Debian13 20260702 by a-skr · Pull Request #14851 · ComplianceAsCode/content

a-skr · 2026-07-02T13:25:33Z

Description:

add a debian13 test container
update debian13 cis benchmarks
add some new rules related to apt configuration
add CIS related profiles

openshift-ci · 2026-07-02T13:25:45Z

Hi @a-skr. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2026-07-02T13:31:49Z

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

github-actions · 2026-07-02T14:08:30Z

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

jan-cerny · 2026-07-07T08:15:33Z

+          - l1_server
+          - l1_workstation
+      rules:
+          - var_password_hashing_algorithm_pam=yescrypt


The CIS Benchmark allows both SHA512 and yescrypt. You should create and select value that allows both ciphers, see linux_os/guide/system/accounts/accounts-pam/var_password_hashing_algorithm_pam.var how we did that for RHEL 10.

will be fixed with next commits

jan-cerny · 2026-07-07T08:24:57Z

+      levels:
+          - l2_server
+          - l2_workstation
+      rules:


missing status: field

will be fixed with next commits

jan-cerny · 2026-07-07T08:26:24Z

+          - file_permissions_var_log_gdm
+          - file_permissions_var_log_gdm3
+          - file_permissions_var_log_lastlog
+          - file_permissions_var_log_cloud-init


file_permissions_var_log_cloud-init appears twice

will be fixed with next commits

jan-cerny · 2026-07-07T08:27:57Z

+      status: automated
+
+    - id: 2.1.16
+      title: Ensure tftp server services are not in use (Automated)


The requirement 2.1.16 should be about telnet

2.1.16 Ensure telnet-server services are not in use (Automated)

it will be fixed in next commits, along with the related rules. That includes updating some template files to handle virtual debian packages properly.

jan-cerny · 2026-07-07T08:29:07Z

+          - l1_server
+          - l1_workstation
+      rules:
+          - sshd_strong_macs=cis_debian12


I'd suggest creating a special selector for Debian 13 even if that would have the same value.

will be fixed with next commits.

jan-cerny · 2026-07-07T08:30:49Z

+    - id: 3.3.1.
+      title: Ensure  is configured (Automated)


Suspicious. Please remove this item.

will be fixed with next commits.

jan-cerny · 2026-07-07T08:31:19Z

+      status: automated
+
+    - id: 7.1.4
+      title: Ensure paccess to /etc/group- is configured (Automated)


will be fixed with next commits.

jan-cerny · 2026-07-07T08:31:39Z

+      status: pending
+
+    - id: 3.3.2.1
+      title: Ensure Ensure net.ipv6.conf.all.forwarding is configured (Automated)


duplicate "Ensure"

will be fixed with next commits.

jan-cerny

The CI fails can be observed also in other PRs and they aren't caused by contents of this PR.

Wires the Debian 13 test-suite container (added in #14851) and the debian13 product into CI: on PRs touching content, build the ssg-debian13-ds.xml datastream, then run the affected rules against a debian:13 target with bash and ansible remediation — mirroring the existing automatus-debian12 workflow (only product/datastream names differ). Validated locally: Dockerfiles/test_suite-debian13 builds on debian:13 with openscap-scanner 1.4.2, and ./build_product debian13 produces build/ssg-debian13-ds.xml. Signed-off-by: rrskris <rrskris@gmail.com>

a-skr requested review from Mab879, jan-cerny, matusmarhefka and vojtapolasek as code owners July 2, 2026 13:25

openshift-ci Bot added the needs-ok-to-test Used by openshift-ci bot. label Jul 2, 2026

a-skr force-pushed the debian13-20260702 branch from f6a726b to 97cc46c Compare July 2, 2026 14:02

Mab879 added this to the 0.1.82 milestone Jul 2, 2026

jan-cerny requested changes Jul 7, 2026

View reviewed changes

a-skr added 12 commits July 9, 2026 16:35

add a debian13 test suite container

1599eaf

add new rule: apt_conf_disable_recommends

079ae4e

add new rule: apt_conf_disable_suggests

6717f8e

add some rules in debian13 CIS benchmark

35d91ab

add debian 13 CIS profiles

3ab4982

add debian support in grub2_bootloader_argument aval template

638f60b

debian13: allow yescrypt and SHA512 for cis rule 5.3.3.4.3

65d35ee

debian13: allow yescrypt and SHA512 for cis rule 5.4.1.4

52c2bd3

debian13: add missing status for rule 6.2.3.12

9eedfda

debian13: remove duplicate rule in cis 6.1.3.1

f981b9e

update bash_remove_package macro to handle virtual packages on debian

296b8d0

enable debian remediation for service_disabled template

87c0c48

a-skr force-pushed the debian13-20260702 branch from 97cc46c to 1cffdf4 Compare July 9, 2026 14:35

jan-cerny requested changes Jul 10, 2026

View reviewed changes

jan-cerny self-assigned this Jul 10, 2026

a-skr added 4 commits July 11, 2026 09:35

fix service_telnet_disabled rule for debian13

9b972e1

debian13: fix cis controls related to tftp and telnet

73038cc

fix typos in cis_debian13.yml

4f026eb

remove extra spaces after shebangs

e4812f2

a-skr force-pushed the debian13-20260702 branch from 7c48091 to e4812f2 Compare July 11, 2026 07:52

jan-cerny approved these changes Jul 14, 2026

View reviewed changes

jan-cerny merged commit f1db4db into ComplianceAsCode:master Jul 14, 2026
48 of 58 checks passed

jan-cerny added Highlight This PR/Issue should make it to the featured changelog. Update Profile Issues or pull requests related to Profiles updates. CIS CIS Benchmark related. Debian Debian product related. labels Jul 14, 2026

rrskris mentioned this pull request Jul 14, 2026

Add Automatus CI workflow for Debian 13 #14885

Merged

Uh oh!

Conversation

a-skr commented Jul 2, 2026

Description:

Uh oh!

openshift-ci Bot commented Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants