text:
# Reference

<!-- DO NOT EDIT: This document was generated by Puppet Strings -->

## Table of Contents

### Classes

#### Public Classes

* [`secure_linux_cis`](#secure_linux_cis): CIS Hardening Module
* [`secure_linux_cis::refresh_mount_options`](#secure_linux_cisrefresh_mount_options): A short summary of the purpose of this class
* [`secure_linux_cis::rules::ensure_code_dump_backtraces_are_disabled`](#secure_linux_cisrulesensure_code_dump_backtraces_are_disabled): Ensure authentication required for single user mode (Scored)
* [`secure_linux_cis::rules::ensure_code_dump_storage_is_disabled`](#secure_linux_cisrulesensure_code_dump_storage_is_disabled): Ensure authentication required for single user mode (Scored)
* [`secure_linux_cis::rules::ensure_default_group_for_the_root_account_is_gid_0`](#secure_linux_cisrulesensure_default_group_for_the_root_account_is_gid_0): Ensure default group for the root account is GID 0 (Scored)
* [`secure_linux_cis::rules::ensure_events_that_modify_the_system_s_mandatory_access_controls_are_collected`](#secure_linux_cisrulesensure_events_that_modify_the_system_s_mandatory_access_controls_are_collected): Ensure events that modify the system's Mandatory Access Controls are collected (Scored)
* [`secure_linux_cis::rules::ensure_events_that_modify_the_system_s_network_environment_are_collected`](#secure_linux_cisrulesensure_events_that_modify_the_system_s_network_environment_are_collected): Ensure events that modify the system's network environment are collected (Scored)
* [`secure_linux_cis::rules::ensure_gpg_keys_are_configured`](#secure_linux_cisrulesensure_gpg_keys_are_configured): Ensure GPG keys are configured (Not Scored)
* [`secure_linux_cis::rules::ensure_inactive_password_lock_is_30_days_or_less`](#secure_linux_cisrulesensure_inactive_password_lock_is_30_days_or_less): Ensure inactive password lock is 30 days or less (Scored)
* [`secure_linux_cis::rules::ensure_ip6tables_default_deny_firewall_policy`](#secure_linux_cisrulesensure_ip6tables_default_deny_firewall_policy): Ensure iptables is installed (Scored)
* [`secure_linux_cis::rules::ensure_ip6tables_is_enabled_and_active`](#secure_linux_cisrulesensure_ip6tables_is_enabled_and_active): Ensure iptables is installed (Scored)
* [`secure_linux_cis::rules::ensure_iptables_is_not_enabled`](#secure_linux_cisrulesensure_iptables_is_not_enabled): Ensure iptables is not enabled
* [`secure_linux_cis::rules::ensure_ipv6_firewall_rules_exist_for_all_open_ports`](#secure_linux_cisrulesensure_ipv6_firewall_rules_exist_for_all_open_ports): Ensure firewall rules exist for all open ports (Scored)
* [`secure_linux_cis::rules::ensure_ipv6_is_disabled`](#secure_linux_cisrulesensure_ipv6_is_disabled): Ensure IPv6 is disabled (Not Scored)
* [`secure_linux_cis::rules::ensure_ipv6_outbound_and_established_connections_are_configured`](#secure_linux_cisrulesensure_ipv6_outbound_and_established_connections_are_configured): Ensure outbound and established connections are configured (Not Scored)
* [`secure_linux_cis::rules::ensure_ipv6_redirects_are_not_accepted`](#secure_linux_cisrulesensure_ipv6_redirects_are_not_accepted): Ensure IPv6 redirects are not accepted (Not Scored)
* [`secure_linux_cis::rules::ensure_ipv6_router_advertisements_are_not_accepted`](#secure_linux_cisrulesensure_ipv6_router_advertisements_are_not_accepted): Ensure IPv6 router advertisements are not accepted (Not Scored)
* [`secure_linux_cis::rules::ensure_logrotate_is_configured`](#secure_linux_cisrulesensure_logrotate_is_configured): Ensure logrotate is configured (Not Scored)
* [`secure_linux_cis::rules::ensure_minimum_days_between_password_changes_is_7_or_more`](#secure_linux_cisrulesensure_minimum_days_between_password_changes_is_7_or_more): Ensure minimum days between password changes is 7 or more (Scored)
* [`secure_linux_cis::rules::ensure_mounting_of_fat_filesystems_is_disabled`](#secure_linux_cisrulesensure_mounting_of_fat_filesystems_is_disabled): Ensure mounting of FAT filesystems is disabled (Scored)
* [`secure_linux_cis::rules::ensure_mounting_of_jffs2_filesystems_is_disabled`](#secure_linux_cisrulesensure_mounting_of_jffs2_filesystems_is_disabled): Ensure mounting of jffs2 filesystems is disabled (Scored)
* [`secure_linux_cis::rules::ensure_mounting_of_vfat_filesystems_is_limited`](#secure_linux_cisrulesensure_mounting_of_vfat_filesystems_is_limited): Ensure mounting of FAT filesystems is disabled (Scored)
* [`secure_linux_cis::rules::ensure_nfs_and_rpc_are_not_enabled`](#secure_linux_cisrulesensure_nfs_and_rpc_are_not_enabled): Ensure NFS and RPC are not enabled (Scored)
* [`secure_linux_cis::rules::ensure_nftables_is_not_installed_with_firewalld`](#secure_linux_cisrulesensure_nftables_is_not_installed_with_firewalld): Ensure nftables base chains exist
* [`secure_linux_cis::rules::ensure_outbound_and_established_connections_are_configured`](#secure_linux_cisrulesensure_outbound_and_established_connections_are_configured): Ensure outbound and established connections are configured (Not Scored)
* [`secure_linux_cis::rules::ensure_package_manager_repositories_are_configured`](#secure_linux_cisrulesensure_package_manager_repositories_are_configured): Ensure package manager repositories are configured (Not Scored)
* [`secure_linux_cis::rules::ensure_password_expiration_is_365_days_or_less`](#secure_linux_cisrulesensure_password_expiration_is_365_days_or_less): Ensure password expiration is 365 days or less (Scored)
* [`secure_linux_cis::rules::ensure_password_expiration_warning_days_is_7_or_more`](#secure_linux_cisrulesensure_password_expiration_warning_days_is_7_or_more): Ensure password expiration warning days is 7 or more (Scored)
* [`secure_linux_cis::rules::ensure_permissions_on_etc_cron_tab_are_configured`](#secure_linux_cisrulesensure_permissions_on_etc_cron_tab_are_configured): Ensure permissions on /etc/cron.d are configured (Scored)
* [`secure_linux_cis::rules::ensure_permissions_on_etc_group_dash_are_configured`](#secure_linux_cisrulesensure_permissions_on_etc_group_dash_are_configured): Ensure permissions on /etc/group- are configured (Scored)
* [`secure_linux_cis::rules::ensure_permissions_on_etc_gshadow__are_configured`](#secure_linux_cisrulesensure_permissions_on_etc_gshadow__are_configured): Ensure permissions on /etc/gshadow- are configured (Scored)
* [`secure_linux_cis::rules::ensure_ssh_loglevel_is_set_to_info`](#secure_linux_cisrulesensure_ssh_loglevel_is_set_to_info): Ensure SSH LogLevel is set to INFO (Scored)

#### Private Classes

* `secure_linux_cis::reboot`: A short summary of the purpose of this class
* `secure_linux_cis::rules::disable_automounting`: Disable Automounting
* `secure_linux_cis::rules::disable_the_rhnsd_daemon`: Disable the rhnsd Daemon
* `secure_linux_cis::rules::disable_usb_storage`: Disable USB Storage
* `secure_linux_cis::rules::ensure_a_nftables_table_exists`: Ensure a nftables table exists
* `secure_linux_cis::rules::ensure_a_single_time_synchronization_daemon_is_in_use`: Ensure a single time synchronization daemon is in use
* `secure_linux_cis::rules::ensure_a_table_exists`: Ensure a table exists
* `secure_linux_cis::rules::ensure_a_web_server_is_not_installed`: Ensure a web server is not installed
* `secure_linux_cis::rules::ensure_access_to_the_su_command_is_restricted`: Ensure access to the su command is restricted
* `secure_linux_cis::rules::ensure_accounts_in_etc_passwd_use_shadowed_passwords`: Ensure accounts in /etc/passwd use shadowed passwords
* `secure_linux_cis::rules::ensure_actions_as_another_user_are_always_logged`: Ensure actions as another user are always logged
* `secure_linux_cis::rules::ensure_address_space_layout_randomization_aslr_is_enabled`: Ensure address space layout randomization (ASLR) is   enabled
* `secure_linux_cis::rules::ensure_aide_is_installed`: Ensure AIDE is installed
* `secure_linux_cis::rules::ensure_all_apparmor_profiles_are_enforcing`: Ensure all AppArmor Profiles are enforcing
* `secure_linux_cis::rules::ensure_all_apparmor_profiles_are_in_enforce_or_complain_mode`: Ensure all AppArmor Profiles are in enforce or complain mode
* `secure_linux_cis::rules::ensure_all_groups_in_etc_passwd_exist_in_etc_group`: Ensure all groups in /etc/passwd exist in /etc/group
* `secure_linux_cis::rules::ensure_all_logfiles_have_appropriate_permissions_and_ownership`: Ensure all logfiles have appropriate permissions and ownership
* `secure_linux_cis::rules::ensure_all_users_home_directories_exist`: Ensure all users' home directories exist
* `secure_linux_cis::rules::ensure_all_users_last_password_change_date_is_in_the_past`: Ensure all users last password change date is in the past
* `secure_linux_cis::rules::ensure_apparmor_is_enabled_in_the_bootloader_configuration`: Ensure AppArmor is enabled in the bootloader configuration
* `secure_linux_cis::rules::ensure_apparmor_is_installed`: Ensure AppArmor is installed
* `secure_linux_cis::rules::ensure_at_is_restricted_to_authorized_users`: Ensure at is restricted to authorized users
* `secure_linux_cis::rules::ensure_audit_backlog_limit_is_sufficient`: Ensure audit_backlog_limit is sufficient
* `secure_linux_cis::rules::ensure_audit_configuration_files_are_owned_by_root`: Ensure audit configuration files are owned by root
* `secure_linux_cis::rules::ensure_audit_configuration_files_belong_to_group_root`: Ensure audit configuration files belong to group root
* `secure_linux_cis::rules::ensure_audit_log_storage_size_is_configured`: Ensure audit log storage size is configured
* `secure_linux_cis::rules::ensure_audit_logs_are_not_automatically_deleted`: Ensure audit logs are not automatically deleted
* `secure_linux_cis::rules::ensure_audit_tools_are_owned_by_root`: Ensure audit tools are owned by root
* `secure_linux_cis::rules::ensure_audit_tools_belong_to_group_root`: Ensure audit tools belong to group root
* `secure_linux_cis::rules::ensure_auditd_is_installed`: Ensure auditd is installed
* `secure_linux_cis::rules::ensure_auditd_service_is_enabled`: Ensure auditd service is enabled
* `secure_linux_cis::rules::ensure_auditd_service_is_enabled_and_active`: Ensure auditd service is enabled and active
* `secure_linux_cis::rules::ensure_auditd_service_is_enabled_and_running`: Ensure auditd service is enabled and running
* `secure_linux_cis::rules::ensure_auditing_for_processes_that_start_prior_to_auditd_is_enabled`: Ensure auditing for processes that start prior to auditd is enabled
* `secure_linux_cis::rules::ensure_augenrules_is_enabled`: Ensure augenrules is enabled
* `secure_linux_cis::rules::ensure_authentication_is_required_when_booting_into_rescue_mode`: Ensure authentication is required when booting into rescue mode
* `secure_linux_cis::rules::ensure_authentication_required_for_single_user_mode`: Ensure authentication required for single user mode
* `secure_linux_cis::rules::ensure_authselect_includes_with_faillock`: Ensure authselect includes with-faillock
* `secure_linux_cis::rules::ensure_automatic_error_reporting_is_not_enabled`: Ensure Automatic Error Reporting is not enabled
* `secure_linux_cis::rules::ensure_automatic_mounting_of_removable_media_is_disabled`: Ensure automatic mounting of removable media is disabled
* `secure_linux_cis::rules::ensure_avahi_server_is_not_installed`: Ensure Avahi Server is not installed
* `secure_linux_cis::rules::ensure_base_chains_exist`: Ensure base chains exist
* `secure_linux_cis::rules::ensure_bogus_icmp_responses_are_ignored`: Ensure bogus ICMP responses are ignored
* `secure_linux_cis::rules::ensure_bootloader_password_is_set`: Ensure bootloader password is set
* `secure_linux_cis::rules::ensure_broadcast_icmp_requests_are_ignored`: Ensure broadcast ICMP requests are ignored
* `secure_linux_cis::rules::ensure_changes_to_system_administration_scope_sudoers_is_collected`: Ensure changes to system administration scope (sudoers) is collected
* `secure_linux_cis::rules::ensure_chargen_services_are_not_enabled`: Ensure chargen services are not enabled
* `secure_linux_cis::rules::ensure_chrony_is_configured`: Ensure chrony is configured
* `secure_linux_cis::rules::ensure_chrony_is_enabled_and_running`: Ensure chrony is enabled and running
* `secure_linux_cis::rules::ensure_chrony_is_running_as_user_chrony`: Ensure chrony is running as user _chrony
* `secure_linux_cis::rules::ensure_core_dump_backtraces_are_disabled`: Ensure core dump backtraces are disabled
* `secure_linux_cis::rules::ensure_core_dump_storage_is_disabled`: Ensure core dump storage is disabled
* `secure_linux_cis::rules::ensure_core_dumps_are_restricted`: Ensure core dumps are restricted
* `secure_linux_cis::rules::ensure_cron_daemon_is_enabled`: Ensure cron daemon is enabled
* `secure_linux_cis::rules::ensure_cron_daemon_is_enabled_and_running`: Ensure cron daemon is enabled and running
* `secure_linux_cis::rules::ensure_cron_is_restricted_to_authorized_users`: Ensure cron is restricted to authorized users
* `secure_linux_cis::rules::ensure_cryptographic_mechanisms_are_used_to_protect_the_integrity_of_audit_tools`: Ensure cryptographic mechanisms are used to protect   the integrity of audit tools
* `secure_linux_cis::rules::ensure_cups_is_not_installed`: Ensure CUPS is not installed
* `secure_linux_cis::rules::ensure_daytime_services_are_not_enabled`: Ensure daytime services are not enabled
* `secure_linux_cis::rules::ensure_dccp_is_disabled`: Ensure DCCP is disabled
* `secure_linux_cis::rules::ensure_default_deny_firewall_policy`: Ensure default deny firewall policy
* `secure_linux_cis::rules::ensure_default_user_shell_timeout_is_configured`: Ensure default user shell timeout is configured
* `secure_linux_cis::rules::ensure_default_user_umask_is_configured`: Ensure default user umask is configured
* `secure_linux_cis::rules::ensure_default_zone_is_set`: Ensure default zone is set
* `secure_linux_cis::rules::ensure_dev_shm_is_configured`: Ensure /dev/shm is configured
* `secure_linux_cis::rules::ensure_dhcp_server_is_not_installed`: Ensure DHCP Server is not installed
* `secure_linux_cis::rules::ensure_disable_user_list_is_enabled`: Ensure disable-user-list is enabled
* `secure_linux_cis::rules::ensure_discard_services_are_not_enabled`: Ensure discard services are not enabled
* `secure_linux_cis::rules::ensure_discretionary_access_control_permission_modification_events_are_collected`: Ensure discretionary access control permission modification events are collected
* `secure_linux_cis::rules::ensure_dns_server_is_not_installed`: Ensure DNS Server is not installed
* `secure_linux_cis::rules::ensure_echo_services_are_not_enabled`: Ensure echo services are not enabled
* `secure_linux_cis::rules::ensure_etc_hosts_allow_is_configured`: Ensure /etc/hosts.allow is configured
* `secure_linux_cis::rules::ensure_etc_hosts_deny_is_configured`: Ensure /etc/hosts.deny is configured
* `secure_linux_cis::rules::ensure_etc_shadow_password_fields_are_not_empty`: Ensure /etc/shadow password fields are not empty  
* `secure_linux_cis::rules::ensure_events_that_modify_date_and_time_information_are_collected`: Ensure events that modify date and time information are collected
* `secure_linux_cis::rules::ensure_events_that_modify_the_sudo_log_file_are_collected`: Ensure events that modify the sudo log file are collected
* `secure_linux_cis::rules::ensure_events_that_modify_the_systems_mandatory_access_controls_are_collected`: Ensure events that modify the system's Mandatory Access Controls are collected
* `secure_linux_cis::rules::ensure_events_that_modify_the_systems_network_environment_are_collected`: Ensure events that modify the system's network   environment are collected
* `secure_linux_cis::rules::ensure_events_that_modify_user_group_information_are_collected`: Ensure events that modify user/group information are collected
* `secure_linux_cis::rules::ensure_file_deletion_events_by_users_are_collected`: Ensure file deletion events by users are collected
* `secure_linux_cis::rules::ensure_filesystem_integrity_is_regularly_checked`: Ensure filesystem integrity is regularly checked
* `secure_linux_cis::rules::ensure_firewall_rules_exist_for_all_open_ports`: Ensure firewall rules exist for all open ports
* `secure_linux_cis::rules::ensure_firewalld_is_either_not_installed_or_masked_with_iptables`: Ensure firewalld is either not installed or masked with iptables
* `secure_linux_cis::rules::ensure_firewalld_is_installed`: Ensure firewalld is installed
* `secure_linux_cis::rules::ensure_firewalld_is_not_installed_or_stopped_and_masked`: Ensure firewalld is not installed or stopped and masked
* `secure_linux_cis::rules::ensure_firewalld_service_enabled_and_running`: Ensure firewalld service enabled and running
* `secure_linux_cis::rules::ensure_firewalld_service_is_enabled_and_running`: Ensure firewalld service is enabled and running
* `secure_linux_cis::rules::ensure_ftp_client_is_not_installed`: Ensure FTP client is not installed
* `secure_linux_cis::rules::ensure_ftp_server_is_not_installed`: Ensure FTP Server is not installed
* `secure_linux_cis::rules::ensure_gdm_automatic_mounting_of_removable_media_is_disabled`: Ensure GDM automatic mounting of removable media is disabled
* `secure_linux_cis::rules::ensure_gdm_autorun_never_is_enabled`: Ensure GDM autorun-never is enabled
* `secure_linux_cis::rules::ensure_gdm_autorun_never_is_not_overridden`: Ensure GDM autorun-never is not overridden
* `secure_linux_cis::rules::ensure_gdm_disable_user_list_option_is_enabled`: Ensure GDM disable-user-list option is enabled
* `secure_linux_cis::rules::ensure_gdm_disabling_automatic_mounting_of_removable_media_is_not_overridden`: Ensure GDM disabling automatic mounting of removable media is not overridden
* `secure_linux_cis::rules::ensure_gdm_is_removed_or_login_is_configured`: Ensure GDM is removed or login is configured
* `secure_linux_cis::rules::ensure_gdm_login_banner_is_configured`: Ensure GDM login banner is configured
* `secure_linux_cis::rules::ensure_gdm_screen_locks_cannot_be_overridden`: Ensure GDM screen locks cannot be overridden
* `secure_linux_cis::rules::ensure_gdm_screen_locks_when_the_user_is_idle`: Ensure GDM screen locks when the user is idle
* `secure_linux_cis::rules::ensure_gnome_display_manager_is_removed`: Ensure GNOME Display Manager is removed
* `secure_linux_cis::rules::ensure_gpgcheck_is_globally_activated`: Ensure gpgcheck is globally activated
* `secure_linux_cis::rules::ensure_grpquota_option_set_on_home_partition`: Ensure grpquota option set on /home partition
* `secure_linux_cis::rules::ensure_home_partition_includes_the_nodev_option`: Ensure /home partition includes the nodev option
* `secure_linux_cis::rules::ensure_http_proxy_server_is_not_installed`: Ensure HTTP Proxy Server is not installed
* `secure_linux_cis::rules::ensure_http_server_is_not_installed`: Ensure HTTP server is not installed
* `secure_linux_cis::rules::ensure_icmp_redirects_are_not_accepted`: Ensure ICMP redirects are not accepted
* `secure_linux_cis::rules::ensure_imap_and_pop3_server_are_not_installed`: 1 Ensure IMAP and POP3 server is not enabled (Scored)
* `secure_linux_cis::rules::ensure_imap_and_pop3_server_is_not_installed`: 1 Ensure IMAP and POP3 server is not enabled (Scored)
* `secure_linux_cis::rules::ensure_interactive_boot_is_not_enabled`: Ensure interactive boot is not enabled
* `secure_linux_cis::rules::ensure_ip_forwarding_is_disabled`: Ensure IP forwarding is disabled
* `secure_linux_cis::rules::ensure_iptables_default_deny_firewall_policy`: Ensure iptables default deny firewall policy
* `secure_linux_cis::rules::ensure_iptables_firewall_rules_exist_for_all_open_ports`: Ensure iptables firewall rules exist for all open ports  
* `secure_linux_cis::rules::ensure_iptables_is_enabled_and_active`: Ensure iptables is enabled and active
* `secure_linux_cis::rules::ensure_iptables_is_enabled_and_running`: Ensure iptables is enabled and running
* `secure_linux_cis::rules::ensure_iptables_is_installed`: Ensure iptables is installed
* `secure_linux_cis::rules::ensure_iptables_loopback_traffic_is_configured`: Ensure iptables loopback traffic is configured
* `secure_linux_cis::rules::ensure_iptables_package_is_installed`: Ensure iptables package is installed
* `secure_linux_cis::rules::ensure_iptables_packages_are_installed`: Ensure iptables packages are installed
* `secure_linux_cis::rules::ensure_iptables_persistent_is_not_installed_with_ufw`: Ensure iptables-persistent is not installed with ufw
* `secure_linux_cis::rules::ensure_iptables_rules_are_saved`: Ensure iptables rules are saved
* `secure_linux_cis::rules::ensure_iptables_rules_exist_for_all_open_ports`: Ensure iptables rules exist for all open ports
* `secure_linux_cis::rules::ensure_iptables_services_not_installed_with_firewalld`: Ensure iptables-services not installed with firewalld  
* `secure_linux_cis::rules::ensure_ipv6_loopback_traffic_is_configured`: Ensure IPv6 loopback traffic is configured (Scored)
* `secure_linux_cis::rules::ensure_journald_is_configured_to_compress_large_log_files`: Ensure journald is configured to compress large log files
* `secure_linux_cis::rules::ensure_journald_is_configured_to_send_logs_to_rsyslog`: Ensure journald is configured to send logs to rsyslog
* `secure_linux_cis::rules::ensure_journald_is_configured_to_write_logfiles_to_persistent_disk`: Ensure journald is configured to write logfiles to persistent disk
* `secure_linux_cis::rules::ensure_journald_is_not_configured_to_receive_logs_from_a_remote_client`: Ensure journald is not configured to receive logs from a remote client
* `secure_linux_cis::rules::ensure_journald_is_not_configured_to_recieve_logs_from_a_remote_client`: Ensure journald is not configured to recieve logs from a remote client
* `secure_linux_cis::rules::ensure_journald_service_is_enabled`: Ensure journald service is enabled
* `secure_linux_cis::rules::ensure_kernel_module_loading_and_unloading_is_collected`: Ensure kernel module loading and unloading is collected
* `secure_linux_cis::rules::ensure_kernel_module_loading_unloading_and_modification_is_collected`: Ensure kernel module loading unloading and   modification is collected
* `secure_linux_cis::rules::ensure_last_logged_in_user_display_is_disabled`: Ensure last logged in user display is disabled
* `secure_linux_cis::rules::ensure_ldap_client_is_not_installed`: Ensure LDAP client is not installed
* `secure_linux_cis::rules::ensure_ldap_server_is_not_installed`: Ensure LDAP server is not installed
* `secure_linux_cis::rules::ensure_local_interactive_user_dot_files_are_not_group_or_world_writable`: Ensure local interactive user dot files are not group or  world writable
* `secure_linux_cis::rules::ensure_local_interactive_user_home_directories_exist`: Ensure local interactive user home directories exist
* `secure_linux_cis::rules::ensure_local_interactive_users_own_their_home_directories`: Ensure local interactive users own their home directories
* `secure_linux_cis::rules::ensure_local_login_warning_banner_is_configured_properly`: Ensure local login warning banner is configured properly
* `secure_linux_cis::rules::ensure_lockout_for_failed_password_attempts_is_configured`: Ensure lockout for failed password attempts is   configured
* `secure_linux_cis::rules::ensure_login_and_logout_events_are_collected`: Ensure login and logout events are collected
* `secure_linux_cis::rules::ensure_logrotate_assigns_appropriate_permissions`: Ensure logrotate assigns appropriate permissions
* `secure_linux_cis::rules::ensure_loopback_traffic_is_configured`: Ensure loopback traffic is configured
* `secure_linux_cis::rules::ensure_mail_transfer_agent_is_configured_for_local_only_mode`: Ensure mail transfer agent is configured for local-only mode
* `secure_linux_cis::rules::ensure_message_of_the_day_is_configured_properly`: Ensure message of the day is configured properly
* `secure_linux_cis::rules::ensure_minimum_days_between_password_changes_is_configured`: Ensure minimum days between password changes is configured
* `secure_linux_cis::rules::ensure_mounting_of_cramfs_filesystems_is_disabled`: Ensure mounting of cramfs filesystems is disabled
* `secure_linux_cis::rules::ensure_mounting_of_fat_filesystems_is_limited`: Ensure mounting of FAT filesystems is limited
* `secure_linux_cis::rules::ensure_mounting_of_freevxfs_filesystems_is_disabled`: Ensure mounting of freevxfs filesystems is disabled
* `secure_linux_cis::rules::ensure_mounting_of_hfs_filesystems_is_disabled`: Ensure mounting of hfs filesystems is disabled
* `secure_linux_cis::rules::ensure_mounting_of_hfsplus_filesystems_is_disabled`: Ensure mounting of hfsplus filesystems is disabled
* `secure_linux_cis::rules::ensure_mounting_of_squashfs_filesystems_is_disabled`: Ensure mounting of squashfs filesystems is disabled
* `secure_linux_cis::rules::ensure_mounting_of_udf_filesystems_is_disabled`: Ensure mounting of udf filesystems is disabled
* `secure_linux_cis::rules::ensure_net_snmp_is_not_installed`: Ensure net-snmp is not installed
* `secure_linux_cis::rules::ensure_nfs_is_not_installed`: Ensure NFS is not installed
* `secure_linux_cis::rules::ensure_nfs_utils_is_not_installed_or_the_nfs_server_service_is_disabled`: Ensure nfs-utils is not installed or the nfs-server service is disabled
* `secure_linux_cis::rules::ensure_nfs_utils_is_not_installed_or_the_nfs_server_service_is_masked`: Ensure nfs-utils is not installed or the nfs-server service is masked
* `secure_linux_cis::rules::ensure_nftables_base_chains_exist`: Ensure nftables base chains exist
* `secure_linux_cis::rules::ensure_nftables_default_deny_firewall_policy`: Ensure nftables default deny firewall policy
* `secure_linux_cis::rules::ensure_nftables_is_installed`: Ensure nftables is installed
* `secure_linux_cis::rules::ensure_nftables_is_not_installed`: Ensure nftables is not installed
* `secure_linux_cis::rules::ensure_nftables_is_not_installed_or_stopped_and_masked`: Ensure nftables is not installed or stopped and masked
* `secure_linux_cis::rules::ensure_nftables_is_not_installed_with_iptables`: Ensure nftables is not installed with iptables
* `secure_linux_cis::rules::ensure_nftables_loopback_traffic_is_configured`: Ensure nftables loopback traffic is configured
* `secure_linux_cis::rules::ensure_nftables_rules_are_permanent`: Ensure nftables rules are permanent
* `secure_linux_cis::rules::ensure_nftables_service_is_enabled`: Ensure nftables service is enabled
* `secure_linux_cis::rules::ensure_nis_client_is_not_installed`: Ensure NIS Client is not installed
* `secure_linux_cis::rules::ensure_nis_server_is_not_enabled`: 6 Ensure NIS Server is not enabled (Scored)
* `secure_linux_cis::rules::ensure_nis_server_is_not_installed`: Ensure NIS Server is not installed
* `secure_linux_cis::rules::ensure_no_duplicate_gids_exist`: Ensure no duplicate GIDs exist
* `secure_linux_cis::rules::ensure_no_duplicate_group_names_exist`: Ensure no duplicate group names exist
* `secure_linux_cis::rules::ensure_no_duplicate_uids_exist`: Ensure no duplicate UIDs exist
* `secure_linux_cis::rules::ensure_no_duplicate_user_names_exist`: Ensure no duplicate user names exist
* `secure_linux_cis::rules::ensure_no_legacy_entries_exist_in_etc_group`: Ensure no legacy "+" entries exist in /etc/group
* `secure_linux_cis::rules::ensure_no_legacy_entries_exist_in_etc_passwd`: Ensure no legacy "+" entries exist in /etc/passwd
* `secure_linux_cis::rules::ensure_no_legacy_entries_exist_in_etc_shadow`: Ensure no legacy "+" entries exist in /etc/shadow
* `secure_linux_cis::rules::ensure_no_local_interactive_user_has_forward_files`: Ensure no local interactive user has .forward files
* `secure_linux_cis::rules::ensure_no_local_interactive_user_has_netrc_files`: Ensure no local interactive user has .netrc files
* `secure_linux_cis::rules::ensure_no_local_interactive_user_has_rhosts_files`: Ensure no local interactive user has .rhosts files
* `secure_linux_cis::rules::ensure_no_unconfined_daemons_exist`: Ensure no unconfined daemons exist
* `secure_linux_cis::rules::ensure_no_unconfined_services_exist`: Ensure no unconfined services exist
* `secure_linux_cis::rules::ensure_no_ungrouped_files_or_directories_exist`: Ensure no ungrouped files or directories exist
* `secure_linux_cis::rules::ensure_no_unowned_files_or_directories_exist`: Ensure no unowned files or directories exist
* `secure_linux_cis::rules::ensure_no_users_have_forward_files`: Ensure no users have .forward files
* `secure_linux_cis::rules::ensure_no_users_have_netrc_files`: Ensure no users have .netrc files
* `secure_linux_cis::rules::ensure_no_users_have_rhosts_files`: Ensure no users have .rhosts files
* `secure_linux_cis::rules::ensure_no_world_writable_files_exist`: Ensure no world writable files exist
* `secure_linux_cis::rules::ensure_nodev_option_set_on_dev_shm_partition`: Ensure nodev option set on /dev/shm partition
* `secure_linux_cis::rules::ensure_nodev_option_set_on_home_partition`: Ensure nodev option set on /home partition
* `secure_linux_cis::rules::ensure_nodev_option_set_on_removable_media_partitions`: Ensure nodev option set on removable media partitions
* `secure_linux_cis::rules::ensure_nodev_option_set_on_tmp_partition`: Ensure nodev option set on /tmp partition
* `secure_linux_cis::rules::ensure_nodev_option_set_on_var_log_audit_partition`: Ensure nodev option set on /var/log/audit partition
* `secure_linux_cis::rules::ensure_nodev_option_set_on_var_log_partition`: Ensure nodev option set on /var/log partition
* `secure_linux_cis::rules::ensure_nodev_option_set_on_var_partition`: Ensure nodev option set on /var partition
* `secure_linux_cis::rules::ensure_nodev_option_set_on_var_tmp_partition`: Ensure nodev option set on /var/tmp partition
* `secure_linux_cis::rules::ensure_noexec_option_set_on_dev_shm_partition`: Ensure noexec option set on /dev/shm partition
* `secure_linux_cis::rules::ensure_noexec_option_set_on_home_partition`: 7 Ensure noexec option set on /home partition (Scored)
* `secure_linux_cis::rules::ensure_noexec_option_set_on_removable_media_partitions`: 0 Ensure noexec option set on removable media partitions (Not Scored)
* `secure_linux_cis::rules::ensure_noexec_option_set_on_tmp_partition`: Ensure noexec option set on /tmp partition
* `secure_linux_cis::rules::ensure_noexec_option_set_on_var_log_audit_partition`: Ensure noexec option set on /var/log/audit partition
* `secure_linux_cis::rules::ensure_noexec_option_set_on_var_log_partition`: Ensure noexec option set on /var/log partition
* `secure_linux_cis::rules::ensure_noexec_option_set_on_var_partition`: Ensure noexec option set on /var partition
* `secure_linux_cis::rules::ensure_noexec_option_set_on_var_tmp_partition`: Ensure noexec option set on /var/tmp partition  
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_dev_shm_partition`: Ensure nosuid option set on /dev/shm partition
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_home_partition`: Ensure nosuid option set on /home partition
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_removable_media_partitions`: Ensure nosuid option set on removable media partitions
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_tmp_partition`: Ensure nosuid option set on /tmp partition
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_var_log_audit_partition`: Ensure nosuid option set on /var/log/audit partition
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_var_log_partition`: Ensure nosuid option set on /var/log partition
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_var_partition`: Ensure nosuid option set on /var partition
* `secure_linux_cis::rules::ensure_nosuid_option_set_on_var_tmp_partition`: Ensure nosuid option set on /var/tmp partition
* `secure_linux_cis::rules::ensure_ntp_access_control_is_configured`: Ensure ntp access control is configured
* `secure_linux_cis::rules::ensure_ntp_is_configured`: Ensure ntp is configured
* `secure_linux_cis::rules::ensure_ntp_is_enabled_and_running`: Ensure ntp is enabled and running
* `secure_linux_cis::rules::ensure_ntp_is_running_as_user_ntp`: Ensure ntp is running as user ntp
* `secure_linux_cis::rules::ensure_only_authorized_groups_are_assigned_ownership_of_audit_log_files`: Ensure only authorized groups are assigned ownership of audit log files
* `secure_linux_cis::rules::ensure_only_authorized_users_own_audit_log_files`: Ensure only authorized users own audit log files
* `secure_linux_cis::rules::ensure_only_strong_ciphers_are_used`: Ensure only strong Ciphers are used
* `secure_linux_cis::rules::ensure_only_strong_key_exchange_algorithms_are_used`: Ensure only strong Key Exchange algorithms are used
* `secure_linux_cis::rules::ensure_only_strong_mac_algorithms_are_used`: Ensure only strong MAC algorithms are used
* `secure_linux_cis::rules::ensure_packet_redirect_sending_is_disabled`: Ensure packet redirect sending is disabled
* `secure_linux_cis::rules::ensure_password_creation_requirements_are_configured`: Ensure password creation requirements are configured
* `secure_linux_cis::rules::ensure_password_fields_are_not_empty`: Ensure password fields are not empty
* `secure_linux_cis::rules::ensure_password_hashing_algorithm_is_up_to_date_with_the_latest_standards`: Ensure password hashing algorithm is up to date with the latest standards
* `secure_linux_cis::rules::ensure_password_reuse_is_limited`: Ensure password reuse is limited
* `secure_linux_cis::rules::ensure_permissions_on_all_logfiles_are_configured`: Ensure permissions on all logfiles are configured
* `secure_linux_cis::rules::ensure_permissions_on_bootloader_config_are_configured`: Ensure permissions on bootloader config are configured
* `secure_linux_cis::rules::ensure_permissions_on_bootloader_config_are_not_overridden`: Ensure permissions on bootloader config are not overridden
* `secure_linux_cis::rules::ensure_permissions_on_etc_cron_d_are_configured`: Ensure permissions on /etc/cron.d are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_cron_daily_are_configured`: Ensure permissions on /etc/cron.daily are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_cron_hourly_are_configured`: Ensure permissions on /etc/cron.hourly are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_cron_monthly_are_configured`: Ensure permissions on /etc/cron.monthly are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_cron_weekly_are_configured`: Ensure permissions on /etc/cron.weekly are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_crontab_are_configured`: Ensure permissions on /etc/crontab are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_group_are_configured`: Ensure permissions on /etc/group are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_gshadow_are_configured`: Ensure permissions on /etc/gshadow are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_gshadow_dash_are_configured`: Ensure permissions on /etc/gshadow- are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_hosts_allow_are_configured`: Ensure permissions on /etc/hosts.allow are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_hosts_deny_are_configured`: Ensure permissions on /etc/hosts.deny are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_issue_are_configured`: Ensure permissions on /etc/issue are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_issue_net_are_configured`: Ensure permissions on /etc/issue.net are configured  
* `secure_linux_cis::rules::ensure_permissions_on_etc_motd_are_configured`: Ensure permissions on /etc/motd are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_passwd_are_configured`: Ensure permissions on /etc/passwd are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_passwd_dash_are_configured`: Ensure permissions on /etc/group- are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_shadow_are_configured`: Ensure permissions on /etc/shadow are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_shadow_dash_are_configured`: Ensure permissions on /etc/shadow- are configured
* `secure_linux_cis::rules::ensure_permissions_on_etc_ssh_sshd_config_are_configured`: Ensure permissions on /etc/ssh/sshd_config are configured
* `secure_linux_cis::rules::ensure_permissions_on_ssh_private_host_key_files_are_configured`: Ensure permissions on SSH private host key files are configured
* `secure_linux_cis::rules::ensure_permissions_on_ssh_public_host_key_files_are_configured`: Ensure permissions on SSH public host key files are configured
* `secure_linux_cis::rules::ensure_prelink_is_disabled`: Ensure prelink is disabled
* `secure_linux_cis::rules::ensure_prelink_is_not_installed`: Ensure prelink is not installed
* `secure_linux_cis::rules::ensure_rds_is_disabled`: Ensure RDS is disabled
* `secure_linux_cis::rules::ensure_re_authentication_for_privilege_escalation_is_not_disabled_globally`: Ensure re-authentication for privilege escalation is not disabled globally
* `secure_linux_cis::rules::ensure_remote_login_warning_banner_is_configured_properly`: Ensure remote login warning banner is configured properly
* `secure_linux_cis::rules::ensure_removable_media_partitions_include_noexec_option`: Ensure removable media partitions include noexec option
* `secure_linux_cis::rules::ensure_reverse_path_filtering_is_enabled`: Ensure Reverse Path Filtering is enabled
* `secure_linux_cis::rules::ensure_root_path_integrity`: Ensure root PATH Integrity
* `secure_linux_cis::rules::ensure_rpc_is_not_installed`: Ensure RPC is not installed
* `secure_linux_cis::rules::ensure_rpcbind_is_not_installed_or_the_rpcbind_service_is_disabled`: Ensure rpcbind is not installed or the rpcbind service is disabled
* `secure_linux_cis::rules::ensure_rpcbind_is_not_installed_or_the_rpcbind_services_are_masked`: Ensure rpcbind is not installed or the rpcbind services are masked
* `secure_linux_cis::rules::ensure_rsh_client_is_not_installed`: Ensure rsh client is not installed
* `secure_linux_cis::rules::ensure_rsh_server_is_not_enabled`: Ensure rsh server is not enabled
* `secure_linux_cis::rules::ensure_rsync_daemon_is_not_installed_or_the_rsyncd_service_is_masked`: Ensure rsync-daemon is not installed or the rsyncd service is masked
* `secure_linux_cis::rules::ensure_rsync_is_not_installed_or_the_rsyncd_service_is_masked`: Ensure rsync is not installed or the rsyncd service is masked
* `secure_linux_cis::rules::ensure_rsync_service_is_either_not_installed_or_masked`: Ensure rsync service is either not installed or masked
* `secure_linux_cis::rules::ensure_rsync_service_is_not_enabled`: Ensure rsync service is not enabled
* `secure_linux_cis::rules::ensure_rsync_service_is_not_installed`: Ensure rsync service is not installed
* `secure_linux_cis::rules::ensure_rsyslog_default_file_permissions_are_configured`: Ensure rsyslog default file permissions are configured  
* `secure_linux_cis::rules::ensure_rsyslog_default_file_permissions_configured`: Ensure rsyslog default file permissions configured
* `secure_linux_cis::rules::ensure_rsyslog_is_configured_to_send_logs_to_a_remote_log_host`: Ensure rsyslog is configured to send logs to a remote log   host
* `secure_linux_cis::rules::ensure_rsyslog_is_installed`: Ensure rsyslog is installed
* `secure_linux_cis::rules::ensure_rsyslog_is_not_configured_to_receive_logs_from_a_remote_client`: Ensure rsyslog is not configured to receive logs from a remote client
* `secure_linux_cis::rules::ensure_rsyslog_is_not_configured_to_recieve_logs_from_a_remote_client`: Ensure rsyslog is not configured to recieve logs from a remote client
* `secure_linux_cis::rules::ensure_rsyslog_service_is_enabled`: Ensure rsyslog service is enabled
* `secure_linux_cis::rules::ensure_rsyslog_service_is_enabled_and_running`: Ensure rsyslog Service is enabled and running
* `secure_linux_cis::rules::ensure_samba_is_not_installed`: Ensure Samba is not installed
* `secure_linux_cis::rules::ensure_sctp_is_disabled`: Ensure SCTP is disabled
* `secure_linux_cis::rules::ensure_secure_icmp_redirects_are_not_accepted`: Ensure secure ICMP redirects are not accepted
* `secure_linux_cis::rules::ensure_selinux_is_installed`: Ensure SELinux is installed
* `secure_linux_cis::rules::ensure_selinux_is_not_disabled_in_bootloader_configuration`: Ensure SELinux is not disabled in bootloader configuration
* `secure_linux_cis::rules::ensure_selinux_policy_is_configured`: Ensure SELinux policy is configured
* `secure_linux_cis::rules::ensure_separate_partition_exists_for_home`: Ensure separate partition exists for /home
* `secure_linux_cis::rules::ensure_separate_partition_exists_for_var`: Ensure separate partition exists for /var
* `secure_linux_cis::rules::ensure_separate_partition_exists_for_var_log`: Ensure separate partition exists for /var/log
* `secure_linux_cis::rules::ensure_separate_partition_exists_for_var_log_audit`: Ensure separate partition exists for /var/log/audit
* `secure_linux_cis::rules::ensure_separate_partition_exists_for_var_tmp`: Ensure separate partition exists for /var/tmp
* `secure_linux_cis::rules::ensure_session_initiation_information_is_collected`: Ensure session initiation information is collected
* `secure_linux_cis::rules::ensure_setroubleshoot_is_not_installed`: Ensure SETroubleshoot is not installed
* `secure_linux_cis::rules::ensure_shadow_group_is_empty`: Ensure shadow group is empty
* `secure_linux_cis::rules::ensure_snmp_server_is_not_installed`: Ensure SNMP Server is not installed
* `secure_linux_cis::rules::ensure_source_routed_packets_are_not_accepted`: Ensure source routed packets are not accepted
* `secure_linux_cis::rules::ensure_ssh_access_is_limited`: Ensure SSH access is limited
* `secure_linux_cis::rules::ensure_ssh_allowtcpforwarding_is_disabled`: Ensure SSH AllowTcpForwarding is disabled
* `secure_linux_cis::rules::ensure_ssh_hostbasedauthentication_is_disabled`: Ensure SSH HostbasedAuthentication is disabled
* `secure_linux_cis::rules::ensure_ssh_idle_timeout_interval_is_configured`: Ensure SSH Idle Timeout Interval is configured
* `secure_linux_cis::rules::ensure_ssh_ignorerhosts_is_enabled`: Ensure SSH IgnoreRhosts is enabled
* `secure_linux_cis::rules::ensure_ssh_logingracetime_is_set_to_one_minute_or_less`: Ensure SSH LoginGraceTime is set to one minute or less
* `secure_linux_cis::rules::ensure_ssh_loglevel_is_appropriate`: Ensure SSH LogLevel is appropriate
* `secure_linux_cis::rules::ensure_ssh_maxsessions_is_limited`: Ensure SSH MaxSessions is limited
* `secure_linux_cis::rules::ensure_ssh_maxstartups_is_configured`: Ensure SSH MaxStartups is configured
* `secure_linux_cis::rules::ensure_ssh_pam_is_enabled`: Ensure SSH PAM is enabled
* `secure_linux_cis::rules::ensure_ssh_permitemptypasswords_is_disabled`: Ensure SSH PermitEmptyPasswords is disabled
* `secure_linux_cis::rules::ensure_ssh_permituserenvironment_is_disabled`: Ensure SSH PermitUserEnvironment is disabled
* `secure_linux_cis::rules::ensure_ssh_root_login_is_disabled`: Ensure SSH root login is disabled
* `secure_linux_cis::rules::ensure_ssh_warning_banner_is_configured`: Ensure SSH warning banner is configured
* `secure_linux_cis::rules::ensure_sticky_bit_is_set_on_all_world_writable_directories`: Ensure sticky bit is set on all world-writable directories
* `secure_linux_cis::rules::ensure_successful_and_unsuccessful_attempts_to_use_the_chacl_command_are_recorded`: Ensure successful and unsuccessful attempts to use the chacl command are recorded
* `secure_linux_cis::rules::ensure_successful_and_unsuccessful_attempts_to_use_the_chcon_command_are_recorded`: Ensure successful and unsuccessful attempts to use the chcon command are recorded
* `secure_linux_cis::rules::ensure_successful_and_unsuccessful_attempts_to_use_the_setfacl_command_are_recorded`: Ensure successful and unsuccessful attempts to use the setfacl command are recorded
* `secure_linux_cis::rules::ensure_successful_and_unsuccessful_attempts_to_use_the_usermod_command_are_recorded`: Ensure successful and unsuccessful attempts to use the usermod command are recorded
* `secure_linux_cis::rules::ensure_successful_file_system_mounts_are_collected`: Ensure successful file system mounts are collected
* `secure_linux_cis::rules::ensure_sudo_authentication_timeout_is_configured_correctly`: Ensure sudo authentication timeout is configured correctly
* `secure_linux_cis::rules::ensure_sudo_commands_use_pty`: Ensure sudo commands use pty
* `secure_linux_cis::rules::ensure_sudo_is_installed`: Ensure sudo is installed
* `secure_linux_cis::rules::ensure_sudo_log_file_exists`: Ensure sudo log file exists
* `secure_linux_cis::rules::ensure_suspicious_packets_are_logged`: Ensure suspicious packets are logged
* `secure_linux_cis::rules::ensure_system_accounts_are_secured`: Ensure system accounts are secured
* `secure_linux_cis::rules::ensure_system_administrator_actions_sudolog_are_collected`: Ensure system administrator actions (sudolog) are collected
* `secure_linux_cis::rules::ensure_system_administrator_command_executions_sudo_are_collected`: Ensure system administrator command executions (sudo) are collected
* `secure_linux_cis::rules::ensure_system_is_disabled_when_audit_logs_are_full`: Ensure system is disabled when audit logs are full
* `secure_linux_cis::rules::ensure_system_wide_crypto_policy_is_not_legacy`: Ensure system-wide crypto policy is not legacy
* `secure_linux_cis::rules::ensure_system_wide_crypto_policy_is_not_over_ridden`: Ensure system-wide crypto policy is not over-ridden
* `secure_linux_cis::rules::ensure_systemd_journal_remote_is_installed`: Ensure systemd-journal-remote is installed
* `secure_linux_cis::rules::ensure_systemd_timesyncd_is_configured`: Ensure systemd-timesyncd is configured
* `secure_linux_cis::rules::ensure_systemd_timesyncd_is_enabled_and_running`: Ensure systemd-timesyncd is enabled and running
* `secure_linux_cis::rules::ensure_talk_client_is_not_installed`: Ensure talk client is not installed
* `secure_linux_cis::rules::ensure_talk_server_is_not_enabled`: Ensure talk server is not enabled
* `secure_linux_cis::rules::ensure_tcp_syn_cookies_is_enabled`: Ensure TCP SYN Cookies is enabled
* `secure_linux_cis::rules::ensure_tcp_wrappers_is_installed`: Ensure TCP Wrappers is installed (deprecated)
* `secure_linux_cis::rules::ensure_telnet_client_is_not_installed`: Ensure telnet client is not installed
* `secure_linux_cis::rules::ensure_telnet_server_is_not_installed`: Ensure telnet-server is not installed
* `secure_linux_cis::rules::ensure_tftp_client_is_not_installed`: Ensure TFTP client is not installed
* `secure_linux_cis::rules::ensure_tftp_server_is_not_enabled`: Ensure tftp server is not enabled
* `secure_linux_cis::rules::ensure_tftp_server_is_not_installed`: Ensure TFTP Server is not installed
* `secure_linux_cis::rules::ensure_the_audit_configuration_is_immutable`: Ensure the audit configuration is immutable
* `secure_linux_cis::rules::ensure_the_mcs_translation_service_mcstrans_is_not_installed`: Ensure the MCS Translation Service (mcstrans) is not installed
* `secure_linux_cis::rules::ensure_the_selinux_mode_is_enforcing`: Ensure the SELinux mode is enforcing
* `secure_linux_cis::rules::ensure_the_selinux_mode_is_enforcing_or_permissive`: Ensure the SELinux mode is enforcing or permissive
* `secure_linux_cis::rules::ensure_the_selinux_mode_is_not_disabled`: Ensure the SELinux mode is not disabled
* `secure_linux_cis::rules::ensure_time_services_are_not_enabled`: Ensure time services are not enabled
* `secure_linux_cis::rules::ensure_time_synchronization_is_in_use`: Ensure time synchronization is in use
* `secure_linux_cis::rules::ensure_tipc_is_disabled`: Ensure TIPC is disabled
* `secure_linux_cis::rules::ensure_tmp_is_a_separate_partition`: Ensure /tmp is a separate partition
* `secure_linux_cis::rules::ensure_tmp_is_configured`: Ensure /tmp is configured
* `secure_linux_cis::rules::ensure_ufw_default_deny_firewall_policy`: Ensure ufw default deny firewall policy
* `secure_linux_cis::rules::ensure_ufw_firewall_rules_exist_for_all_open_ports`: Ensure ufw firewall rules exist for all open ports
* `secure_linux_cis::rules::ensure_ufw_is_installed`: Ensure ufw is installed
* `secure_linux_cis::rules::ensure_ufw_is_uninstalled_or_disabled_with_iptables`: Ensure ufw is uninstalled or disabled with iptables
* `secure_linux_cis::rules::ensure_ufw_is_uninstalled_or_disabled_with_nftables`: Ensure ufw is uninstalled or disabled with nftables
* `secure_linux_cis::rules::ensure_ufw_loopback_traffic_is_configured`: Ensure ufw loopback traffic is configured
* `secure_linux_cis::rules::ensure_ufw_service_is_enabled`: Ensure ufw service is enabled
* `secure_linux_cis::rules::ensure_unsuccessful_file_access_attempts_are_collected`: Ensure unsuccessful file access attempts are collected
* `secure_linux_cis::rules::ensure_unsuccessful_unauthorized_file_access_attempts_are_collected`: Ensure unsuccessful unauthorized file access attempts are collected
* `secure_linux_cis::rules::ensure_updates_patches_and_additional_security_software_are_installed`: Ensure updates, patches, and additional security software are installed
* `secure_linux_cis::rules::ensure_use_of_privileged_commands_are_collected`: Ensure use of privileged commands are collected
* `secure_linux_cis::rules::ensure_use_of_privileged_commands_is_collected`: Ensure use of privileged commands is collected
* `secure_linux_cis::rules::ensure_users_dot_files_are_not_group_or_world_writable`: Ensure users' dot files are not group or world writable
* `secure_linux_cis::rules::ensure_users_must_provide_password_for_escalation`: Ensure users must provide password for escalation
* `secure_linux_cis::rules::ensure_users_must_provide_password_for_privilege_escalation`: Ensure users must provide password for privilege escalation
* `secure_linux_cis::rules::ensure_users_netrc_files_are_not_group_or_world_accessible`: Ensure users' .netrc Files are not group or world accessible
* `secure_linux_cis::rules::ensure_users_own_their_home_directories`: Ensure users own their home directories
* `secure_linux_cis::rules::ensure_usrquota_option_set_on_home_partition`: Ensure usrquota option set on /home partition
* `secure_linux_cis::rules::ensure_var_tmp_partition_includes_the_nodev_option`: Ensure /var/tmp partition includes the nodev option
* `secure_linux_cis::rules::ensure_var_tmp_partition_includes_the_noexec_option`: Ensure /var/tmp partition includes the noexec option
* `secure_linux_cis::rules::ensure_var_tmp_partition_includes_the_nosuid_option`: Ensure /var/tmp partition includes the nosuid option
* `secure_linux_cis::rules::ensure_vsftp_server_is_not_installed`: Ensure VSFTP Server is not installed
* `secure_linux_cis::rules::ensure_wireless_interfaces_are_disabled`: Ensure wireless interfaces are disabled
* `secure_linux_cis::rules::ensure_x_window_system_is_not_installed`: Ensure X Window System is not installed
* `secure_linux_cis::rules::ensure_xd_nx_support_is_enabled`: Ensure XD/NX support is enabled
* `secure_linux_cis::rules::ensure_xdcmp_is_not_enabled`: Ensure XDCMP is not enabled
* `secure_linux_cis::rules::ensure_xdmcp_is_not_enabled`: Ensure XDMCP is not enabled
* `secure_linux_cis::rules::ensure_xinetd_is_not_enabled`: Ensure xinetd is not enabled
* `secure_linux_cis::rules::ensure_xinetd_is_not_installed`: Ensure xinetd is not installed
* `secure_linux_cis::sshd_service`: Helper class for reloading various services when needed

### Defined types

#### Public Defined types

#### Private Defined types

* `secure_linux_cis::mount_options`: Check and fix a mount with a single option

### Plans

* [`secure_linux_cis`](#secure_linux_cis)

## Classes

### <a name="secure_linux_cis"></a>`secure_linux_cis`

CIS Hardening Module

#### Parameters

The following parameters are available in the `secure_linux_cis` class:

* [`include_rules`](#include_rules)
* [`exclude_rules`](#exclude_rules)
* [`exclude_x_window_packages`](#exclude_x_window_packages)
* [`grub_config_files`](#grub_config_files)
* [`su_group`](#su_group)
* [`time_servers`](#time_servers)
* [`host_allow_rules`](#host_allow_rules)
* [`host_deny_rules`](#host_deny_rules)
* [`logging_host`](#logging_host)
* [`exclude_logs`](#exclude_logs)
* [`is_logging_host`](#is_logging_host)
* [`max_log_file`](#max_log_file)
* [`max_auth_tries`](#max_auth_tries)
* [`max_sessions`](#max_sessions)
* [`max_startups`](#max_startups)
* [`time_sync`](#time_sync)
* [`mta`](#mta)
* [`mac`](#mac)
* [`ipv6_enabled`](#ipv6_enabled)
* [`approved_ciphers`](#approved_ciphers)
* [`approved_kex`](#approved_kex)
* [`approved_mac_algorithms`](#approved_mac_algorithms)
* [`client_alive_interval`](#client_alive_interval)
* [`client_alive_count_max`](#client_alive_count_max)
* [`login_grace_time`](#login_grace_time)
* [`allow_users`](#allow_users)
* [`update_command`](#update_command)
* [`allow_groups`](#allow_groups)
* [`deny_users`](#deny_users)
* [`deny_groups`](#deny_groups)
* [`minlen`](#minlen)
* [`dcredit`](#dcredit)
* [`ucredit`](#ucredit)
* [`ocredit`](#ocredit)
* [`lcredit`](#lcredit)
* [`attempts`](#attempts)
* [`lockout_time`](#lockout_time)
* [`past_passwords`](#past_passwords)
* [`pass_max_days`](#pass_max_days)
* [`pass_min_days`](#pass_min_days)
* [`pass_warn_days`](#pass_warn_days)
* [`pass_inactive_days`](#pass_inactive_days)
* [`cron_service`](#cron_service)
* [`timeout`](#timeout)
* [`banner`](#banner)
* [`motd`](#motd)
* [`auto_restart`](#auto_restart)
* [`workstation_level_1`](#workstation_level_1)
* [`workstation_level_2`](#workstation_level_2)
* [`server_level_1`](#server_level_1)
* [`server_level_2`](#server_level_2)
* [`profile_type`](#profile_type)
* [`enforcement_level`](#enforcement_level)
* [`auditd_package`](#auditd_package)
* [`selinux_mode`](#selinux_mode)
* [`default_firewalld_zone`](#default_firewalld_zone)

##### <a name="include_rules"></a>`include_rules`

Data type: `Array[String]`

Which rules to include

##### <a name="exclude_rules"></a>`exclude_rules`

Data type: `Array[String]`

Which rules to exclude

##### <a name="exclude_x_window_packages"></a>`exclude_x_window_packages`

Data type: `Array[String]`

Which X window packages to exclude from removal

##### <a name="grub_config_files"></a>`grub_config_files`

Data type: `Array[String]`

Grub configuration

##### <a name="su_group"></a>`su_group`

Data type: `String`

The default group for sudo rights

##### <a name="time_servers"></a>`time_servers`

Data type: `Array[Stdlib::Host]`

Array of valid NTP Time servers

##### <a name="host_allow_rules"></a>`host_allow_rules`

Data type: `Array[String]`

Specifies which IP addresses are permitted to connect to the host

##### <a name="host_deny_rules"></a>`host_deny_rules`

Data type: `Array[String]`

Specifies which IP addresses are not permitted to connect to the host

##### <a name="logging_host"></a>`logging_host`

Data type: `String`

Which host should logging be sent to

##### <a name="exclude_logs"></a>`exclude_logs`

Data type: `Array[Stdlib::Unixpath]`

What logs files to exclude from management

##### <a name="is_logging_host"></a>`is_logging_host`

Data type: `Boolean`

Is this host a logging host

##### <a name="max_log_file"></a>`max_log_file`

Data type: `Integer`

Maximum log file

##### <a name="max_auth_tries"></a>`max_auth_tries`

Data type: `Integer[1,4]`

How many authorization attempts to allow

##### <a name="max_sessions"></a>`max_sessions`

Data type: `Integer[1,10]`

How many SSH sessions to allow

##### <a name="max_startups"></a>`max_startups`

Data type: `String`

How many SSH startups to allow

##### <a name="time_sync"></a>`time_sync`

Data type: `Enum['ntp', 'chrony', 'systemd-timesuncd']`

Which NTP program to use

##### <a name="mta"></a>`mta`

Data type: `Enum['postfix', 'exim', 'none']`

Which Mail Transfer program to use

##### <a name="mac"></a>`mac`

Data type: `Enum['selinux', 'apparmor', 'none']`

Which Mandatory Access Control to use

##### <a name="ipv6_enabled"></a>`ipv6_enabled`

Data type: `Boolean`

Should ipv6 be enabled

##### <a name="approved_ciphers"></a>`approved_ciphers`

Data type: `Array[String]`

Which SSH Ciphers are approved for use

##### <a name="approved_kex"></a>`approved_kex`

Data type: `Array[String]`

Which SSH Key Exchange algorithms are approved for use.

##### <a name="approved_mac_algorithms"></a>`approved_mac_algorithms`

Data type: `Array[String]`

Which SSH MAC algorigthms are approved for use

##### <a name="client_alive_interval"></a>`client_alive_interval`

Data type: `Integer`

Client alive interval to use

##### <a name="client_alive_count_max"></a>`client_alive_count_max`

Data type: `Integer[0,3]`

Maximum specificed client alive count

##### <a name="login_grace_time"></a>`login_grace_time`

Data type: `Integer`

Login grace time

##### <a name="allow_users"></a>`allow_users`

Data type: `Array[String]`

Which users to allow

##### <a name="update_command"></a>`update_command`

Data type: `String`

Command used to update OS packages

##### <a name="allow_groups"></a>`allow_groups`

Data type: `Array[String]`

Which groups to allow

##### <a name="deny_users"></a>`deny_users`

Data type: `Array[String]`

Which users to deny

##### <a name="deny_groups"></a>`deny_groups`

Data type: `Array[String]`

Which groups to deny

##### <a name="minlen"></a>`minlen`

Data type: `Integer`

Minimum length

##### <a name="dcredit"></a>`dcredit`

Data type: `Integer`

D Credit

##### <a name="ucredit"></a>`ucredit`

Data type: `Integer`

U Credit

##### <a name="ocredit"></a>`ocredit`

Data type: `Integer`

O Credit

##### <a name="lcredit"></a>`lcredit`

Data type: `Integer`

L Credit

##### <a name="attempts"></a>`attempts`

Data type: `Integer`

Number of attempts

##### <a name="lockout_time"></a>`lockout_time`

Data type: `Integer`

Amount of time for lockout

##### <a name="past_passwords"></a>`past_passwords`

Data type: `Integer`

Number of previous passwords

##### <a name="pass_max_days"></a>`pass_max_days`

Data type: `Integer`

Password maximum days

##### <a name="pass_min_days"></a>`pass_min_days`

Data type: `Integer`

Password minimum days

##### <a name="pass_warn_days"></a>`pass_warn_days`

Data type: `Integer`

Password warning days

##### <a name="pass_inactive_days"></a>`pass_inactive_days`

Data type: `Integer`

Password inactive days

##### <a name="cron_service"></a>`cron_service`

Data type: `Enum['cron', 'crond']`

Should this system use cron or crond

##### <a name="timeout"></a>`timeout`

Data type: `Integer`

Number of seconds of inactivity after which a shell terminates.

##### <a name="banner"></a>`banner`

Data type: `String`

String to be content of /etc/issue, /etc/issue.net (and /etc/motd if $motd not defined)

##### <a name="motd"></a>`motd`

Data type: `String`

String to be content of /etc/motd.  If $banner is defined and $motd is not, $banner becomes content of /etc/motd

##### <a name="auto_restart"></a>`auto_restart`

Data type: `Boolean`

If an automatic restart should occur when defined classes require a reboot to take effect

##### <a name="workstation_level_1"></a>`workstation_level_1`

Data type: `Array[String]`

Workstation level 1 rules for this node

##### <a name="workstation_level_2"></a>`workstation_level_2`

Data type: `Array[String]`

Workstation level 2 rules for this node

##### <a name="server_level_1"></a>`server_level_1`

Data type: `Array[String]`

Server level 1 rules for this node

##### <a name="server_level_2"></a>`server_level_2`

Data type: `Array[String]`

Server level 2 rules for this node

##### <a name="profile_type"></a>`profile_type`

Data type: `Enum['workstation', 'server']`

Is this node a server or workstation

##### <a name="enforcement_level"></a>`enforcement_level`

Data type: `Integer[1, 2]`

Enforce level 1 or level 2 rules

##### <a name="auditd_package"></a>`auditd_package`

Data type: `String`

Auditd package

##### <a name="selinux_mode"></a>`selinux_mode`

Data type: `Enum['enforcing', 'permissive']`

SElinux mode enforcing or permissive. Defaults to enforcing.

##### <a name="default_firewalld_zone"></a>`default_firewalld_zone`

Data type: `Enum['drop', 'block', 'public', 'external', 'dmz', 'work', 'home', 'internal', 'trusted']`

Firewalld zone to default o. Defaults to drop.

### <a name="secure_linux_cisrefresh_mount_options"></a>`secure_linux_cis::refresh_mount_options`

A description of what this class does

#### Examples

#####

```puppet
include secure_linux_cis::refresh_mount_options
```

### <a name="secure_linux_cisrulesensure_code_dump_backtraces_are_disabled"></a>`secure_linux_cis::rules::ensure_code_dump_backtraces_are_disabled`

Description:
ingle user mode (rescue mode) is used for recovery when the system detects an issue during boot or by
manual selection from the bootloader.

### <a name="secure_linux_cisrulesensure_code_dump_storage_is_disabled"></a>`secure_linux_cis::rules::ensure_code_dump_storage_is_disabled`

Description:
ingle user mode (rescue mode) is used for recovery when the system detects an issue during boot or by
manual selection from the bootloader.

### <a name="secure_linux_cisrulesensure_default_group_for_the_root_account_is_gid_0"></a>`secure_linux_cis::rules::ensure_default_group_for_the_root_account_is_gid_0`

Description:
The usermod command can be used to specify which group the root user belongs to. This affects permissions
 of files that are created by the root user.

### <a name="secure_linux_cisrulesensure_events_that_modify_the_system_s_mandatory_access_controls_are_collected"></a>`secure_linux_cis::rules::ensure_events_that_modify_the_system_s_mandatory_access_controls_are_collected`

Description:
Monitor SELinux mandatory access controls. The parameters below monitor any write
access (potential additional, deletion or modification of files in the directory) or attribute
changes to the /etc/selinux or directory.

Rationale:
Changes to files in these directories could indicate that an unauthorized user is attempting
to modify access controls and change security contexts, leading to a compromise of the
system.

### <a name="secure_linux_cisrulesensure_events_that_modify_the_system_s_network_environment_are_collected"></a>`secure_linux_cis::rules::ensure_events_that_modify_the_system_s_network_environment_are_collected`

Description:
Record changes to network environment files or system calls. The below parameters
monitor the sethostname (set the systems host name) or setdomainname (set the systems
domainname) system calls, and write an audit event on system call exit. The other
parameters monitor the /etc/issue and /etc/issue.net files (messages displayed prelogin),
/etc/hosts (file containing host names and associated IP addresses),
/etc/sysconfig/network file and /etc/sysconfig/network-scripts/ directory
(containing network interface scripts and configurations).

Rationale:
Monitoring sethostname and setdomainname will identify potential unauthorized changes
to host and domainname of a system. The changing of these names could potentially break
security parameters that are set based on those names. The /etc/hosts file is monitored
for changes in the file that can indicate an unauthorized intruder is trying to change
machine associations with IP addresses and trick users and processes into connecting to
unintended machines. Monitoring /etc/issue and /etc/issue.net is important, as
intruders could put disinformation into those files and trick users into providing
information to the intruder. Monitoring /etc/sysconfig/network and
/etc/sysconfig/network-scripts/ is important as it can show if network interfaces or
scripts are being modified in a way that can lead to the machine becoming unavailable or
compromised. All audit records will be tagged with the identifier "system-locale."

### <a name="secure_linux_cisrulesensure_gpg_keys_are_configured"></a>`secure_linux_cis::rules::ensure_gpg_keys_are_configured`

Description:
The gpgcheck option, found in the main section of the /etc/yum.conf and individual /etc/yum/repos.d/*
files determines if an RPM package's signature is checked prior to its installation.

### <a name="secure_linux_cisrulesensure_inactive_password_lock_is_30_days_or_less"></a>`secure_linux_cis::rules::ensure_inactive_password_lock_is_30_days_or_less`

Description:
User accounts that have been inactive for over a given period of time can be automatically disabled. It is recommended that accounts that
are inactive for 30 days after password expiration be disabled.

Rationale:
Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies.

### <a name="secure_linux_cisrulesensure_ip6tables_default_deny_firewall_policy"></a>`secure_linux_cis::rules::ensure_ip6tables_default_deny_firewall_policy`

Description:
iptables allows configuration of the IPv4 tables in the linux kernel and the rules stored
within them. Most firewall configuration utilities operate as a front end to iptables.

Rationale:
iptables is required for firewall management and configuration.

### <a name="secure_linux_cisrulesensure_ip6tables_is_enabled_and_active"></a>`secure_linux_cis::rules::ensure_ip6tables_is_enabled_and_active`

Description:
iptables allows configuration of the IPv4 tables in the linux kernel and the rules stored
within them. Most firewall configuration utilities operate as a front end to iptables.

Rationale:
iptables is required for firewall management and configuration.

### <a name="secure_linux_cisrulesensure_iptables_is_not_enabled"></a>`secure_linux_cis::rules::ensure_iptables_is_not_enabled`

Description:
IPtables is an application that allows a system administrator to configure
the IPv4 and IPv6 tables, chains and rules provided by the Linux kernel
firewall.
IPtables is installed as a dependency with firewalld.

Rationale:
Running firewalld and IPtables concurrently may lead to conflict, therefore
IPtables should be stopped and masked when using firewalld.

### <a name="secure_linux_cisrulesensure_ipv6_firewall_rules_exist_for_all_open_ports"></a>`secure_linux_cis::rules::ensure_ipv6_firewall_rules_exist_for_all_open_ports`

Description:
Any ports that have been opened on non-loopback addresses need firewall rules to govern
traffic.

Rationale:
Without a firewall rule configured for open ports default firewall policy will drop all
packets to these ports.

### <a name="secure_linux_cisrulesensure_ipv6_is_disabled"></a>`secure_linux_cis::rules::ensure_ipv6_is_disabled`

Description:
Although IPv6 has many advantages over IPv4, few organizations have implemented IPv6.

Rationale:
If IPv6 is not to be used, it is recommended that it be disabled to reduce the attack surface
of the system.

### <a name="secure_linux_cisrulesensure_ipv6_outbound_and_established_connections_are_configured"></a>`secure_linux_cis::rules::ensure_ipv6_outbound_and_established_connections_are_configured`

Description:
Configure the firewall rules for new outbound, and established connections.

Rationale:
If rules are not in place for new outbound, and established connections all packets will be
dropped by the default policy preventing network usage.

### <a name="secure_linux_cisrulesensure_ipv6_redirects_are_not_accepted"></a>`secure_linux_cis::rules::ensure_ipv6_redirects_are_not_accepted`

Description:
This setting prevents the system from accepting ICMP redirects. ICMP redirects tell the
system about alternate routes for sending traffic.

Rationale:
It is recommended that systems not accept ICMP redirects as they could be tricked into
routing traffic to compromised machines. Setting hard routes within the system (usually a
single default route to a trusted router) protects the system from bad routes.

### <a name="secure_linux_cisrulesensure_ipv6_router_advertisements_are_not_accepted"></a>`secure_linux_cis::rules::ensure_ipv6_router_advertisements_are_not_accepted`

Description:
This setting disables the system's ability to accept IPv6 router advertisements.

Rationale:
It is recommended that systems not accept router advertisements as they could be tricked
into routing traffic to compromised machines. Setting hard routes within the system
(usually a single default route to a trusted router) protects the system from bad routes.

### <a name="secure_linux_cisrulesensure_logrotate_is_configured"></a>`secure_linux_cis::rules::ensure_logrotate_is_configured`

Description:
The system includes the capability of rotating log files regularly to avoid filling up the
system with logs or making the logs unmanageable large. The file
/etc/logrotate.d/syslog is the configuration file used to rotate log files created by
syslog or rsyslog.

Rationale:
By keeping the log files smaller and more manageable, a system administrator can easily
archive these files to another system and spend less time looking through inordinately
large log files.

### <a name="secure_linux_cisrulesensure_minimum_days_between_password_changes_is_7_or_more"></a>`secure_linux_cis::rules::ensure_minimum_days_between_password_changes_is_7_or_more`

Description:
The PASS_MIN_DAYS parameter in /etc/login.defs allows an administrator to prevent users from changing their password until a minimum
number of days have passed since the last time the user changed their password. It is recommended that PASS_MIN_DAYS parameter be set to
7 or more days.

Rationale:
By restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an
attempt to circumvent password reuse controls.

### <a name="secure_linux_cisrulesensure_mounting_of_fat_filesystems_is_disabled"></a>`secure_linux_cis::rules::ensure_mounting_of_fat_filesystems_is_disabled`

Description:
The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules.
It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:
Removing support for unneeded filesystem types reduces the local attack surface of the system.
If this filesystem type is not needed, disable it.

### <a name="secure_linux_cisrulesensure_mounting_of_jffs2_filesystems_is_disabled"></a>`secure_linux_cis::rules::ensure_mounting_of_jffs2_filesystems_is_disabled`

Description:
The jffs2 (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices.

Rationale:
Removing support for unneeded filesystem types reduces the local attack surface of the system.
If this filesystem type is not needed, disable it.

### <a name="secure_linux_cisrulesensure_mounting_of_vfat_filesystems_is_limited"></a>`secure_linux_cis::rules::ensure_mounting_of_vfat_filesystems_is_limited`

Description:
The FAT filesystem format is primarily used on older windows systems and portable USB drives or flash modules.
It comes in three types FAT12 , FAT16 , and FAT32 all of which are supported by the vfat kernel module.

Rationale:
Removing support for unneeded filesystem types reduces the local attack surface of the system.
If this filesystem type is not needed, disable it.

### <a name="secure_linux_cisrulesensure_nfs_and_rpc_are_not_enabled"></a>`secure_linux_cis::rules::ensure_nfs_and_rpc_are_not_enabled`

Description:
The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment.
It provides the ability for systems to mount file systems of other servers through the network.

Rationale:
If the system does not export NFS shares or act as an NFS client,
it is recommended that these services be disabled to reduce remote attack surface.

### <a name="secure_linux_cisrulesensure_nftables_is_not_installed_with_firewalld"></a>`secure_linux_cis::rules::ensure_nftables_is_not_installed_with_firewalld`

Description:
Chains are containers for rules. They exist in two kinds, base chains and regular chains. A base chain is an entry point for packets
from the networking stack, a regular chain may be used as jump target and is used for better rule organization.

Rationale:
If a base chain doesn't exist with a hook for input, forward, and delete, packets that would flow through those chains will not be
touched by nftables.

### <a name="secure_linux_cisrulesensure_outbound_and_established_connections_are_configured"></a>`secure_linux_cis::rules::ensure_outbound_and_established_connections_are_configured`

Description:
Configure the firewall rules for new outbound, and established connections.

Rationale:
If rules are not in place for new outbound, and established connections all packets will be
dropped by the default policy preventing network usage.

### <a name="secure_linux_cisrulesensure_package_manager_repositories_are_configured"></a>`secure_linux_cis::rules::ensure_package_manager_repositories_are_configured`

Description:
Systems need to have package manager repositories configured to ensure they receive the latest patches and updates.

### <a name="secure_linux_cisrulesensure_password_expiration_is_365_days_or_less"></a>`secure_linux_cis::rules::ensure_password_expiration_is_365_days_or_less`

Description:
The PASS_MAX_DAYS parameter in /etc/login.defs allows an administrator to force passwords to expire once they reach a defined age. It is
recommended that the PASS_MAX_DAYS parameter be set to less than or equal to 365 days.

Rationale:
The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute
force attack is limited by the age of the password. Therefore, reducing the maximum age of a password also reduces an attacker's window
of opportunity.

### <a name="secure_linux_cisrulesensure_password_expiration_warning_days_is_7_or_more"></a>`secure_linux_cis::rules::ensure_password_expiration_warning_days_is_7_or_more`

Description:
The PASS_WARN_AGE parameter in /etc/login.defs allows an administrator to notify users that their password will expire in a defined
number of days. It is recommended that the PASS_WARN_AGE parameter be set to 7 or more days.

Rationale:
Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may
choose a simple password or write it down where it may be discovered.

### <a name="secure_linux_cisrulesensure_permissions_on_etc_cron_tab_are_configured"></a>`secure_linux_cis::rules::ensure_permissions_on_etc_cron_tab_are_configured`

Description:
The /etc/cron.d directory contains system cron jobs that need to run in a
similar manner to the hourly, daily weekly and monthly jobs from /etc/crontab ,
but require more granular control as to when they run. The files in this
directory cannot be manipulated by the crontab command, but are instead edited
by system administrators using a text editor. The commands below restrict
read/write and search access to user and group root, preventing regular users
from accessing this directory.

Rationale:
Granting write access to this directory for non-privileged users could provide
them the means for gaining unauthorized elevated privileges. Granting read
access to this directory could give an unprivileged user insight in how to gain
elevated privileges or circumvent auditing controls.

### <a name="secure_linux_cisrulesensure_permissions_on_etc_group_dash_are_configured"></a>`secure_linux_cis::rules::ensure_permissions_on_etc_group_dash_are_configured`

Description:
The /etc/group- file contains a backup list of all the valid groups defined in the system.

### <a name="secure_linux_cisrulesensure_permissions_on_etc_gshadow__are_configured"></a>`secure_linux_cis::rules::ensure_permissions_on_etc_gshadow__are_configured`

Description:
The /etc/gshadow- file is used to store backup information about groups that is critical to the security
of those accounts, such as the hashed password and other security information.

#### Parameters

The following parameters are available in the `secure_linux_cis::rules::ensure_permissions_on_etc_gshadow__are_configured` class:

* [`enforced`](#enforced)

##### <a name="enforced"></a>`enforced`

Data type: `Boolean`

Default value: ``true``

### <a name="secure_linux_cisrulesensure_ssh_loglevel_is_set_to_info"></a>`secure_linux_cis::rules::ensure_ssh_loglevel_is_set_to_info`

Description:
The INFO parameter specifies that login and logout activity will be logged.

Rationale:
SSH provides several logging levels with varying amounts of verbosity. DEBUG is
specifically not recommended other than strictly for debugging SSH
communications since it provides so much data that it is difficult to identify
important security information. INFO level is the basic level that only records
login activity of SSH users. In many situations, such as Incident Response, it
is important to determine when a particular user was active on a system. The
logout record can eliminate those users who disconnected, which helps narrow
the field.

## Defined types

## Plans

### <a name="secure_linux_cis"></a>`secure_linux_cis`

The secure_linux_cis class.

#### Parameters

The following parameters are available in the `secure_linux_cis` plan:

* [`targets`](#targets)
* [`time_servers`](#time_servers)
* [`profile_type`](#profile_type)

##### <a name="targets"></a>`targets`

Data type: `TargetSpec`

##### <a name="time_servers"></a>`time_servers`

Data type: `Array[Stdlib::Host]`

Default value: `['time.google.com']`

##### <a name="profile_type"></a>`profile_type`

Data type: `Enum['workstation', 'server']`

Default value: `'server'`

gha_language: Puppet


text:
# aws-eb-laravel
AWS Elastic Beanstalk configurations for Laravel

# Inspired By
I would like to say special thanks to [rennokki/laravel-aws-eb](https://github.com/rennokki/laravel-aws-eb) and [FoxxMD/laravel-elasticbeanstalk-cron](https://github.com/FoxxMD/laravel-elasticbeanstalk-cron).

license: MIT

repository: ibruce-fa/aws-eb-laravel

branch_name: refs/heads/master

extension: md

license_type: permissive

repo_name: ibruce-fa/aws-eb-laravel


text:
---
title: "Downtown Portland, Part II: An Injured Friend. Guest Reblog from Blatant Calm"
date: 2020-08-05T01:45:57.443Z
author: Boop Troop Eugene
summary: "Blatant Calm explores the direct experience of a friend who was
  injured while a medic, including her participation, her injuries, the weapons
  used against peaceful demonstrators, and what you can do to try to help.
  Content alert: Graphic photos."
tags:
  - medics
  - injuries
---
<!--StartFragment-->

**TL;DR: Street medic shot in the back by Portland Police at multiple protests, once causing severe injury. This is her story.**

![](https://blatantcalmhome.files.wordpress.com/2020/07/109792818_10157702397697532_7766753084132348008_o-1.jpg?w=1024)

*Photo Credit: Teri Melton, taken Tuesday. July 21*

My last post examined the disparity between what is happening in Portland and what is reported by the news media, law enforcement, and the administration.

There are some who feel I unfairly lay most of the blame on the city and federal officers for the escalating violence and injury to both property and people. Some believe the city and federal officers are justified in their actions, and that those who are breaking no laws have nothing to fear or be concerned about.

I disagree.

[Journalists and protest medics have been targeted](https://newrepublic.com/article/157985/protest-medics-targeted-police-words) by the police since before the feds arrived in Portland.

Doubt this to be true? I want to share the personal story of someone I know. She’s a talented musician and artist, volunteer for multiple creative arts organizations, Gilman Scholarship recipient, 4.0 student, and a published poet. Not only is she my friend, she is also the daughter of a junior high and high school classmate and dear friend of mine.

I will refer to her as “Z.” All the following text in italics are her own words.

This will be a lengthy article in 4 parts:

**Part I. Z’s Participation in the Portland Protests**

**Part II. Z’s Injuries**

**Part III. Non-Lethal Weapons”**

**Part IV. Conclusion – What You Can Do**

Feel free to post, share, and forward this article if you are so moved.

- - -

**Part I. Z’s Participation in the Portland Protests**

Z has attended about half of the daily protests (she estimates about 30 total). She has participated in protests both prior and after the unbidden arrival of federal enforcers. Her primary goal all along has been to provide basic first aid.

*“I go out as an unmarked street medic. I avoid having the red crosses anywhere on my person to avoid getting targeted by police and federal agents. It’s been a while since I’ve been fully CPR certified, so I can offer basic first aid and eye wash (the most common need on the front lines) but not full blown 911/first response type care.”*

Beyond sometimes joining in some of the chants, her primary focus is to offer care to fellow protesters:

*“When I’m protesting, I generally keep my focus on first aid and protestor safety. However, I join in chants. I chant ‘QUIT YOUR JOB!’ amongst many other things. I don’t carry signs because I need use of both of my hands should anyone need first aid attention.”*

Z has been shot more than once in the back with rubber bullets and clubbed on the head with a baton.

*“When I was hit with the rubber bullet, me and the other protesters were retreating from a front line of police after they deployed tear gas, pepper bullets, flash bangs, and rubber bullets into the crowd. I had my back turned to them, was walking in the direction they were requesting of the protestors and was shot. This is pretty common. As soon as anything is declared an ‘unlawful assembly’ or a ‘riot’ the police/feds will not stop firing munitions until the entire crowd is dispersed and most of the people go home. They single out people who stay late and either arrest, detain, or beat them.”*

*“Every time I’ve been hurt (at least when it hasn’t been by tear gas or pepper spray) I’ve had my back to police and they have either shot at me or hit me in the head with a baton.*

*Folks have started chanting ‘don’t turn your back on them’ as things get spicy down there now as a protective measure.”*

![](https://blatantcalmhome.files.wordpress.com/2020/07/116048860_10157699492842532_1948076489937943643_o.jpg?w=1024)

Photo credit: Reuters news photo captioned “A federal law enforcement officer pushes a mother back during a demonstration against the presence of federal law enforcement officers and racial inequality in Portland, Oregon, U.S., July 21, 2020. REUTERS/Caitlin Ochs TPX IMAGES OF THE DAY”

Some might ask whether Z could be perceived as a threat to law enforcement. She is 5’1” (155cm) and 105 lbs. (47.6 kg). Although she did not see the officer who shot her, the one who hit her in the head with a baton she estimates to have been at least 5’11” (180cm).

- - -

**Part II. Z’s Injuries**

One of the protests where Z was hit was on June 2. That night she was shot in the tail bone with a rubber bullet. She thought she could manage and heal on her own, but the pain increased and a visit to the doctor a few days later didn’t help. After two weeks immobilized with debilitating pain, she dragged herself to the ER where it was determined she had developed a severe infection.

*“I’ve had tailbone injuries before, so I figured with appropriate icing and keeping weight off the injury, I would be okay. The pain, swelling, and (eventually) infection got increasingly severe over the course of the following two weeks. Somewhere in the middle of those two weeks I went to the doctor for X-Rays and an exam. The doctor didn’t look at the wound, said I was fine, and sent me home with instructions to take Tylenol for the pain.  That experience left me feeling confused about the severity of the injury and ultimately informed my hesitancy to take myself to the ER.”*

*“At the peak of my infection, I could hardly make it to the car to get to the hospital, even with help or crutches.”*

*“The pain of a blood infection is something I had yet to experience also – it was so intense. I legitimately had a moment prior to asking my roommate to drive me to the hospital where I felt something very deep and intuitive within me say, ‘If you don’t get yourself serious help for this FAST you will die.’ It was a very mortal moment.  It definitely redefined by pain limit, that’s for sure.”*

*“The rubber bullet didn’t break \[the] skin, but there was significant internal bleeding that became severely infected. When I admitted myself to the ER, the surgeon who was preparing me for surgery said that had I waited 24-48 hours longer to seek help I would have needed extensive blood transfusions. They also told me the infection was deep and progressive enough that it was visibly ‘tracking.’ I was told the operation (which was basically just a very deep drainage) would take about 2 minutes. The infection was so deep and expansive that it took 30 minutes. The underwear and skirt that I wore into the hospital had to be tossed into a biohazard bag and thrown away because of how soaked in infection it had gotten during the operation. They put a drainage tube in the wound site, which stayed in place for two weeks after surgery. Once the tube was removed, I was permitted to go back to activities like walking and biking. I’m still working on gaining my strength back.”*

[Click here for an image of Z’s drain tube [***warning: graphic image***](https://blatantcalmhome.files.wordpress.com/2020/07/injury2.jpg)]

![](https://blatantcalmhome.files.wordpress.com/2020/07/injury1a.jpg?w=625)

Z, convalescing post-surgery

Z has recovered sufficiently enough to attend protests. She received a baton hit to the head after the federal officers arrived, but she is adamant that her injuries were all inflicted by members of the Portland Police Bureau (PPB):

*“The tailbone injury was \[prior to the arrival of the Feds], the head hit was post-Fed. But both injuries were carried out by the PPB, who claim not to be working with one another, but have been employing each other’s tactics in very noticeable ways (ie: bull rushes, combining tear gas and mace to use en masse in large crowds, etc.)”*

Despite her injuries from the PPB, she agrees that the arrival of the uninvited federal enforcers has significantly resulted in larger protests and an escalation in tensions.

*“The crowds at the Justice Center had dwindled significantly before July 4th and DEFINITELY got reinvigorated once the federal occupation happened.”*

Z also has witnessed a lot of troubling evidence that the Portland Police and the federal enforcers are collaborating and supporting each other:

*“The PPB and Feds are not supposed to be working together, but there are a lot of personal accounts and evidence that suggest otherwise.*

*One tactic I’ve seen (and experienced) is that the Feds at the Justice Center will excessively gas the park (the area where protestors gather, where houseless folks have tents set up, and where free food, clothing, and other resources are available), pushing the crowds into downtown areas where then (miraculously) the PPB are waiting at various intersections to continue gassing, macing, shooting projectiles, and corralling the protestors as they try to get away from federal gassing.”*

![](https://blatantcalmhome.files.wordpress.com/2020/07/115912768_10157695752422532_2034084786537045721_o.jpg?w=1024)

Photo credit: David J. Loftus. One of the tents in the protest support camp near of SW Third across from the federal courthouse. The report is that the feds specifically attacked the camp last night (July 21st)– classic disruption of military supply-line tactics — with pepper spray and tear gas. – David J. Loftus

*“There were a lot of elders in the crowd last I was in one of those situations as well – the majority of the first aid I was providing that night was for men aged 45-75, most of them appearing to be closer to the 65-75 range.”*

- - -

**Part III. “Non-Lethal Weapons”**

Z’s experience shows the danger so-called “non-lethal weapons” pose. Commonly used to control crowds and riots, non-lethal weapons can inflict significant and, in some cases, permanent serious injury, or death. This is especially the case when wielded by people who are poorly trained and/or not using the weapons as intended.

**[From tear gas to rubber bullets, here’s what ‘nonlethal’ weapons can do to the body – National Geographic](https://www.nationalgeographic.com/science/2020/06/what-nonlethal-weapons-can-do-to-the-body-george-floyd/)**

**[‘Less lethal’ can still maim and kill: A visual guide to weapons police use on protesters – USA Today](https://www.usatoday.com/in-depth/news/2020/06/20/less-lethal-rubber-bullet-protester-pepper-ball-tear-gas-injured-blinded/5343717002/)** ***\[Warning, graphic images]***

- - -

**Part IV. Conclusion – What You Can Do**

**Facts:**

* City and federal officers have been using excessive amounts of so-called non-lethal weapons on protesters
* City and federal officers have been using these non-lethal weapons improperly, either because of lack of training, a sense of impunity for their actions, or a combination of both.
* City and federal officers have been targeting journalists and those providing medical aid to protesters.
* My friend Z presented no threat to anyone, caused or threatened to cause no damage to property, was offering medical aid, followed official orders to retreat, yet was targeted and injured on several occasions, gravely injured on one occasion.

**What you can do:**

**Demand federal officers leave Portland**. Both Oregon Senators and two Oregon Representative have denounced the “politically-motivated authoritarian tactics.” Contact your members of Congress to in support of the removal of the Feds.

**Call for the banning of the use of tear gas**. [Seattle’s City Council recently voted to ban police use of tear gas and choke holds](https://www.seattletimes.com/seattle-news/politics/seattle-city-council-bans-police-use-of-tear-gas-and-chokeholds-as-protests-for-black-lives-continue/). Urge your city to follow suit! [The use of tear gas is banned in war under Chemical Weapons Convention and the 1925 Geneva Protocol](https://www.un.org/disarmament/wmd/bio/1925-geneva-protocol/), but it is still legal for use in law enforcement.

**Organizations Z Suggests you Support:**

I asked Z what she recommended people who want to support to do. She suggested these organizations to support:

She has high praise for [Teressa Raiford and Don’t Shoot PDX](https://www.dontshootpdx.org/)

“[This person is crowdfunding to distribute respirators](https://www.instagram.com/saltysonthecolumbia/?hl=en) to protesters on the ground level as well- prioritizing BIPOC, Moms, Dads, and Elders”

She provided these links for organizations that are helping:

[Figure Out How To Help, Portland – Portland Monthly](https://www.pdxmonthly.com/news-and-city-life/2020/05/breathe-deep-and-figure-out-how-to-help)

[Things You Can Do to Support the Black Community and Promote Anti-Racist Efforts – Portland Mercury](https://www.portlandmercury.com/blogtown/2020/06/02/28499055/things-you-can-do-to-support-the-black-community-and-promote-anti-racist-efforts)

**Z’s Educational Suggestions:**

Z stresses the importance of educating yourself on the issues. Here are her recommendations:

[Arresting Power: Resisting Police Violence in Portland, Oregon](http://www.arrestingpower.com/)\
Z says: “Arresting Power is a documentary specifically about the history of police brutality to Oregon, and gives very necessary insight into exactly how and why the police have behaved, and continue to behave, the way they do.”

[12 Free Documentaries And Shows About Black History And Racism In America – KBPS](https://www.kpbs.org/news/2020/jun/10/13-free-documentaries-and-shows-about-black-histor/)

[Ten “Must Watch” Black History Documentaries – PBS](http://www.pbs.org/black-culture/explore/10-black-history-documentaries-to-watch/)

**Be safe, keep secure, and do the right thing.**

<!--EndFragment-->

repository: booptroopeugene/booptroopeugene

gha_language: HTML

gha_license_id: MIT

repo_name: booptroopeugene/booptroopeugene


text:
# mustache.ts - Logic-less {{mustache}} templates with TypeScript(converting to JavaScript)

[mustache.ts](http://github.com/smile7sky/mustache.ts) is forked from [mustache.js](http://github.com/janl/mustache.js) which is an implementation of the [mustache](http://mustache.github.com/) template system in JavaScript.

This is the TypeScript version of {{mustache}} so your TypeScript projects can include `mustache.ts` as a TypeScript file, and also easily rewrite. `mustache.ts` will be converted to `mustache.js` which is perfectly copmatible with [mustache.js](http://github.com/janl/mustache.js). As it provides same interfaces and shares all unit tests with [mustache.js](http://github.com/janl/mustache.js)

## todo

1. Installation with npm and bower
2. Usage more in detail
3. TSLint
4. Examples on TypeScript projects