---
# SYSTEM CONFIGURATION
# ====================
# These are not meant to be modified by the user

# suid and sgid blacklists and whitelists
# ---------------------------------------
# don't change values in the system_blacklist/whitelist
# adjust values for blacklist/whitelist instead, they can override system_blacklist/whitelist

# list of suid/sgid entries that must be removed
os_security_suid_sgid_system_blacklist:
  # blacklist as provided by NSA
  - '/usr/bin/rcp'
  - '/usr/bin/rlogin'
  - '/usr/bin/rsh'
  # sshd must not use host-based authentication (see ssh cookbook)
  - '/usr/libexec/openssh/ssh-keysign'
  - '/usr/lib/openssh/ssh-keysign'
  # misc others
  - '/sbin/netreport'                                            # not normally required for user
  - '/usr/sbin/usernetctl'                                       # modify interfaces via functional accounts
  # connecting to ...
  - '/usr/sbin/userisdnctl'                                      # no isdn...
  - '/usr/sbin/pppd'                                             # no ppp / dsl ...
  # lockfile
  - '/usr/bin/lockfile'
  - '/usr/bin/mail-lock'
  - '/usr/bin/mail-unlock'
  - '/usr/bin/mail-touchlock'
  - '/usr/bin/dotlockfile'
  # need more investigation blacklist for now
  - '/usr/bin/arping'
  - '/usr/sbin/uuidd'
  - '/usr/bin/mtr'                                               # investigate current state...
  - '/usr/lib/evolution/camel-lock-helper-1.2'                   # investigate current state...
  - '/usr/lib/pt_chown'                                          # pseudo-tty needed?
  - '/usr/lib/eject/dmcrypt-get-device'
  - '/usr/lib/mc/cons.saver'                                      # midnight commander screensaver

# list of suid/sgid entries that can remain untouched
os_security_suid_sgid_system_whitelist:
  # whitelist as provided by NSA
  - '/bin/mount'
  - '/bin/ping'
  - '/bin/su'
  - '/usr/bin/su'
  - '/bin/umount'
  - '/sbin/pam_timestamp_check'
  - '/sbin/unix_chkpwd'
  - '/usr/bin/at'
  - '/usr/bin/gpasswd'
  - '/usr/bin/locate'
  - '/usr/bin/newgrp'
  - '/usr/bin/passwd'
  - '/usr/bin/ssh-agent'
  - '/usr/libexec/utempter/utempter'
  - '/usr/sbin/lockdev'
  - '/usr/sbin/sendmail.sendmail'
  - '/usr/bin/expiry'
  # whitelist ipv6
  - '/bin/ping6'
  - '/usr/bin/traceroute6.iputils'
  # whitelist nfs
  - '/sbin/mount.nfs'
  - '/sbin/umount.nfs'
  # whitelist nfs4
  - '/sbin/mount.nfs4'
  - '/sbin/umount.nfs4'
  # whitelist cron
  - '/usr/bin/crontab'
  # whitelist consolemssaging
  - '/usr/bin/wall'
  - '/usr/bin/write'
  # whitelist: only SGID with utmp group for multi-session access
  # impact is limited; installation/usage has some remaining risk
  - '/usr/bin/screen'
  # whitelist locate
  - '/usr/bin/mlocate'
  # whitelist usermanagement
  - '/usr/bin/chage'
  - '/usr/bin/chfn'
  - '/usr/bin/chsh'
  # whitelist fuse
  - '/bin/fusermount'
  # whitelist pkexec
  - '/usr/bin/pkexec'
  # whitelist sudo
  - '/usr/bin/sudo'
  - '/usr/bin/sudoedit'
  # whitelist postfix
  - '/usr/sbin/postdrop'
  - '/usr/sbin/postqueue'
  # whitelist apache
  - '/usr/sbin/suexec'
  # whitelist squid
  - '/usr/lib/squid/ncsa_auth'
  - '/usr/lib/squid/pam_auth'
  # whitelist kerberos
  - '/usr/kerberos/bin/ksu'
  # whitelist pam_caching
  - '/usr/sbin/ccreds_validate'
  # whitelist Xorg
  - '/usr/bin/Xorg'                                              # xorg
  - '/usr/bin/X'                                                 # xorg
  - '/usr/lib/dbus-1.0/dbus-daemon-launch-helper'                # freedesktop ipc
  - '/usr/lib/vte/gnome-pty-helper'                              # gnome
  - '/usr/lib/libvte9/gnome-pty-helper'                          # gnome
  - '/usr/lib/libvte-2.90-9/gnome-pty-helper'                     # gnome

# system accounts that do not get their login disabled and pasword changed
os_always_ignore_users: ['root', 'sync', 'shutdown', 'halt']