|
| 1 | +# NIST SP 800-53 Revision 5 Compliance Profile |
| 2 | +# Designed for federal information systems and organisations seeking alignment |
| 3 | +# with NIST Special Publication 800-53 Rev. 5 security and privacy controls. |
| 4 | +# |
| 5 | +# Reference: NIST SP 800-53 Rev. 5 — Security and Privacy Controls for |
| 6 | +# Information Systems and Organizations (November 2020). |
| 7 | +# https://doi.org/10.6028/NIST.SP.800-53r5 |
| 8 | +# |
| 9 | +# Control families addressed by this profile (OS-level technical controls): |
| 10 | +# AC — Access Control |
| 11 | +# AU — Audit and Accountability |
| 12 | +# CM — Configuration Management |
| 13 | +# IA — Identification and Authentication |
| 14 | +# SC — System and Communications Protection |
| 15 | +# SI — System and Information Integrity |
| 16 | +# SA — System and Services Acquisition (subset) |
| 17 | +# RA — Risk Assessment (subset) |
| 18 | +# |
| 19 | +# Controls from AT (Awareness), CA (Assessment), IR (Incident Response), |
| 20 | +# PL (Planning), PM (Program Management), PS (Personnel), PE (Physical), |
| 21 | +# and SR (Supply Chain) require organisational policy and procedures |
| 22 | +# outside the scope of OS hardening. |
| 23 | +# |
| 24 | +# Each control annotation uses the NIST 800-53 Rev. 5 identifier: |
| 25 | +# Family-Number (e.g., AC-2, AU-12, SC-8). |
| 26 | +# Enhancements are noted in parentheses, e.g., SC-8(1). |
| 27 | + |
| 28 | +version: "1" |
| 29 | +profile: nist-800-53 |
| 30 | +environment: onprem |
| 31 | + |
| 32 | +modules: |
| 33 | + ssh: |
| 34 | + enabled: true |
| 35 | + # IA-2 — Identification and Authentication (Organisational Users) |
| 36 | + # IA-5 — Authenticator Management: enforce strong credential policies |
| 37 | + # AC-17 — Remote Access: authorise and monitor remote access sessions |
| 38 | + # SC-8 — Transmission Confidentiality and Integrity: protect data in transit |
| 39 | + # AU-12 — Audit Record Generation: log all access events |
| 40 | + client_alive_interval: 900 # AC-17(1): terminate idle remote sessions after 15 min |
| 41 | + client_alive_count_max: 0 # disconnect immediately when interval expires |
| 42 | + login_grace_time: 60 # IA-2: limit window for unauthenticated connections |
| 43 | + # IA-2 — No shared accounts; each user must be individually identified |
| 44 | + # AC-6 — Least Privilege: root access only through authorised escalation paths |
| 45 | + disable_root_login: true # AC-6(2): prohibit direct root login over SSH |
| 46 | + disable_empty_passwords: true # IA-5(1): passwords must meet complexity requirements |
| 47 | + # SC-8 — Transmission Confidentiality: disable channels that bypass encryption |
| 48 | + disable_x11_forwarding: true # SC-8: X11 forwarding can expose display sessions |
| 49 | + disable_hostbased_auth: true # IA-2: host-based auth bypasses individual accountability |
| 50 | + disable_ignore_rhosts: true # IA-2: .rhosts trust relationships prohibited |
| 51 | + disable_tcp_forwarding: false # evaluate per environment; set true if not required |
| 52 | + disable_agent_forwarding: false |
| 53 | + log_level: VERBOSE # AU-12: generate audit records for all SSH events |
| 54 | + max_auth_tries: 4 # AC-7: limit consecutive failed authentication attempts |
| 55 | + max_sessions: 10 |
| 56 | + # SC-8(1) — Cryptographic Protection: use NIST-approved algorithms (FIPS 140-3) |
| 57 | + # SC-13 — Cryptographic Protection: employ FIPS-validated cryptographic modules |
| 58 | + ciphers: |
| 59 | + - aes128-ctr |
| 60 | + - aes192-ctr |
| 61 | + - aes256-ctr |
| 62 | + - aes128-gcm@openssh.com |
| 63 | + - aes256-gcm@openssh.com |
| 64 | + - chacha20-poly1305@openssh.com |
| 65 | + macs: |
| 66 | + - hmac-sha2-256-etm@openssh.com |
| 67 | + - hmac-sha2-512-etm@openssh.com |
| 68 | + kex_algorithms: |
| 69 | + - curve25519-sha256 |
| 70 | + - curve25519-sha256@libssh.org |
| 71 | + - diffie-hellman-group14-sha256 |
| 72 | + - diffie-hellman-group16-sha512 |
| 73 | + - diffie-hellman-group18-sha512 |
| 74 | + |
| 75 | + firewall: |
| 76 | + enabled: true |
| 77 | + # SC-7 — Boundary Protection: monitor and control communications at system boundary |
| 78 | + # SC-7(5)— Deny by Default / Allow by Exception: default-deny traffic policy |
| 79 | + # AC-4 — Information Flow Enforcement: control information flow across boundaries |
| 80 | + # AU-12 — Audit Record Generation: log boundary crossing events |
| 81 | + backend: auto # auto-detect: ufw | nftables | firewalld |
| 82 | + default_inbound: drop # SC-7(5): deny-by-default inbound policy |
| 83 | + default_outbound: drop # SC-7(5): deny-by-default outbound policy |
| 84 | + log_dropped: true # AU-12: log all dropped boundary traffic |
| 85 | + # SC-7(11) — Restrict Incoming Communications: permit only from authorised sources. |
| 86 | + # Document every open port per CM-6 (Configuration Settings) and |
| 87 | + # CM-7 (Least Functionality). |
| 88 | + |
| 89 | + kernel: |
| 90 | + enabled: true |
| 91 | + # CM-6 — Configuration Settings: establish and document secure configurations |
| 92 | + # CM-7 — Least Functionality: disable or restrict unnecessary functions |
| 93 | + # SI-16 — Memory Protection: implement ASLR and related protections |
| 94 | + # SC-5 — Denial of Service Protection: implement SYN cookie and related controls |
| 95 | + # Kernel module enforces: |
| 96 | + # - kernel.randomize_va_space = 2 (SI-16: ASLR — memory protection) |
| 97 | + # - kernel.kptr_restrict = 2 (CM-6: restrict kernel pointer exposure) |
| 98 | + # - kernel.dmesg_restrict = 1 (CM-7: restrict access to kernel messages) |
| 99 | + # - net.ipv4 source routing disabled (SC-7: boundary protection) |
| 100 | + # - net.ipv4.conf.all.log_martians = 1 (AU-12: log suspicious packets) |
| 101 | + # - fs.suid_dumpable = 0 (AC-6: prevent SUID core dumps leaking data) |
| 102 | + |
| 103 | + users: |
| 104 | + enabled: true |
| 105 | + # AC-2 — Account Management: manage system accounts throughout lifecycle |
| 106 | + # AC-3 — Access Enforcement: enforce approved authorisations |
| 107 | + # AC-6 — Least Privilege: employ the principle of least privilege |
| 108 | + # IA-5 — Authenticator Management: enforce password policy requirements |
| 109 | + # IA-5(1)— Password-Based Authentication: enforce complexity and history |
| 110 | + # AC-7 — Unsuccessful Logon Attempts: enforce lockout after failed attempts |
| 111 | + password_max_days: 60 # IA-5(1)(d): time-based expiration for federal systems |
| 112 | + password_min_days: 1 # IA-5(1): prevent immediate password recycling |
| 113 | + password_warn_age: 14 # advance notification before expiry |
| 114 | + password_min_length: 15 # IA-5(1)(a): NIST High baseline — ≥ 15 characters |
| 115 | + password_complexity: true # IA-5(1)(a): mix of character types required |
| 116 | + password_history: 24 # IA-5(1)(e): NIST High: remember 24 previous passwords |
| 117 | + # AC-7 — enforce lockout to protect against brute-force attacks |
| 118 | + lockout_attempts: 3 # AC-7(a): lock after 3 consecutive failures (NIST High) |
| 119 | + lockout_duration: 3600 # AC-7(b): 1-hour lockout or until administrator reset |
| 120 | + # AC-2(3)— Disable Inactive Accounts: automatically disable after inactivity period |
| 121 | + inactive_account_lock_days: 35 # AC-2(3): NIST recommendation — 35-day inactivity limit |
| 122 | + su_restricted: true # AC-6(2): prohibit direct privilege escalation without auth |
| 123 | + umask: "027" # AC-3: restrict default file creation permissions |
| 124 | + |
| 125 | + filesystem: |
| 126 | + enabled: true |
| 127 | + # CM-6 — Configuration Settings: apply OS hardening to filesystems |
| 128 | + # CM-7 — Least Functionality: disable unused filesystem modules |
| 129 | + # AC-3 — Access Enforcement: restrict access to sensitive filesystem areas |
| 130 | + # SI-7 — Software, Firmware, and Information Integrity: protect from tampering |
| 131 | + tmp_nosuid: true # CM-7: prevent SUID execution from temporary directories |
| 132 | + tmp_nodev: true |
| 133 | + tmp_noexec: true # CM-7: prevent code execution from /tmp |
| 134 | + devshm_nosuid: true |
| 135 | + devshm_nodev: true |
| 136 | + devshm_noexec: true |
| 137 | + var_nosuid: true |
| 138 | + var_tmp_nosuid: true |
| 139 | + var_tmp_nodev: true |
| 140 | + var_tmp_noexec: true |
| 141 | + home_nodev: true |
| 142 | + # CM-7 — Least Functionality: disable unused filesystem types |
| 143 | + disable_cramfs: true |
| 144 | + disable_freevxfs: true |
| 145 | + disable_jffs2: true |
| 146 | + disable_hfs: true |
| 147 | + disable_hfsplus: true |
| 148 | + disable_udf: true |
| 149 | + |
| 150 | + auditd: |
| 151 | + enabled: true |
| 152 | + # AU-2 — Event Logging: identify events requiring audit |
| 153 | + # AU-3 — Content of Audit Records: capture sufficient detail per event |
| 154 | + # AU-4 — Audit Log Storage Capacity: allocate sufficient storage |
| 155 | + # AU-5 — Response to Audit Logging Process Failures: alert on failure |
| 156 | + # AU-9 — Protection of Audit Information: protect audit records from modification |
| 157 | + # AU-11 — Audit Record Retention: retain records for required period |
| 158 | + # AU-12 — Audit Record Generation: generate records for auditable events |
| 159 | + max_log_file_size: 64 # AU-4: 64 MB per log file |
| 160 | + num_logs: 20 # AU-11: retain 20 rotated files (supports 90-day minimum) |
| 161 | + action_on_space_left: email # AU-5(2): alert administrators before capacity exhausted |
| 162 | + space_left_mb: 250 # AU-4: alert with 250 MB remaining |
| 163 | + immutable: true # AU-9(3): make audit configuration immutable at runtime |
| 164 | + audit_privileged_commands: true # AU-2: log all privileged command executions |
| 165 | + audit_file_access: true # AU-12: log unauthorised and failed file access attempts |
| 166 | + audit_user_events: true # AU-2: log all logon, logoff, and session events |
| 167 | + audit_sudo_commands: true # AU-12: log all administrative actions via sudo |
| 168 | + audit_network_changes: true # AU-12: log changes to network configuration |
| 169 | + audit_time_change: true # AU-8: detect and log system time modifications |
| 170 | + |
| 171 | + services: |
| 172 | + enabled: true |
| 173 | + # CM-7 — Least Functionality: prohibit or restrict unnecessary functions and services |
| 174 | + # CM-7(1)— Periodic Review: review and disable functions not required |
| 175 | + disable: |
| 176 | + - xinetd |
| 177 | + - inetd |
| 178 | + - avahi-daemon # CM-7: mDNS/zeroconf not required on managed federal systems |
| 179 | + - cups # CM-7: printing service — disable on non-print servers |
| 180 | + - dhcpd |
| 181 | + - slapd |
| 182 | + - nfs-server |
| 183 | + - bind |
| 184 | + - vsftpd |
| 185 | + - httpd |
| 186 | + - apache2 |
| 187 | + - nginx # CM-7: disable unless documented application requirement |
| 188 | + - dovecot |
| 189 | + - sendmail |
| 190 | + - samba |
| 191 | + - squid |
| 192 | + - snmpd # CM-7: SNMPv1/v2c transmit credentials in cleartext |
| 193 | + - nis |
| 194 | + - telnet # SC-8: cleartext protocol — prohibited; use SSH |
| 195 | + - rsh-server # IA-2: host-trust based auth not permitted |
| 196 | + - tftp-server |
| 197 | + - rsync |
| 198 | + |
| 199 | + network: |
| 200 | + enabled: true |
| 201 | + # SC-7 — Boundary Protection: control communications at boundary |
| 202 | + # CM-7 — Least Functionality: disable unused network protocols |
| 203 | + # SC-5 — Denial of Service Protection: implement protective controls |
| 204 | + disable_ipv6: false # CM-7: set true if IPv6 is not operationally required |
| 205 | + disable_wireless: true # CM-7: disable unused wireless interfaces on servers |
| 206 | + disable_dccp: true # CM-7: disable uncommon protocol not used |
| 207 | + disable_sctp: true |
| 208 | + disable_rds: true # CM-7: disable Reliable Datagram Sockets |
| 209 | + disable_tipc: true # CM-7: disable Transparent Inter-Process Communication |
| 210 | + |
| 211 | + crypto: |
| 212 | + enabled: true |
| 213 | + # SC-8 — Transmission Confidentiality and Integrity: protect data in transit |
| 214 | + # SC-8(1)— Cryptographic Protection: use NIST-approved algorithms |
| 215 | + # SC-13 — Cryptographic Protection: employ FIPS 140-3 validated modules |
| 216 | + min_tls_version: "1.2" # SC-8(1): TLS 1.0 and 1.1 are prohibited |
| 217 | + disable_weak_ciphers: true # SC-13: remove RC4, DES, 3DES — not NIST-approved |
| 218 | + disable_weak_hashes: true # SC-13: reject MD5 and SHA-1 for integrity operations |
| 219 | + |
| 220 | + logging: |
| 221 | + enabled: true |
| 222 | + # AU-11 — Audit Record Retention: retain audit records for minimum defined period |
| 223 | + # AU-4 — Audit Log Storage Capacity: ensure adequate log storage |
| 224 | + # AU-9 — Protection of Audit Information: protect log integrity |
| 225 | + log_retention_days: 1095 # AU-11: 3 years minimum for NIST High baseline |
| 226 | + remote_log_host: "" # AU-9: forward to centralised log server (recommended) |
| 227 | + remote_log_protocol: tcp # TCP for reliable delivery |
| 228 | + |
| 229 | + mac: |
| 230 | + enabled: true |
| 231 | + # AC-3(3)— Mandatory Access Control: enforce MAC policy for all subjects and objects |
| 232 | + # AC-6 — Least Privilege: enforce least-privilege through MAC |
| 233 | + # SC-39 — Process Isolation: maintain separate execution domains per process |
| 234 | + enforce: true |
| 235 | + deny_unknown: true # AC-3(3): deny access to unconfined processes (NIST High) |
| 236 | + |
| 237 | + ntp: |
| 238 | + enabled: true |
| 239 | + # AU-8 — Time Stamps: use system clocks that synchronise to authorised sources |
| 240 | + # AU-8(1)— Synchronisation with Authorised Time Source: use at least two sources |
| 241 | + backend: auto |
| 242 | + timezone: UTC |
| 243 | + # AU-8(1): configure at least two authorised NTP sources. |
| 244 | + # Federal systems should use NIST Internet Time Service or DoD NTP servers. |
| 245 | + # servers: |
| 246 | + # - time.nist.gov |
| 247 | + # - time-a-g.nist.gov |
| 248 | + |
| 249 | + updates: |
| 250 | + enabled: true |
| 251 | + # SI-2 — Flaw Remediation: identify, report, and correct system flaws |
| 252 | + # SI-2(2)— Automated Flaw Remediation Status: automate patch installation |
| 253 | + # RA-5 — Vulnerability Monitoring and Scanning: identify and remediate vulnerabilities |
| 254 | + unattended_security_upgrades: true |
| 255 | + auto_reboot: false # schedule reboots within authorised change windows |
| 256 | + |
| 257 | + containers: |
| 258 | + enabled: false # enable if running containerised workloads |
| 259 | + # CM-7 — Least Functionality: apply to containerised environments |
| 260 | + # AC-6 — Least Privilege: enforce namespace isolation and rootless operation |
| 261 | + # SI-3 — Malicious Code Protection: apply seccomp and MAC profiles |
| 262 | + # SC-39 — Process Isolation: maintain process boundaries via namespaces |
| 263 | + |
| 264 | +report: |
| 265 | + format: html |
| 266 | + output_dir: /var/lib/hardbox/reports |
| 267 | + include_remediation: true |
| 268 | + include_evidence: true # AU-3: include evidence to support audit records |
| 269 | + |
| 270 | +audit: |
| 271 | + fail_on_critical: true |
| 272 | + fail_on_high: true |
| 273 | + fail_on_medium: true # NIST High baseline: medium findings also require remediation |
0 commit comments