd_use_approved_kex_ordered_stig
-- sshd_use_approved_macs
-- sshd_use_approved_macs_ordered_stig
-- sshd_use_directory_configuration
-- sshd_use_priv_separation
-- sshd_use_strong_ciphers
-- sshd_use_strong_kex
-- sshd_use_strong_macs
-- sshd_use_strong_rng
-- sshd_x11_use_localhost
-- sshd_include_crypto_policy
-- harden_sshd_ciphers_openssh_conf_crypto_policy
-- harden_sshd_crypto_policy
-- harden_sshd_macs_openssh_conf_crypto_policy
+  - configure_custom_crypto_policy_cis
+  - directory_groupowner_sshd_config_d
+  - directory_owner_sshd_config_d
+  - directory_permissions_sshd_config_d
+  - disable_host_auth
+  - file_groupowner_etc_sysconfig_sshd
+  - file_groupowner_sshd_config
+  - file_groupowner_sshd_drop_in_config
+  - file_groupownership_sshd_private_key
+  - file_groupownership_sshd_pub_key
+  - file_owner_etc_sysconfig_sshd
+  - file_owner_sshd_config
+  - file_owner_sshd_drop_in_config
+  - file_ownership_sshd_private_key
+  - file_ownership_sshd_pub_key
+  - file_permissions_etc_sysconfig_sshd
+  - file_permissions_sshd_config
+  - file_permissions_sshd_config_not_modified
+  - file_permissions_sshd_drop_in_config
+  - file_permissions_sshd_private_key
+  - file_permissions_sshd_pub_key
+  - file_sshd_50_redhat_exists
+  - firewalld_sshd_disabled
+  - firewalld_sshd_port_enabled
+  - iptables_sshd_disabled
+  - package_openssh-clients_installed
+  - package_openssh-server_installed
+  - package_openssh-server_removed
+  - package_openssh_installed
+  - package_openssh_removed
+  - service_sshd_disabled
+  - service_sshd_enabled
+  - ssh_client_rekey_limit
+  - ssh_client_use_strong_rng_csh
+  - ssh_client_use_strong_rng_sh
+  - ssh_client_use_approved_ciphers_ordered_stig
+  - ssh_keys_passphrase_protected
+  - ssh_private_keys_have_passcode
+  - ssh_use_approved_macs_ordered_stig
+  - sshd_allow_only_protocol2
+  - sshd_disable_compression
+  - sshd_disable_empty_passwords
+  - sshd_disable_empty_passwords_default
+  - sshd_disable_forwarding
+  - sshd_disable_gssapi_auth
+  - sshd_disable_kerb_auth
+  - sshd_disable_pubkey_auth
+  - sshd_disable_rhosts
+  - sshd_disable_rhosts_rsa
+  - sshd_disable_root_login
+  - sshd_disable_root_password_login
+  - sshd_disable_tcp_forwarding
+  - sshd_disable_user_known_hosts
+  - sshd_disable_x11_forwarding
+  - sshd_do_not_permit_user_env
+  - sshd_enable_gssapi_auth
+  - sshd_enable_pam
+  - sshd_enable_pubkey_auth
+  - sshd_enable_strictmodes
+  - sshd_enable_warning_banner
+  - sshd_enable_warning_banner_net
+  - sshd_enable_x11_forwarding
+  - sshd_limit_user_access
+  - sshd_print_last_log
+  - sshd_set_allow_groups
+  - sshd_rekey_limit
+  - sshd_set_idle_timeout
+  - sshd_set_keepalive
+  - sshd_set_keepalive_0
+  - sshd_set_keepalive_positive
+  - sshd_set_login_grace_time
+  - sshd_set_loglevel_info
+  - sshd_set_loglevel_verbose
+  - sshd_set_max_auth_tries
+  - sshd_set_max_sessions
+  - sshd_set_maxstartups
+  - sshd_use_approved_ciphers
+  - sshd_use_approved_ciphers_ordered_stig
+  - sshd_use_approved_kex_ordered_stig
+  - sshd_use_approved_macs
+  - sshd_use_approved_macs_ordered_stig
+  - sshd_use_directory_configuration
+  - sshd_use_priv_separation
+  - sshd_use_strong_ciphers
+  - sshd_use_strong_kex
+  - sshd_use_strong_kex_ubuntu2604
+  - sshd_use_strong_macs
+  - sshd_use_strong_rng
+  - sshd_x11_use_localhost
+  - sshd_include_crypto_policy
+  - harden_sshd_ciphers_openssh_conf_crypto_policy
+  - harden_sshd_crypto_policy
+  - harden_sshd_macs_openssh_conf_crypto_policy
 templates:
-- sshd_lineinfile
+  - sshd_lineinfile