Add Amazon Linux 2023 DISA STIG Profile #14246

Eric-Domeier · 2025-12-16T00:59:16Z

Description:

Add a DISA STIG Profile for Amazon Linux 2023 and attempts to make the results importable to stig viewer

Rationale:

Amazon linux 2023 stig profile is useful for federal agencies, cmmc, fedramp etc.
Amazon Linux 2023 Department of War (Previously Department of Defense) STIG #13885

Review Hints:

This builds off of @jesseborden branch, attempts to get the --stig-viewer flag working properly.
products/al2023/overlays/srg_support.xml is just a copy paste from products/rhel8/overlays/srg_support.xml with name replaced, the content hasn't actually been checked yet.
I haven't verified the content in controls/stig_al2023.yml yet
modifies applicability templates to ensure checks are applicable for al2023

To-do

There are 131 checks that are not remediated (Still failing after running the fix scripts)

…ew and validation of each control.

bring up to date

…s, first attempt

…ux to templates.

openshift-ci · 2025-12-16T00:59:27Z

Hi @Eric-Domeier. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Eric-Domeier · 2025-12-16T02:52:40Z

products/al2023/overlays/srg_support.xml

Needs further review, copy-pasted from RHEL8

Dockerfiles/test_suite-al2023

products/al2023/CMakeLists.txt

products/al2023/profiles/standard.profile

products/al2023/profiles/stig.profile

github-actions · 2025-12-17T13:38:40Z

ATEX Test Results

Test artifacts have been submitted to Testing Farm.

Results: View Test Results
Workflow Run: View Workflow Details

This comment was automatically generated by the ATEX workflow.

openshift-merge-robot · 2026-01-18T00:52:12Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Co-authored-by: Jan Černý <jcerny@redhat.com>

Eric-Domeier · 2026-01-18T19:11:00Z

@Mab879 @jan-cerny I could use some input on the AIDE Database check rule. Currently when running this profile, it "passes" but when ran manually I get the following output

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------

Directory: /boot/loader/entries
 Mtime     : 2026-01-18 17:11:10 +0000        | 2026-01-18 18:25:10 +0000
 Ctime     : 2026-01-18 17:11:10 +0000        | 2026-01-18 18:25:10 +0000

File: /boot/loader/entries/ee78bed5782442a1a6344896391bb47b-6.1.158-180.294.amzn2023.x86_64.conf
 Mtime     : 2026-01-18 17:11:10 +0000        | 2026-01-18 18:25:10 +0000
 Ctime     : 2026-01-18 17:11:10 +0000        | 2026-01-18 18:25:10 +0000

File: /root/.bash_history
 SHA512    : eSAQneKNnsRlm7rLH3UA/pyw1owdWjwO | zHST6EDoUHJlZZgARSx+Y8lN8nZJ8bTP
             2XvvA7anzu15wGHSlUu9+G7h6VFgjmTG | qOC5YBBEiMrlhHLcNN3Rad8YiBmrNvbY
             //D3ke9ALqv2vN1JkfWN9w==         | rlf7vva5szUCEr7qOcbbOg==

File: /var/log/journal/dcc583e8d48d4700801f7f110769af4b/system.journal
 SHA512    : 1zOyQedep75D4pQz9sAlyL3BKbZaXDk7 | DPUpJseIUblLa1fEJDvOyWWvVK/+uqUD
             12AGhCMmj03y7hflKvpyIC6pVNwQUy+x | N7COWgdIEyWTgBkctTUCCnF+VvxStWJR
             0o6D05Ds3+ec/6JvpiM4+Q==         | 0XGwxuljfZF/thq5XCmgCA==

File: /var/log/journal/dcc583e8d48d4700801f7f110769af4b/user-1000.journal
 SHA512    : upY4mUVALfpSnEDWDCVOCjYETMAjijhU | At1JC9vXr0Q32/WAmAS8Gu78YyQwmCW9
             853yKVlG21zp68VaYHTt/xHP8FD8Jf6A | p3Nf0YInPNnVnpRQ8m+65I6BnDK3t6hB
             sLIDF5orcNvbFWynBsFNaw==         | zGPiz2mM2oIyjZrommoCxg==

File: /var/log/lastlog
 Mtime     : 2026-01-18 17:22:38 +0000        | 2026-01-18 18:25:52 +0000
 Ctime     : 2026-01-18 17:22:38 +0000        | 2026-01-18 18:25:52 +0000
 SHA512    : JZcxWxEZ8YugK42+6vukJlGA1ex4pX87 | d/Q17T5vKL4F5TcuGUrptEhFjLibqhor
             18r6P8UdPXezhHyqEz+q3b7nKxv7YUmP | Czv2ZyaDDLXl9w9vsr6vI5LhiJUGmznP
             X5w8ssJVSSlZuE9RcDu8aw==         | W4rtIKGwaHhbm8rY7RLHAA==

So I guess there's really two issues here

Issue 1: expected output for a "Pass" should be

AIDE found NO differences between database and filesystem. Looks okay!!

Issue 2: /var/log, .bash_history are volatile paths that should probably be whitelisted in /etc/aide.conf - is there already a rule somewhere to add paths for whitelisting i'm not seeing?

For the /boot/loader/entries I'm guessing the remediation script is changing something here after AIDE database is built

bordencastle · 2026-01-18T20:13:37Z

controls/stig_al2023.yml

+    title: Amazon Linux 2023 must have the packages required for encrypting
+      off-loaded audit logs installed.
+    rules: 
+      - package_rsyslog-gnutls_installed


@Eric-Domeier I think this should be rsyslog-openssl

Correct, I modified the rule as such here

linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml

Not sure if this is the preferred way or not though, it is correctly using rsyslog-openssl however

Also attempted to fix that one here. bordencastleadmin@0f4ebdf

controls/stig_al2023.yml

bordencastle · 2026-01-18T20:19:23Z

controls/stig_al2023.yml

+      audit records off-loaded onto a different system or media from the system
+      being audited via rsyslog.
+    rules:
+      - rsyslog_encrypt_offload_defaultnetstreamdriver


This value should be set to ossl.
See where I attempted to do that here.... bordencastleadmin@0f4ebdf

But I think the original rule could maybe be used, then just pass in the option/variable of ossl if amazon linux 2023 instead of creating a totally new rule.

controls/stig_al2023.yml

bordencastle · 2026-01-18T20:51:02Z

controls/stig_al2023.yml

+    title: Amazon Linux 2023 must enable certificate-based smart card
+      authentication.
+    rules:
+      - sssd_enable_smartcards


sssd must be installed first. Add package_sssd_installed rule.

I think a couple more of those sssd rules will become applicable and get remediated if this is added in. Amazon Linux 2023 does not have sssd installed by default it appears.

There was something strange with the overrides for the packages and the macros not working when I tried it though, I don't know why, but that's why I updated the macros here to make the sssd install work. bordencastleadmin@0f4ebdf#diff-182dc0614884550d3533d1e8d12b71afe23ffa8d96c22e3a07992754d5e13e93

If you look at the /build/al2023/product.yml it has a platform_package_overrides section, but without changing those macros it seemed to keep tying the original packages and not the overrides.

I notice in builds/al2023/fixes/ansible/package_sssd_installed.yml we have this:

# platform = multi_platform_all # reboot = false # strategy = enable # complexity = low # disruption = low - name: Gather the package facts package_facts: manager: auto tags: - DISA-STIG-AZLX-23-001290 - NIST-800-53-CM-6(a) - enable_strategy - low_complexity - low_disruption - medium_severity - no_reboot_needed - package_sssd_installed - name: Ensure sssd is installed ansible.builtin.package: name: sssd state: present **when: '"sssd-common" in ansible_facts.packages'** tags: - DISA-STIG-AZLX-23-001290 - NIST-800-53-CM-6(a) - enable_strategy - low_complexity - low_disruption - medium_severity - no_reboot_needed - package_sssd_installed

sssd-common is also not installed in vanilla al2023 so might be why its not installing, looking into that

Yeah having trouble tracking down why that "when" clause exists, but if i install sssd-common manually before running the remediation, oscap successfully applies the sssd rules. not sure if this is intended or not

bordencastle · 2026-01-18T21:01:20Z

controls/stig_al2023.yml

+    title: Amazon Linux 2023 must be configured to off-load audit records onto a
+      different system from the system being audited via syslog.
+    rules:
+      - rsyslog_remote_loghost


I think the rules here should be replaced with:
- service_systemd-journal-upload_enabled
- systemd_journal_upload_url

…, fix session timeout check/fix

jesseborden and others added 8 commits September 6, 2025 11:41

generatefromRHEL9similarities

73368ab

Update stig_al2023.yml

bbb2c69

added working shell that works with build_product. Still pending revi…

a28d11c

…ew and validation of each control.

Merge pull request #1 from ComplianceAsCode/master

43637b6

bring up to date

Add the required cmake build, stig overlays, xccdf refence, transform…

a4c6bd0

…s, first attempt

Fix issue with system with kernel evaluating to false, add Amazon lin…

792a0c0

…ux to templates.

Attempt to fix linting, eof gate check fails

3fd77eb

Fix spaces

f8b96a2

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Dec 16, 2025

Eric-Domeier mentioned this pull request Dec 16, 2025

Add Amazon Linux 2023 DISA STIG Profile #14238

Closed

Eric-Domeier commented Dec 16, 2025

View reviewed changes

products/al2023/overlays/srg_support.xml

Copy link

Author

Eric-Domeier Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs further review, copy-pasted from RHEL8

Mab879 added this to the 0.1.80 milestone Dec 16, 2025

Mab879 added the New Profile Issues or pull requests related to new Profiles. label Dec 16, 2025

jan-cerny self-assigned this Dec 17, 2025

jan-cerny reviewed Dec 17, 2025

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jan 18, 2026

Eric-Domeier requested review from Mab879, matusmarhefka and vojtapolasek as code owners January 18, 2026 01:22

Eric-Domeier force-pushed the remove-merge-commit branch from 70bb4f9 to 11a42b6 Compare January 18, 2026 01:57

Eric-Domeier and others added 5 commits January 17, 2026 21:16

Fix SME list

a3a849d

Update Dockerfiles/test_suite-al2023

3c63edb

Co-authored-by: Jan Černý <jcerny@redhat.com>

Fix AZLX-23-002610,AZLX-23-000130

ee887f3

Remove empty profile, add newline, remove unused profiles

6aa5e34

Add additional audit rules

7e48d66

Eric-Domeier force-pushed the remove-merge-commit branch from fa66171 to 7e48d66 Compare January 18, 2026 02:16

Add additional rules

a9d993c

Eric-Domeier added 3 commits January 18, 2026 11:48

Adds custom grub, rsyslog for amazon linux

6755d9a

Fix aide conf path, jounrnalctl

eedc042

Fixes the AIDE Rule from error to pass, but it should not be passing

b9c1345

bordencastle reviewed Jan 18, 2026

View reviewed changes

controls/stig_al2023.yml Outdated Show resolved Hide resolved

bordencastle reviewed Jan 18, 2026

View reviewed changes

controls/stig_al2023.yml Show resolved Hide resolved

bordencastle reviewed Jan 18, 2026

View reviewed changes

Eric-Domeier added 4 commits January 18, 2026 16:14

Update version

fbf20b6

Add bordencastles authselect and sssd fixes

56d5ca7

Change platform to amzn to avoid confusion with Alma Linux or Alibaba…

c5b1185

…, fix session timeout check/fix

Fix rsyslog-openssl package installed rule

273e9dc

Add Amazon Linux 2023 DISA STIG Profile #14246

Are you sure you want to change the base?

Add Amazon Linux 2023 DISA STIG Profile #14246

Conversation

Eric-Domeier commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

To-do

Uh oh!

openshift-ci bot commented Dec 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Dec 17, 2025

ATEX Test Results

Uh oh!

openshift-merge-robot commented Jan 18, 2026

Uh oh!

Eric-Domeier commented Jan 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bordencastle Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bordencastle Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Eric-Domeier commented Dec 16, 2025 •

edited

Loading

bordencastle Jan 18, 2026 •

edited

Loading

bordencastle Jan 18, 2026 •

edited

Loading