Skip to content

Add postfix package requirement and audit retention controls to multiple profile controls #14612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mab879 merged 4 commits into from
Apr 17, 2026
Merged

Add postfix package requirement and audit retention controls to multiple profile controls #14612

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
583ff1a
add auditd_data_retention_action_mail_acct for cis rhel 10
Arden97 Apr 1, 2026
3d1a3d6
add package_postfix_installed to multiple controls
Arden97 Apr 1, 2026
cae6a6e
update profile stability for cis, hipaa, pcidss
Arden97 Apr 1, 2026
715670a
removing package_postfix_installed from sle12, sle15 defaults
Arden97 Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions controls/hipaa.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
- id: 164.308(a)(1)(ii)(D)
title: 'Information system activity review'
description: |-
Implement procedures to regularly review records of information system activity, such as audit logs, access

Check failure on line 53 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

53:100 [line-length] line too long (117 > 99 characters)
reports, and security incident tracking reports.
levels:
- required
Expand Down Expand Up @@ -179,10 +179,10 @@

- id: 164.308(a)(3)
title: 'Workforce security'
description: Implement policies and procedures to ensure that all members of its workforce have

Check failure on line 182 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

182:100 [line-length] line too long (101 > 99 characters)
appropriate access to electronic protected health information, as provided under paragraph

Check failure on line 183 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

183:100 [line-length] line too long (100 > 99 characters)
(a)(4) of this section, and to prevent those workforce members who do not have access under

Check failure on line 184 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

184:100 [line-length] line too long (101 > 99 characters)
paragraph (a)(4) of this section from obtaining access to electronic protected health information.

Check failure on line 185 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

185:100 [line-length] line too long (108 > 99 characters)
levels:
- base
rules:
Expand All @@ -204,7 +204,7 @@
- id: 164.308(a)(3)(i)
title: 'Standard: Workforce security'
description: |-
Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.

Check failure on line 207 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

207:100 [line-length] line too long (374 > 99 characters)
levels:
- addressable
rules:
Expand All @@ -215,8 +215,8 @@

- id: 164.308(a)(3)(ii)(A)
title: 'Authorization and/or supervision (Addressable)'
description: 'Implement procedures for the authorization and/or supervision of workforce members

Check failure on line 218 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

218:100 [line-length] line too long (102 > 99 characters)
who work with electronic protected health information or in locations where it might be accessed.'

Check failure on line 219 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

219:100 [line-length] line too long (108 > 99 characters)
levels:
- required
rules:
Expand Down Expand Up @@ -514,8 +514,8 @@
- id: 164.308(a)(6)(ii)
title: 'Response and reporting'
description: |-
Identify and respond to suspected or known security incidents; mitigate, to the extent practicable,

Check failure on line 517 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

517:100 [line-length] line too long (109 > 99 characters)
harmful effects of security incidents that are known to the covered entity or business associate; and

Check failure on line 518 in controls/hipaa.yml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

518:100 [line-length] line too long (111 > 99 characters)
document security incidents and their outcomes.
levels:
- required
Expand Down Expand Up @@ -1248,6 +1248,7 @@
- auditd_data_retention_max_log_file_action
- auditd_data_retention_max_log_file_action_stig
- auditd_data_retention_space_left_action
- package_postfix_installed
- package_rsyslog_installed
- service_rsyslog_enabled
- partition_for_var_log_audit
Expand Down
1 change: 1 addition & 0 deletions controls/pcidss_3.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2130,6 +2130,7 @@ controls:
- auditd_data_retention_space_left
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_action_mail_acct
- package_postfix_installed

- id: Req-10.8
title: 10.8 Ensure that security policies and operational procedures for monitoring all access
Expand Down
1 change: 1 addition & 0 deletions controls/pcidss_4.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2967,6 +2967,7 @@ controls:
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_space_left
- auditd_data_retention_space_left_action
- package_postfix_installed
- package_logrotate_installed
- timer_logrotate_enabled
related_rules:
Expand Down
1 change: 1 addition & 0 deletions controls/srg_gpos/SRG-OS-000046-GPOS-00022.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ controls:
title: {{{ full_name }}} must alert the ISSO and SA (at a minimum) in the event
of an audit processing failure.
rules:
- package_postfix_installed
- postfix_client_configure_mail_alias
- postfix_client_configure_mail_alias_postmaster
- var_postfix_root_mail_alias=mil_sysadmin
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/services/mail/package_postfix_installed/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ severity: medium
identifiers:
cce@rhel8: CCE-85983-5
cce@rhel9: CCE-85984-3
cce@rhel10: CCE-86466-0

references:
srg: SRG-OS-000046-GPOS-00022
Expand Down
3 changes: 3 additions & 0 deletions products/rhel10/controls/cis_rhel10.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2621,8 +2621,11 @@ controls:
- l2_workstation
status: automated
rules:
- auditd_data_retention_action_mail_acct
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_space_left_action
- package_postfix_installed
- var_auditd_action_mail_acct=root
- var_auditd_admin_space_left_action=cis_rhel10
- var_auditd_space_left_action=cis_rhel10

Expand Down
1 change: 1 addition & 0 deletions products/rhel9/controls/cis_rhel9.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2560,6 +2560,7 @@ controls:
- auditd_data_retention_action_mail_acct
- auditd_data_retention_admin_space_left_action
- auditd_data_retention_space_left_action
- package_postfix_installed
- var_auditd_action_mail_acct=root
- var_auditd_admin_space_left_action=cis_rhel9
- var_auditd_space_left_action=cis_rhel9
Expand Down
1 change: 0 additions & 1 deletion products/sle12/profiles/default.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ selections:
- sudo_vdsm_nopasswd
- ntpd_configure_restrictions
- fapolicyd_prevent_home_folder_access
- package_postfix_installed
- audit_privileged_commands_poweroff
- accounts_password_pam_unix_rounds_password_auth
- sudoers_no_root_target
Expand Down
1 change: 1 addition & 0 deletions products/sle12/profiles/pci-dss-4.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ selections:
- '!use_pam_wheel_for_su'
- use_pam_wheel_group_for_su
- var_pam_wheel_group_for_su=cis
- '!package_postfix_installed'
# Following rules once had a prodtype incompatible with the sle12 product
- '!set_firewalld_default_zone'
- '!accounts_password_pam_dcredit'
Expand Down
1 change: 1 addition & 0 deletions products/sle12/profiles/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ selections:
- sshd_approved_ciphers=cis_sle12
- var_multiple_time_servers=suse
- var_multiple_time_pools=suse
- '!package_postfix_installed'
# Exclude from PCI DISS profile all rules related to ntp and timesyncd and keep only
# rules related to chrony
- '!ntpd_specify_multiple_servers'
Expand Down
1 change: 0 additions & 1 deletion products/sle15/profiles/default.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ selections:
- sudo_vdsm_nopasswd
- package_mcstrans_removed
- fapolicyd_prevent_home_folder_access
- package_postfix_installed
- accounts_password_pam_unix_rounds_password_auth
- audit_privileged_commands_poweroff
- configure_etc_hosts_deny
Expand Down
1 change: 1 addition & 0 deletions products/sle15/profiles/pci-dss-4.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ selections:
- var_multiple_time_servers=suse
- var_multiple_time_pools=suse
- audit_rules_enable_syscall_auditing
- '!package_postfix_installed'
# Exclude from PCI DISS profile all rules related to ntp and timesyncd and keep only
# rules related to chrony
- '!ntpd_specify_multiple_servers'
Expand Down
1 change: 0 additions & 1 deletion shared/references/cce-redhat-avail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
CCE-86466-0
CCE-86468-6
CCE-86482-7
CCE-86483-5
Expand Down
3 changes: 3 additions & 0 deletions tests/data/profile_stability/rhel10/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ audit_rules_usergroup_modification_shadow
audit_sudo_log_events
auditd_data_disk_error_action
auditd_data_disk_full_action
auditd_data_retention_action_mail_acct
auditd_data_retention_admin_space_left_action
auditd_data_retention_max_log_file
auditd_data_retention_max_log_file_action
Expand Down Expand Up @@ -336,6 +337,7 @@ package_net-snmp_removed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_setroubleshoot_removed
Expand Down Expand Up @@ -469,6 +471,7 @@ var_accounts_passwords_pam_faillock_unlock_time=900
var_accounts_tmout=15_min
var_accounts_user_umask=027
var_audit_backlog_limit=8192
var_auditd_action_mail_acct=root
var_auditd_admin_space_left_action=cis_rhel10
var_auditd_disk_error_action=cis_rhel10
var_auditd_disk_full_action=cis_rhel10
Expand Down
3 changes: 3 additions & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ audit_rules_usergroup_modification_shadow
audit_sudo_log_events
auditd_data_disk_error_action
auditd_data_disk_full_action
auditd_data_retention_action_mail_acct
auditd_data_retention_admin_space_left_action
auditd_data_retention_max_log_file
auditd_data_retention_max_log_file_action
Expand Down Expand Up @@ -335,6 +336,7 @@ package_net-snmp_removed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_squid_removed
Expand Down Expand Up @@ -465,6 +467,7 @@ var_accounts_passwords_pam_faillock_unlock_time=900
var_accounts_tmout=15_min
var_accounts_user_umask=027
var_audit_backlog_limit=8192
var_auditd_action_mail_acct=root
var_auditd_admin_space_left_action=cis_rhel10
var_auditd_disk_error_action=cis_rhel10
var_auditd_disk_full_action=cis_rhel10
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ no_direct_root_logins
no_empty_passwords
package_audit_installed
package_cron_installed
package_postfix_installed
package_rsyslog_installed
package_sequoia-sq_installed
package_telnet-server_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@ package_libselinux_installed
package_logrotate_installed
package_net-snmp_removed
package_nftables_installed
package_postfix_installed
package_sequoia-sq_installed
package_sudo_installed
package_telnet-server_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/stig.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,6 +380,7 @@ package_pcsc-lite-ccid_installed
package_pcsc-lite_installed
package_policycoreutils-python-utils_installed
package_policycoreutils_installed
package_postfix_installed
package_rsyslog-gnutls_installed
package_rsyslog_installed
package_s-nail_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/stig_gui.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,6 +377,7 @@ package_pcsc-lite-ccid_installed
package_pcsc-lite_installed
package_policycoreutils-python-utils_installed
package_policycoreutils_installed
package_postfix_installed
package_rsyslog-gnutls_installed
package_rsyslog_installed
package_s-nail_installed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ libreswan_approved_tunnels
no_direct_root_logins
no_empty_passwords
no_rsh_trust_files
package_postfix_installed
package_telnet-server_removed
package_telnet_removed
package_xinetd_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,7 @@ package_libselinux_installed
package_logrotate_installed
package_net-snmp_removed
package_nftables_installed
package_postfix_installed
package_sudo_installed
package_telnet-server_removed
package_telnet_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,7 @@ package_nftables_installed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_setroubleshoot_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,7 @@ package_nftables_installed
package_nginx_removed
package_openldap-clients_removed
package_pam_pwquality_installed
package_postfix_installed
package_rsync_removed
package_samba_removed
package_squid_removed
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/hipaa.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ no_direct_root_logins
no_empty_passwords
no_rsh_trust_files
package_cron_installed
package_postfix_installed
package_telnet-server_removed
package_telnet_removed
require_singleuser_auth
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,7 @@ package_libselinux_installed
package_logrotate_installed
package_net-snmp_removed
package_nftables_installed
package_postfix_installed
package_sudo_installed
package_telnet-server_removed
package_telnet_removed
Expand Down
Loading