Update RHEL 9 STIG to V2R2

components/openssh.yml

@@ -19,6 +19,7 @@ rules:
 - file_permissions_sshd_config
 - file_permissions_sshd_private_key
 - file_permissions_sshd_pub_key
+- file_sshd_50_redhat_exists
 - firewalld_sshd_disabled
 - firewalld_sshd_port_enabled
 - iptables_sshd_disabled

controls/stig_rhel9.yml

@@ -1847,7 +1847,8 @@ controls:
             - medium
         title: RHEL 9 SSH daemon must be configured to use system-wide crypto policies.
         rules:
-            - configure_ssh_crypto_policy
+            - harden_sshd_ciphers_opensshserver_conf_crypto_policy
+            - file_sshd_50_redhat_exists
         status: automated
 
     -   id: RHEL-09-255060
@@ -2596,6 +2597,7 @@ controls:
             15 minutes of inactivity.
         rules:
             - accounts_tmout
+            - var_accounts_tmout=10_min
         status: automated
 
     -   id: RHEL-09-412040

linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/rule.yml

@@ -1,6 +1,5 @@
 documentation_complete: true
 
-
 title: 'Prevent Unrestricted Mail Relaying'
 
 description: |-
@@ -13,6 +12,8 @@ rationale: |-
     host as a mail relay for the purpose of sending spam or other unauthorized
     activity.
 
+platform: package[postfix]
+
 severity: medium
 
 identifiers:

linux_os/guide/services/ssh/file_sshd_50_redhat_exists/rule.yml

@@ -0,0 +1,28 @@
+documentation_complete: true
+
+title: 'The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist'
+
+description: |-
+    The <tt>/etc/ssh/sshd_config.d/50-redhat.conf</tt> file must exist as it contains important
+    settings to secure SSH.
+
+
+rationale: |-
+    The file must exist to configure SSH correctly.
+
+severity: medium
+
+warnings:
+    - general:
+        There is no remediation available for this rule since this file
+        needs to have the correct content for the given system.
+
+
+template:
+    name: 'file_existence'
+    vars:
+        filepath: '/etc/ssh/sshd_config.d/50-redhat.conf'
+        exists: true
+    backends:
+        ansible: off
+        bash: off