Controls configured by OpenLogic

The following CIS controls are pre-configured by the OpenLogic team as part of the hardened image build process. Applicability varies by image type. VM images include OS-level configurations such as cryptography and SSH settings. Container images may include runtime or base image configurations.

These controls are implemented to ensure baseline compliance and security without requiring additional user intervention.

For the current benchmark version and related release note information, see CIS benchmark version 0.1.81.

Virtual machine images

  • CIS 1.6.1: The system cryptography policy is set to FIPS (but in disabled state)

    This only sets the crypto-policy profile to FIPS-compliant algorithms, it does not enable full kernel FIPS mode. Full kernel FIPS mode is untouched/out of scope.

  • CIS 1.6.1: The system cryptography policy is set to FIPS (but in disabled state)

    This only sets the crypto-policy profile to FIPS-compliant algorithms, it does not enable full kernel FIPS mode. Full kernel FIPS mode is untouched/out of scope.

  • CIS 5.4.2.5: Ensure root PATH integrity (all directories in the root PATH exist). The root user's PATH includes six standard directories. Two of them, /root/.local/bin and /root/bin, are not created by default on the cloud image, which caused this control to fail. OpenLogic creates all six directories (owner root:root, mode 0755) during the image build and adds a systemd-tmpfiles rule so that /root/.local/bin and /root/bin are recreated at every boot if they are missing. This does not change the contents of root's PATH or the behavior of the root shell.

  • CIS 1.6.1: The system cryptography policy is set to FIPS (but in disabled state)

    This only sets the crypto-policy profile to FIPS-compliant algorithms, it does not enable full kernel FIPS mode. Full kernel FIPS mode is untouched/out of scope.

  • CIS 2.4.1.1: AlmaLinux’s vendor-packaged datastream (scap-security-guide-0.1.81) has an OVAL check that queries the RPM database for a package named cron. However, no such package exists on AlmaLinux/RHEL 8. Instead, there is a package named cronie that provides the cron functionality under a different name. Therefore, we have added remediation to install the cronie package. This is a temporary fix that will be removed after the datastream file is fixed.

  • CIS 1.6.1: The system cryptography policy is set to FIPS (but in disabled state)

    This only sets the crypto-policy profile to FIPS-compliant algorithms, it does not enable full kernel FIPS mode. Full kernel FIPS mode is untouched/out of scope.

  • CIS 2.4.1.1: AlmaLinux’s vendor-packaged datastream (scap-security-guide-0.1.81) has an OVAL check that queries the RPM database for a package named cron. However, no such package exists on AlmaLinux/RHEL 8. Instead, there is a package named cronie that provides the cron functionality under a different name. Therefore, we have added remediation to install the cronie package. This is a temporary fix that will be removed after the datastream file is fixed.

  • CIS 5.4.2.5: Ensure root PATH integrity (all directories in the root PATH exist). The root user's PATH includes six standard directories. Two of them, /root/.local/bin and /root/bin, are not created by default on the cloud image, which caused this control to fail. OpenLogic creates all six directories (owner root:root, mode 0755) during the image build and adds a systemd-tmpfiles rule so that /root/.local/bin and /root/bin are recreated at every boot if they are missing. This does not change the contents of root's PATH or the behavior of the root shell.