Alex Haydock

RHEL 8 CIS 5.2.2 Ensure SSH access is limited (Automated)

1

Needs rule.

Needs rule.

Needs rule, as the `rsyslog_files_permissions rule` is not sufficient.

Needs rule, as the file_permissions_sshd_private_key rule does not align properly with the benchmark.

Needs rule. The current `sshd_enable_warning_banner` rule is insufficient for the RHEL 8 CIS profile, as it configures the sshd warning banner to use `/etc/issue` instead of `/etc/issue.net` which the benchmark...

Needs rule. We are partially satisfying this with the `no_shelllogin_for_systemaccounts` rule, but the benchmark also calls for a rule which will lock any current system accounts.

Feature request: Verify upstream GPG signature

1

Looking at the `Snapcraft.yaml` file, it doesn't look like there's any verification going on here for the fetched `.deb` file. For a security-focused application (or really any application) I think...

As of the most recent commit, 0de4bffe24c71604a19d95222011d1b2e6d41f10, I can see that the URL to download Busybox into the RHEL 8 UBI container is being hard-coded into the `install.sh` script: https://github.com/splunk/docker-splunk/blob/0de4bffe24c71604a19d95222011d1b2e6d41f10/base/redhat-8/install.sh#L45...

Apps break on hosts where Splunk is configured to listen on IPv6 management port

6

For apps which invoke the `get_splunkd_access_info()` function from `splunkenv.py`, errors are thrown when a host is configured to listen using IPv6 on the Splunk MGMT port. This function uses `get_conf_key_value()`...