Initial collection structure

Migrated from legacy playbook repo into Ansible collection format:

Roles (171 total):
- common: 44 roles (fact gathering, SSH setup, utilities)
- configuration: 32 roles (system config, networking, satellite)
- provisioning: 16 roles (VMware, Azure, physical server deployment)
- security: 15 roles (OpenSCAP hardening, certificates, AD integration)
- monitoring: 12 roles (Zabbix, logging agents, metrics)
- networking: 12 roles (DNS, DHCP, network interfaces)
- satellite: 4 roles (Pulp/Satellite management)
- misc: 36 roles (various utilities)

Playbooks (159 total):
- provisioning: 14 playbooks
- azure: 13 playbooks
- configuration: 22 playbooks
- maintenance: 10 playbooks
- security: 10 playbooks
- monitoring: 9 playbooks
- vcenter: 6 playbooks
- networking: 7 playbooks
- misc: 65 playbooks

roles/security/backup_certs_and_keys/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Created by the UFST Linux team

roles/security/backup_certs_and_keys/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for backup_certs_and_keys

roles/security/backup_certs_and_keys/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for backup_certs_and_keys

roles/security/backup_certs_and_keys/meta/main.yml

@@ -0,0 +1,57 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 1.2
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list of versions.
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/backup_certs_and_keys/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+# tasks file for backup_certs_and_keys
+- name: Find old tarballs
+  shell: find /tmp/ -maxdepth 1 -type f | grep 'certs-and-keys.*.tar'
+  register: files_to_delete
+  ignore_errors: yes
+
+- name: Files to delete
+  debug: msg={{ files_to_delete.stdout_lines }}
+
+- name: Remove old tarballs
+  file:
+    state: absent
+    path: "{{ item }}"
+  with_items: 
+    - "{{ files_to_delete.stdout_lines }}"
+
+- name: Copy all Openshift certificates into a tarball on each host
+  shell: /usr/bin/tar cf /tmp/certs-and-keys-$(hostname)-$(date +"%Y-%m-%d_%H-%M-%S").tar /etc/origin/master/*.key /etc/origin/master/*.crt
+
+- name: Find tarball on each host
+  shell: find /tmp/ -maxdepth 1 -type f | grep 'certs-and-keys*' | sort -r | head -1
+  register: files_to_copy
+  ignore_errors: yes
+
+- name: Files to copy
+  debug: msg={{ files_to_copy.stdout_lines }}
+
+- name: Fetch tarball from each hosts
+  synchronize:
+    src: "{{ item }}"
+    dest: backup/certs-and-keys/
+    mode: pull
+  with_items: 
+    - "{{ files_to_copy.stdout_lines }}"

roles/security/backup_certs_and_keys/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/backup_certs_and_keys/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - backup_certs_and_keys

roles/security/backup_certs_and_keys/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for backup_certs_and_keys

roles/security/change-infra-pass/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/security/change-infra-pass/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for change-infra-pass

roles/security/change-infra-pass/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for change-infra-pass

roles/security/change-infra-pass/meta/main.yml

@@ -0,0 +1,60 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 2.4
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/change-infra-pass/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Change infra password
+  user: name=infra update_password=always password="xxx"
+
+#use Salted password password
+# openssl passwd -1 -salt xyz  yourpass

roles/security/change-infra-pass/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/change-infra-pass/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - change-infra-pass

roles/security/change-infra-pass/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for change-infra-pass

roles/security/change-ssh-host-keys/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/security/change-ssh-host-keys/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for change-ssh-host-keys

roles/security/change-ssh-host-keys/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for change-ssh-host-keys

roles/security/change-ssh-host-keys/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/change-ssh-host-keys/tasks/main.yml

@@ -0,0 +1,4 @@
+---
+# tasks file for change-ssh-host-keys
+- name: Remove existing ssh host keys
+  ansible.builtin.shell: /bin/rm /etc/ssh/ssh_host_* && systemctl restart sshd

roles/security/change-ssh-host-keys/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/change-ssh-host-keys/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - change-ssh-host-keys

roles/security/change-ssh-host-keys/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for change-ssh-host-keys

roles/security/create-ca/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Created by the UFST Linux team

roles/security/create-ca/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for create-ca

roles/security/create-ca/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for create-ca

roles/security/create-ca/meta/main.yml

@@ -0,0 +1,57 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 2.4
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list of versions.
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/create-ca/tasks/main.yml

@@ -0,0 +1,42 @@
+---
+- name: Remove provided PyOpenSSL
+  yum:
+    name:
+      - pyOpenSSL
+    state: absent
+
+- name: Install pip and setuptools
+  yum:
+    name: 
+      - python2-pip
+      - python-setuptools
+    state: latest
+
+- name: Install PyOpenSSL
+  pip:
+    name: PyOpenSSL
+    state: latest
+
+- name: Configure certificate directory
+  file:
+    state: directory
+    path: /etc/certs/ca
+
+- name: Generate CA private key
+  openssl_privatekey:
+    path: /etc/certs/ca/linux-ca.key
+    size: 2048
+
+- name: Generate CA Certificate Signing Request
+  openssl_csr:
+    path: /etc/certs/ca/linux-ca.csr
+    privatekey_path: /etc/certs/ca/linux-ca.key
+    common_name: linux-ca
+
+- name: Generate a Self Signed OpenSSL CA certificate
+  openssl_certificate:
+    path: /etc/certs/ca/linux-ca.crt
+    privatekey_path: /etc/certs/ca/linux-ca.key
+    csr_path: /etc/certs/ca/linux-ca.csr
+    provider: selfsigned
+

roles/security/create-ca/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/create-ca/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - create-ca

roles/security/create-ca/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for create-ca

roles/security/create-certificate/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Created by the UFST Linux team

roles/security/create-certificate/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for create-certificate

roles/security/create-certificate/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for create-certificate

roles/security/create-certificate/meta/main.yml

@@ -0,0 +1,57 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 2.4
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list of versions.
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/create-certificate/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- block:
+  - name: Create client cert folder
+    file:
+      state: directory
+      path: /etc/certs/clients
+
+  - name: Generate private key
+    openssl_privatekey:
+      path: "/etc/certs/clients/{{ inventory_hostname }}.key"
+      size: 2048
+
+  - name: Generate Certificate Signing Request
+    openssl_csr:
+      path: "/etc/certs/clients/{{ inventory_hostname }}.csr"
+      privatekey_path: "/etc/certs/clients/{{ inventory_hostname }}.key"
+      common_name: "{{ inventory_hostname }}"
+
+  - name: Generate a CA signed OpenSSL certificate
+    openssl_certificate:
+      path: "/etc/certs/clients/{{ inventory_hostname }}.crt"
+      privatekey_path: "/etc/certs/clients/{{ inventory_hostname }}.key"
+      csr_path: "/etc/certs/clients/{{ inventory_hostname }}.csr"
+      ownca_path: /etc/certs/ca/linux-ca.crt
+      ownca_privatekey_path: /etc/certs/ca/linux-ca.key
+      provider: ownca
+  delegate_to: linux-certs.EXAMPLE-CORP.COM

roles/security/create-certificate/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/create-certificate/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - create-certificate

roles/security/create-certificate/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for create-certificate

roles/security/enforce-azure-openscap/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Created by the UFST Linux team

roles/security/enforce-azure-openscap/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for enforce-azure-openscap

roles/security/enforce-azure-openscap/files/issue

@@ -0,0 +1,2 @@
+Udviklings- og Forenklingsstyrelsen
+Advarsel! Kun adgang for autoriseret personale

roles/security/enforce-azure-openscap/files/openscap_DTACB.xml

@@ -0,0 +1,613 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
+  <xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml"/>
+  <xccdf:version time="2018-04-12T13:33:31">1</xccdf:version>
+  <xccdf:Profile id="xccdf_org.ssgproject.content_profile_ospp-rhel7_SKATV1">
+    <xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Danish Tax Authority Configuration Baseline (DTACB)</xccdf:title>
+    <xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile is developed by the Danish Tax Authority
+
+The DTACB is intended to be the core set of security related configuration settings by which all DTA interal servers should comply.
+
+</xccdf:description>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_certified" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_screen_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_password" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_uefi_password" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_interactive_boot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_insmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_modprobe" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_rmmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postdrop" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postqueue" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_audit_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_bluetooth_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_nousb_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_autofs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rsh_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rsh-server_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_talk_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_talk-server_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_xinetd_removed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_ypbind_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_ypserv_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rexec_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rlogin_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rsh_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_sshd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_telnet_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_xinetd_disabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_ypbind_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_zebra_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_use_kerberos_security_all_exports" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_compression" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_use_approved_macs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_selinux_bootloader" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_group_owner_grub2_cfg" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_user_owner_grub2_cfg" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_abrt_anon_write" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_abrt_handle_event" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_cron_can_relabel" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_cron_system_cronjob_use_shares" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_cron_userdomain_transition" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_daemons_dump_core" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_daemons_use_tcp_wrapper" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_daemons_use_tty" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_deny_execmem" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_deny_ptrace" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_domain_fd_use" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_domain_kernel_load_modules" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_fips_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_gpg_web_anon_write" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_guest_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_kerberos_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_logadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_logging_syslogd_can_sendmail" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_logging_syslogd_use_tty" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_login_console_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_mmap_low_allowed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_mock_enable_homedirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_mount_anyfile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_polyinstantiation_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secure_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secure_mode_insmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secure_mode_policyload" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_direct_dri_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execheap" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execstack" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_mysql_connect_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_ping" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_postgresql_connect_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_rw_noexattrfile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_share_music" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_tcp_server" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_udp_server" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_use_ssh_chroot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_ssh_chroot_rw_homedirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_ssh_keysign" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_ssh_sysadm_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_staff_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_sysadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_unconfined_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_use_ecryptfs_home_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_user_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_bind_vnc_tcp_port" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_exec_bootloader" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_sysadm_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_write_home" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_connect_network" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_mount_media" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_use_bluetooth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xserver_clients_write_xshm" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xserver_execmem" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xserver_object_manager" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_prelink" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_install_antivirus" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_install_hids" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ldap_client_start_tls" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_dracut-fips_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_smartcard_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_user_locks" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_clean_components_post_updating" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_server_minimize_served_info" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_client_restrict_options" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_denial_of_service" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay_set_trusted_networks" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay_smtp_auth_for_untrusted_networks" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay_require_tls_for_smtp_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_limit_users" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_configure_firewall" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_firewalld" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_c2s_support" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_encrypt_partitions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sudo" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_userowner_shadow_file" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_groupowner_shadow_file" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_docker_selinux_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_print_last_log" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_account_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_locking_out_password_attempts" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_system_shutdown" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_telnet_removed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_ssh_known_hosts_timeout" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_memcache_timeout" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_sssd_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_sssd_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sssd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_ipv6_disable" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_rpm_verification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_kdump_disabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_abrtd_disabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_quality_pwquality" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_quality" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_accounts-physical" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_aide" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_software-integrity" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="false"/>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value">36000</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">Udviklings- og Forenklingsstyrelsen\nAdvarsel! Kun adgang for autoriseret personale</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen">12</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers">time.ccta.dk,time.dmz23.local,time.dmz24.local</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout">36000</xccdf:set-value>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="usgcb_default"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" selector="15_minutes"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="15"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="10_minutes"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sshd_listening_port" selector="default"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" selector="disabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" selector="disabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" selector="disabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" selector="enabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" selector="root"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" selector="single"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_flush" selector="data"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" selector="rotate"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" selector="6"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" selector="email"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="rhel"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="077"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="35"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" selector="10"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="60"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="7"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" selector="6"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="10_min"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" selector="8"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" selector="2"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" selector="5"/>
+  </xccdf:Profile>
+</xccdf:Tailoring>

roles/security/enforce-azure-openscap/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for enforce-azure-openscap

roles/security/enforce-azure-openscap/meta/main.yml

@@ -0,0 +1,57 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 1.2
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list of versions.
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/enforce-azure-openscap/tasks/collect_use_of_privileged_commands.yml

@@ -0,0 +1,151 @@
+- name: Search for privileged commands
+  shell: "find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null | cat"
+  check_mode: no
+  register: find_result
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+
+# Inserts/replaces the rule in /etc/audit/rules.d
+
+- name: Search /etc/audit/rules.d for audit rule entries
+  find:
+    paths: "/etc/audit/rules.d"
+    recurse: no
+    contains: "^.*path={{ item }} .*$"
+    patterns: "*.rules"
+  with_items:
+    - "{{ find_result.stdout_lines }}"
+  register: files_result
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+  
+- name: Overwrites the rule in rules.d
+  lineinfile:
+    path: "{{ item.1.path }}"
+    line: '-a always,exit -F path={{ item.0.item }} -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged'
+    create: no
+    regexp: "^.*path={{ item.0.item }} .*$"
+  with_subelements:
+    - "{{ files_result.results }}"
+    - files
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+    
+- name: Adds the rule in rules.d
+  lineinfile:
+    path: /etc/audit/rules.d/privileged.rules
+    line: '-a always,exit -F path={{ item.item }} -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged'
+    create: yes
+  with_items:
+    - "{{ files_result.results }}"
+  when: item.matched == 0
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+  
+# Adds/overwrites the rule in /etc/audit/audit.rules
+
+- name: Inserts/replaces the rule in audit.rules
+  lineinfile:
+    path: /etc/audit/audit.rules
+    line: '-a always,exit -F path={{ item.item }} -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged'
+    create: yes
+    regexp: "^.*path={{ item.item }} .*$"
+  with_items:
+    - "{{ files_result.results }}"
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360

roles/security/enforce-azure-openscap/tasks/configure_logrotate.yml

@@ -0,0 +1,7 @@
+- name: Configure logrotate
+  template:
+    src: logrotate.conf
+    dest: /etc/logrotate.conf
+    owner: root
+    group: root
+    mode: 0644

roles/security/enforce-azure-openscap/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+
+#- import_tasks: collect_use_of_privileged_commands.yml
+#- import_tasks: configure_logrotate.yml
+
+
+- name: Check that server is a RHEL server
+  assert: { that: "ansible_os_family == 'RedHat'" }
+
+- name: Get RHEL version
+  shell: grep "Red Hat Enterprise Linux" /etc/redhat-release | awk '{ print $7 }'
+  register: rhel_version
+  changed_when: False
+
+- name: Red Hat version
+  debug: msg={{ rhel_version.stdout }}
+
+- assert:
+    that:
+      - rhel_version.stdout is version_compare('7.0', '>=')
+
+- name: Create directory for OpenSCAP policies
+  file:
+    path: /usr/share/xml/scap/skat
+    owner: root
+    group: root
+    mode: 0755
+    state: directory
+
+- name: Copy OpenSCAP baseline to target
+  copy:
+    src: openscap_DTACB.xml
+    dest: /usr/share/xml/scap/skat/openscap_DTACB.xml
+
+- name: Remediate OpenSCAP policy
+  command: |
+    oscap xccdf eval --datastream-id scap_org.open-scap_datastream_from_xccdf_ssg-rhel7-xccdf-1.2.xml \
+    --xccdf-id scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml \
+    --tailoring-file /usr/share/xml/scap/skat/openscap_DTACB.xml \
+    --profile xccdf_org.ssgproject.content_profile_ospp-rhel7_SKATV1 \
+    --oval-results \
+    --report /tmp/report.html \
+    --remediate /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
+  register: result
+  changed_when: result is failed
+  failed_when: false
+
+- name: Setup login banner
+  copy:
+    src: issue
+    dest: /etc/issue
+
+- name: Set correct ClientAliveInterval value in sshd_config
+  command: sed 's/^ClientAliveInterval.*/ClientAliveInterval 36000/g' -i /etc/ssh/sshd_config
+
+- name: Set report name
+  set_fact:
+    report_name: "{{ inventory_hostname }}.{{ ansible_date_time.date }}.{{ ansible_date_time.time }}.html"
+
+- name: Download report
+  fetch:
+    src: /tmp/report.html
+    dest: /tmp/{{ report_name }}
+    flat: true
+
+- name: Delete report from temporary storage
+  file:
+    path: /tmp/report.html
+    state: absent

roles/security/enforce-azure-openscap/tasks/noexec_on_tmp.yml

@@ -0,0 +1,58 @@
+- name: get back device associated to mountpoint
+  shell: mount | grep ' /tmp ' |cut -d ' ' -f 1
+  register: device_name
+  check_mode: no
+  tags:
+    - mount_option_tmp_noexec
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80150-6
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2
+
+- name: get back device previous mount option
+  shell: mount | grep ' /tmp ' | sed -re 's:.*\((.*)\):\1:'
+  register: device_cur_mountoption
+  check_mode: no
+  tags:
+    - mount_option_tmp_noexec
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80150-6
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2
+
+- name: get back device fstype
+  shell: mount | grep ' /tmp ' | cut -d ' ' -f 5
+  register: device_fstype
+  check_mode: no
+  tags:
+    - mount_option_tmp_noexec
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80150-6
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2
+
+- name: Ensure permission noexec are set on /tmp
+  mount:
+    path: "/tmp"
+    src: "{{device_name.stdout}}"
+    opts: "{{device_cur_mountoption.stdout}},noexec"
+    state: "mounted"
+    fstype: "{{device_fstype.stdout}}"
+  tags:
+    - mount_option_tmp_noexec
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80150-6
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2

roles/security/enforce-azure-openscap/tasks/nosuid_on_tmp.yml

@@ -0,0 +1,58 @@
+- name: get back device associated to mountpoint
+  shell: mount | grep ' /tmp ' |cut -d ' ' -f 1
+  register: device_name
+  check_mode: no
+  tags:
+    - mount_option_tmp_nosuid
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80151-4
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2
+
+- name: get back device previous mount option
+  shell: mount | grep ' /tmp ' | sed -re 's:.*\((.*)\):\1:'
+  register: device_cur_mountoption
+  check_mode: no
+  tags:
+    - mount_option_tmp_nosuid
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80151-4
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2
+
+- name: get back device fstype
+  shell: mount | grep ' /tmp ' | cut -d ' ' -f 5
+  register: device_fstype
+  check_mode: no
+  tags:
+    - mount_option_tmp_nosuid
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80151-4
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2
+
+- name: Ensure permission nosuid are set on /tmp
+  mount:
+    path: "/tmp"
+    src: "{{device_name.stdout}}"
+    opts: "{{device_cur_mountoption.stdout}},nosuid"
+    state: "mounted"
+    fstype: "{{device_fstype.stdout}}"
+  tags:
+    - mount_option_tmp_nosuid
+    - low_severity
+    - configure_strategy
+    - low_complexity
+    - high_disruption
+    - CCE-80151-4
+    - NIST-800-53-CM-7
+    - NIST-800-53-MP-2

roles/security/enforce-azure-openscap/tasks/verify_and_correct_file_permissions_with_rpm.yml

@@ -0,0 +1,27 @@
+- name: "Read list of files with incorrect permissions"
+  shell: "rpm -Va | grep '^.M' | cut -d ' ' -f5- | sed -r 's;^.*\\s+(.+);\\1;g'"
+  register: files_with_incorrect_permissions
+  failed_when: False
+  changed_when: False
+  check_mode: no
+  tags:
+    - rpm_verify_permissions
+    - high_severity
+    - restrict_strategy
+    - high_complexity
+    - medium_disruption
+    - CCE-27209-6
+    - DISA-STIG-RHEL-07-010010
+
+- name: "Correct file permissions with RPM"
+  shell: "rpm --setperms $(rpm -qf '{{item}}')"
+  with_items: "{{ files_with_incorrect_permissions.stdout_lines }}"
+  when: files_with_incorrect_permissions.stdout_lines | length > 0
+  tags:
+    - rpm_verify_permissions
+    - high_severity
+    - restrict_strategy
+    - high_complexity
+    - medium_disruption
+    - CCE-27209-6
+    - DISA-STIG-RHEL-07-010010

roles/security/enforce-azure-openscap/templates/logrotate.conf

@@ -0,0 +1,36 @@
+# see "man logrotate" for details
+# rotate log files {{ period }}
+{{ period }}
+
+# keep {{ frequency }} {{ period }} worth of backlogs
+rotate {{ frequency }}
+
+# create new (empty) log files after rotating old ones
+create
+
+# use date as a suffix of the rotated file
+dateext
+
+# uncomment this if you want your log files compressed
+#compress
+
+# RPM packages drop log rotation information into this directory
+include /etc/logrotate.d
+
+# no packages own wtmp and btmp -- we'll rotate them here
+/var/log/wtmp {
+    monthly
+    create 0664 root utmp
+        minsize 1M
+    rotate 1
+}
+
+/var/log/btmp {
+    missingok
+    monthly
+    create 0600 root utmp
+    rotate 1
+}
+
+# system-specific logs may be also be configured here.
+

roles/security/enforce-azure-openscap/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/enforce-azure-openscap/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - enforce-azure-openscap

roles/security/enforce-azure-openscap/vars/main.yml

@@ -0,0 +1,4 @@
+---
+# vars file for enforce-skat-openscap
+frequency: 30
+period: daily

roles/security/enforce-cis-rhel7/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/security/enforce-cis-rhel7/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# defaults file for enforce-cis
+provider: onpremise

roles/security/enforce-cis-rhel7/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for enforce-cis

roles/security/enforce-cis-rhel7/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.4
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

roles/security/enforce-cis-rhel7/tasks/main.yml

@@ -0,0 +1,210 @@
+---
+# tasks file for enforce-cis
+- name: Create /etc/modprobe.d/cis.conf
+  template:
+    src: cis.conf
+    dest: /etc/modprobe.d/cis.conf
+    mode: 0644
+
+- name: Mount /dev/shm as tmpfs
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^tmpfs\s\/dev\/shm.*'
+    line: 'tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0'
+
+- name: Mount /home with nodev
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^/dev/mapper/rhel-home.*'
+    line: '/dev/mapper/rhel-home /home xfs rw,relatime,seclabel,attr2,inode64,noquota,nodev 0 0'
+  when: datacenter == 'onpremise'
+
+- name: Mount /tmp with nodev
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^/dev/mapper/rhel-tmp.*'
+    line: '/dev/mapper/rhel-tmp /tmp xfs rw,noexec,relatime,seclabel,attr2,inode64,noquota,nosuid,nodev 0 0'
+  when: datacenter == 'onpremise'
+
+- name: Set hard core 0
+  lineinfile:
+    path: /etc/security/limits.conf
+    regexp: '^\*\shard\score.*'
+    line: '* hard core 0'
+
+- name: Set suid_dumpable to 0
+  lineinfile:
+    path: /etc/sysctl.conf
+    regexp: '^fs.suid_dumpable.*'
+    line: 'fs.suid_dumpable = 0'
+
+- name: Set IPv6 kernel parameters
+  lineinfile:
+    dest: /etc/sysctl.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^net.ipv6.conf.all.accept_ra.*', line: 'net.ipv6.conf.all.accept_ra = 0' }
+    - { regexp: '^net.ipv6.conf.default.accept_ra.*', line: 'net.ipv6.conf.default.accept_ra = 0' }
+    - { regexp: '^net.ipv6.conf.all.accept_redirects.*', line: 'net.ipv6.conf.all.accept_redirects = 0' }
+    - { regexp: '^net.ipv6.conf.default.accept_redirects.*', line: 'net.ipv6.conf.default.accept_redirects = 0' }
+
+- name: Set FileCreateMode in /etc/rsyslog.conf
+  lineinfile:
+    path: /etc/rsyslog.conf
+    regexp: '^\$FileCreateMode.*'
+    line: '$FileCreateMode 0640'
+
+- name: Restart rsyslog
+  systemd:
+   name: rsyslog
+   state: restarted
+
+- name: Set sshd parameters
+  lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^[#]?Protocol.*', line: 'Protocol 2' }
+    - { regexp: '^[#]?LogLevel.*', line: 'LogLevel INFO' }
+    - { regexp: '^[#]?X11Forwarding.*', line: 'X11Forwarding no' }
+    - { regexp: '^[#]?MaxAuthTries.*', line: 'MaxAuthTries 4' }
+    - { regexp: '^[#]?IgnoreRhosts.*', line: 'IgnoreRhosts yes' }
+    - { regexp: '^[#]?HostbasedAuthentication.*', line: 'HostbasedAuthentication no' }
+    - { regexp: '^[#]?PermitUserEnvironment.*', line: 'PermitUserEnvironment no' }
+    - { regexp: '^[#]?MACs.*', line: 'MACs hmac-sha2-512,hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com' }
+    - { regexp: '^[#]?LoginGraceTime.*', line: 'LoginGraceTime 60' }
+
+- name: Set correct permission and ownership on cron files
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0700
+    state: directory
+  with_items:
+    - /etc/cron.d
+    - /etc/cron.hourly
+    - /etc/cron.daily
+    - /etc/cron.weekly
+    - /etc/cron.monthly
+
+- name: Set correct permissions on /etc/crontab
+  file:
+    path: /etc/crontab
+    owner: root
+    group: root
+    mode: 0600
+
+- name: Set correct permissions on /var/run/syslogd.pid
+  file:
+    path: /var/run/syslogd.pid
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Only members of wheel are allowed to use su
+  lineinfile:
+    dest: /etc/pam.d/su
+    regexp: '^auth\srequired\spam_wheel.so.*'
+    line: 'auth required pam_wheel.so use_uid'
+
+- name: Fix permissions on /home/infra
+  file:
+    dest: /home/infra
+    owner: infra
+    group: infra
+    recurse: yes
+
+- name: Fix permissions on /var/db/sudo/lectured/infra
+  file:
+    dest: /var/db/sudo/lectured/infra
+    owner: infra
+    group: infra
+
+- name: Delete cron.allow and cron.deny
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/cron.allow
+    - /etc/cron.deny
+    - /etc/at.allow
+    - /etc/at.deny
+
+- name: Re-create cron.allow and at.allow
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0600
+    state: touch
+  with_items:
+    - /etc/cron.allow
+    - /etc/at.allow
+
+- name: Remember the last 5 passwords and limit to 3 retries (password-auth)
+  lineinfile:
+    dest: /etc/pam.d/password-auth
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^password\s+sufficient\s+pam_unix.so.*', line: 'password sufficient pam_unix.so sha512 remember=5' }
+    - { regexp: '^password\s+requisite\s+pam_pwquality.so.*', line: 'password requisite pam_pwquality.so try_first_pass retry=3' }
+
+- name: Remember the last 5 passwords and limit to 3 retries (system-auth)
+  lineinfile:
+    dest: /etc/pam.d/system-auth
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^password\s+sufficient\s+pam_unix.so.*', line: 'password sufficient pam_unix.so sha512 remember=5' }
+    - { regexp: '^password\s+requisite\s+pam_pwquality.so.*', line: 'password requisite pam_pwquality.so try_first_pass retry=3' }
+
+- name: Set pwquality parameters
+  lineinfile:
+    dest: /etc/security/pwquality.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^[#]?minlen.*', line: 'minlen = 14' }
+    - { regexp: '^[#]?dcredit.*', line: 'dcredit = -1' }
+    - { regexp: '^[#]?lcredit.*', line: 'lcredit = -1' }
+    - { regexp: '^[#]?ocredit.*', line: 'ocredit = -1' }
+    - { regexp: '^[#]?ucredit.*', line: 'ucredit = -1' }
+
+- name: Reload sysctl
+  command: sysctl -p
+
+- name: Overwrite issue.net
+  template:
+    src: issue.net
+    dest: /etc/issue.net
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Set correct permissions in /etc/logrotate.d/zabbix-agent
+  lineinfile:
+    dest: /etc/logrotate.d/zabbix-agent
+    regexp: 'create\s+0664\s+zabbix\s+zabbix'
+    line: 'create 0660 zabbix zabbix'
+
+- name: Change default create permission to 0660 in /etc/logrotate.conf
+  lineinfile:
+    dest: /etc/logrotate.conf
+    regexp: '^create.*'
+    line: 'create 0640'
+
+- name: Set permissions to 0640 for files and 750 for directories in /var/log
+  file:
+    dest: /var/log
+    mode: u=rwX,g=rX,o=
+    recurse: yes
+
+- name: Compress rotated log files
+  lineinfile:
+    path: /etc/logrotate.conf
+    regexp: '^#compress'
+    line: 'compress'

roles/security/enforce-cis-rhel7/templates/cis.conf

@@ -0,0 +1,2 @@
+install udf /bin/true
+options ipv6 disable=1

roles/security/enforce-cis-rhel7/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/enforce-cis-rhel7/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - enforce-cis

roles/security/enforce-cis-rhel7/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for enforce-cis

roles/security/enforce-cis-rhel8/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/security/enforce-cis-rhel8/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/security/enforce-cis-rhel8/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# defaults file for enforce-cis-rhel8
+provider: onpremise

roles/security/enforce-cis-rhel8/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for enforce-cis-rhel8

roles/security/enforce-cis-rhel8/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

roles/security/enforce-cis-rhel8/tasks/main.yml

@@ -0,0 +1,224 @@
+---
+# tasks file for enforce-cis
+- name: Create /etc/modprobe.d/cis.conf
+  template:
+    src: cis.conf
+    dest: /etc/modprobe.d/cis.conf
+    mode: 0644
+
+- name: Mount /dev/shm as tmpfs
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^tmpfs\s\/dev\/shm.*'
+    line: 'tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0'
+
+- name: Mount /home with nodev
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^/dev/mapper/rhel-home.*'
+    line: '/dev/mapper/rhel-home /home xfs rw,relatime,seclabel,attr2,inode64,noquota,nodev 0 0'
+  when: provider == 'onpremise'
+
+#- name: Mount /tmp with nodev
+#  lineinfile:
+#    path: /etc/fstab
+#    regexp: '^/dev/mapper/rhel-tmp.*'
+#    line: '/dev/mapper/rhel-tmp /tmp xfs rw,noexec,relatime,seclabel,attr2,inode64,noquota,nosuid,nodev 0 0'
+#  when: provider == 'onpremise'
+
+- name: Set hard core 0
+  lineinfile:
+    path: /etc/security/limits.conf
+    regexp: '^\*\shard\score.*'
+    line: '* hard core 0'
+
+- name: Set suid_dumpable to 0
+  lineinfile:
+    path: /etc/sysctl.conf
+    regexp: '^fs.suid_dumpable.*'
+    line: 'fs.suid_dumpable = 0'
+
+- name: Set IPv6 kernel parameters
+  lineinfile:
+    dest: /etc/sysctl.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^net.ipv6.conf.all.accept_ra.*', line: 'net.ipv6.conf.all.accept_ra = 0' }
+    - { regexp: '^net.ipv6.conf.default.accept_ra.*', line: 'net.ipv6.conf.default.accept_ra = 0' }
+    - { regexp: '^net.ipv6.conf.all.accept_redirects.*', line: 'net.ipv6.conf.all.accept_redirects = 0' }
+    - { regexp: '^net.ipv6.conf.default.accept_redirects.*', line: 'net.ipv6.conf.default.accept_redirects = 0' }
+    - { regexp: '^net.ipv4.conf.default.secure_redirects.*', line: 'net.ipv4.conf.default.secure_redirects=0' }
+    - { regexp: '^net.ipv4.conf.all.rp_filter.*', line: 'net.ipv4.conf.all.rp_filter=0' }
+    - { regexp: '^net.ipv4.conf.default.rp_filter.*', line: 'net.ipv4.conf.default.rp_filter=1' }
+    - { regexp: '^net.ipv4.conf.all.accept_redirects.*', line: 'net.ipv4.conf.all.accept_redirects=0' }
+    - { regexp: '^net.ipv4.conf.all.accept_source_route.*', line: 'net.ipv4.conf.all.accept_source_route=0' }
+    - { regexp: '^net.ipv4.conf.default.accept_source_route.*', line: 'net.ipv4.conf.default.accept_source_route=0' }
+    - { regexp: '^net.ipv4.conf.default.log_martians.*', line: 'net.ipv4.conf.default.log_martians=1' }
+
+- name: Set FileCreateMode in /etc/rsyslog.conf
+  lineinfile:
+    path: /etc/rsyslog.conf
+    regexp: '^\$FileCreateMode.*'
+    line: '$FileCreateMode 0640'
+
+- name: Restart rsyslog
+  systemd:
+   name: rsyslog
+   state: restarted
+
+- name: Set sshd parameters
+  lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^[#]?Protocol.*', line: 'Protocol 2' }
+    - { regexp: '^[#]?LogLevel.*', line: 'LogLevel INFO' }
+    - { regexp: '^[#]?X11Forwarding.*', line: 'X11Forwarding no' }
+    - { regexp: '^[#]?MaxAuthTries.*', line: 'MaxAuthTries 4' }
+    - { regexp: '^[#]?IgnoreRhosts.*', line: 'IgnoreRhosts yes' }
+    - { regexp: '^[#]?HostbasedAuthentication.*', line: 'HostbasedAuthentication no' }
+    - { regexp: '^[#]?PermitUserEnvironment.*', line: 'PermitUserEnvironment no' }
+    - { regexp: '^[#]?MACs.*', line: 'MACs hmac-sha2-512,hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com' }
+    - { regexp: '^[#]?LoginGraceTime.*', line: 'LoginGraceTime 60' }
+    - { regexp: '^[#]?PermitEmptyPasswords.*', line: 'PermitEmptyPasswords no' }
+    - { regexp: '^[#]?Ciphers.*', line: 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc' }
+    - { regexp: '^[#]?ClientAliveInterval.*', line: 'ClientAliveInterval 36000' }
+    - { regexp: '^[#]?Banner.*', line: 'Banner /etc/issue' }
+
+- name: Set correct permission and ownership on cron files
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0700
+    state: directory
+  with_items:
+    - /etc/cron.d
+    - /etc/cron.hourly
+    - /etc/cron.daily
+    - /etc/cron.weekly
+    - /etc/cron.monthly
+
+- name: Set correct permissions on /etc/crontab
+  file:
+    path: /etc/crontab
+    owner: root
+    group: root
+    mode: 0600
+  
+- name: Only members of wheel are allowed to use su
+  lineinfile:
+    dest: /etc/pam.d/su
+    regexp: '^auth\srequired\spam_wheel.so.*'
+    line: 'auth required pam_wheel.so use_uid'
+
+- name: Fix permissions on /home/infra
+  file:
+    dest: /home/infra
+    owner: infra
+    group: infra
+    recurse: yes
+
+- name: Fix permissions on /var/db/sudo/lectured/infra
+  file:
+    dest: /var/db/sudo/lectured/infra
+    owner: infra
+    group: infra
+
+- name: Delete cron.allow and cron.deny
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/cron.allow
+    - /etc/cron.deny
+    - /etc/at.allow
+    - /etc/at.deny
+
+- name: Re-create cron.allow and at.allow
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0600
+    state: touch
+  with_items:
+    - /etc/cron.allow
+    - /etc/at.allow
+
+- name: Remember the last 5 passwords and limit to 3 retries (password-auth)
+  lineinfile:
+    dest: /etc/pam.d/password-auth
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items: 
+    - { regexp: '^password\s+sufficient\s+pam_unix.so.*', line: 'password sufficient pam_unix.so sha512 remember=5' }
+    - { regexp: '^password\s+requisite\s+pam_pwquality.so.*', line: 'password requisite pam_pwquality.so try_first_pass retry=3' }
+    
+- name: Remember the last 5 passwords and limit to 3 retries (system-auth)
+  lineinfile:
+    dest: /etc/pam.d/system-auth
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items: 
+    - { regexp: '^password\s+sufficient\s+pam_unix.so.*', line: 'password sufficient pam_unix.so sha512 remember=5' }
+    - { regexp: '^password\s+requisite\s+pam_pwquality.so.*', line: 'password requisite pam_pwquality.so try_first_pass retry=3' }
+
+- name: Set pwquality parameters
+  lineinfile:
+    dest: /etc/security/pwquality.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^[#]?minlen.*', line: 'minlen = 14' }
+    - { regexp: '^[#]?dcredit.*', line: 'dcredit = -1' }
+    - { regexp: '^[#]?lcredit.*', line: 'lcredit = -1' }
+    - { regexp: '^[#]?ocredit.*', line: 'ocredit = -1' }
+    - { regexp: '^[#]?ucredit.*', line: 'ucredit = -1' }
+
+- name: Reload sysctl
+  command: sysctl -p
+
+- name: Set permissions to 0640 for files and 750 for directories in /var/log
+  file:
+    dest: /var/log
+    mode: u=rwX,g=rX,o=
+    recurse: yes
+
+- name: Compress rotated log files
+  lineinfile:
+    path: /etc/logrotate.conf
+    regexp: '^#compress.*'
+    line: 'compress'
+
+- name: Set permissions to 640 for newly created log files
+  lineinfile:
+    path: /etc/logrotate.conf
+    regexp: '^create 0660'
+    line: 'create 0640'
+
+- name: Create /etc/hosts.allow
+  file:
+    path: /etc/hosts.allow
+    state: touch
+    owner: root
+    group: root
+    mode: 0644
+  
+- name: Create /etc/hosts.deny
+  file:
+    path: /etc/hosts.deny
+    state: touch
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Overwrite issue.net
+  template:
+    src: issue.net
+    dest: /etc/issue.net
+    owner: root
+    group: root
+    mode: 0644

roles/security/enforce-cis-rhel8/templates/CIS_disable_unused_filesystems.conf

@@ -0,0 +1,22 @@
+# 1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Scored)
+install cramfs /bin/true
+
+# 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled (Scored)
+install freevxfs /bin/true
+
+# 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled (Scored)
+install jffs2 /bin/true
+
+# 1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored)
+install hfs /bin/true
+
+# 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled (Scored)
+install hfsplus /bin/true
+
+# 1.1.1.6 Ensure mounting of squashfs filesystems is disabled (Scored)
+install squashfs /bin/true
+
+# 1.1.1.7 UDF is required for Azure provisioning
+# It is disabled separately, see /etc/cloud/cloud.cfg.d/99-disable-udf.cfg
+
+install vfat /bin/true

roles/security/enforce-cis-rhel8/templates/cis.conf

@@ -0,0 +1,25 @@
+options ipv6 disable=1
+
+# 1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Scored)
+install cramfs /bin/true
+
+# 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled (Scored)
+install freevxfs /bin/true
+
+# 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled (Scored)
+install jffs2 /bin/true
+
+# 1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored)
+install hfs /bin/true
+
+# 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled (Scored)
+install hfsplus /bin/true
+
+# 1.1.1.6 Ensure mounting of squashfs filesystems is disabled (Scored)
+install squashfs /bin/true
+
+# 1.1.1.7 UDF is required for Azure provisioning
+# It is disabled separately, see /etc/cloud/cloud.cfg.d/99-disable-udf.cfg
+
+install dccp /bin/true
+install sctp /bin/true

roles/security/enforce-cis-rhel8/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/enforce-cis-rhel8/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - enforce-cis-rhel8

roles/security/enforce-cis-rhel8/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for enforce-cis-rhel8

roles/security/enforce-cis-rhel9/.travis.yml

@@ -0,0 +1,29 @@
+---
+language: python
+python: "2.7"
+
+# Use the new container infrastructure
+sudo: false
+
+# Install ansible
+addons:
+  apt:
+    packages:
+    - python-pip
+
+install:
+  # Install ansible
+  - pip install ansible
+
+  # Check ansible version
+  - ansible --version
+
+  # Create ansible.cfg with correct roles_path
+  - printf '[defaults]\nroles_path=../' >ansible.cfg
+
+script:
+  # Basic role syntax check
+  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

roles/security/enforce-cis-rhel9/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

roles/security/enforce-cis-rhel9/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+# defaults file for enforce-cis-rhel8
+provider: onpremise

roles/security/enforce-cis-rhel9/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for enforce-cis-rhel8

roles/security/enforce-cis-rhel9/meta/main.yml

@@ -0,0 +1,53 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.9
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
+  

roles/security/enforce-cis-rhel9/tasks/main.yml

@@ -0,0 +1,224 @@
+---
+# tasks file for enforce-cis
+- name: Create /etc/modprobe.d/cis.conf
+  template:
+    src: cis.conf
+    dest: /etc/modprobe.d/cis.conf
+    mode: 0644
+
+- name: Mount /dev/shm as tmpfs
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^tmpfs\s\/dev\/shm.*'
+    line: 'tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0'
+
+- name: Mount /home with nodev
+  lineinfile:
+    path: /etc/fstab
+    regexp: '^/dev/mapper/rhel-home.*'
+    line: '/dev/mapper/rhel-home /home xfs rw,relatime,seclabel,attr2,inode64,noquota,nodev 0 0'
+  when: provider == 'onpremise'
+
+#- name: Mount /tmp with nodev
+#  lineinfile:
+#    path: /etc/fstab
+#    regexp: '^/dev/mapper/rhel-tmp.*'
+#    line: '/dev/mapper/rhel-tmp /tmp xfs rw,noexec,relatime,seclabel,attr2,inode64,noquota,nosuid,nodev 0 0'
+#  when: provider == 'onpremise'
+
+- name: Set hard core 0
+  lineinfile:
+    path: /etc/security/limits.conf
+    regexp: '^\*\shard\score.*'
+    line: '* hard core 0'
+
+- name: Set suid_dumpable to 0
+  lineinfile:
+    path: /etc/sysctl.conf
+    regexp: '^fs.suid_dumpable.*'
+    line: 'fs.suid_dumpable = 0'
+
+- name: Set IPv6 kernel parameters
+  lineinfile:
+    dest: /etc/sysctl.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^net.ipv6.conf.all.accept_ra.*', line: 'net.ipv6.conf.all.accept_ra = 0' }
+    - { regexp: '^net.ipv6.conf.default.accept_ra.*', line: 'net.ipv6.conf.default.accept_ra = 0' }
+    - { regexp: '^net.ipv6.conf.all.accept_redirects.*', line: 'net.ipv6.conf.all.accept_redirects = 0' }
+    - { regexp: '^net.ipv6.conf.default.accept_redirects.*', line: 'net.ipv6.conf.default.accept_redirects = 0' }
+    - { regexp: '^net.ipv4.conf.default.secure_redirects.*', line: 'net.ipv4.conf.default.secure_redirects=0' }
+    - { regexp: '^net.ipv4.conf.all.rp_filter.*', line: 'net.ipv4.conf.all.rp_filter=0' }
+    - { regexp: '^net.ipv4.conf.default.rp_filter.*', line: 'net.ipv4.conf.default.rp_filter=1' }
+    - { regexp: '^net.ipv4.conf.all.accept_redirects.*', line: 'net.ipv4.conf.all.accept_redirects=0' }
+    - { regexp: '^net.ipv4.conf.all.accept_source_route.*', line: 'net.ipv4.conf.all.accept_source_route=0' }
+    - { regexp: '^net.ipv4.conf.default.accept_source_route.*', line: 'net.ipv4.conf.default.accept_source_route=0' }
+    - { regexp: '^net.ipv4.conf.default.log_martians.*', line: 'net.ipv4.conf.default.log_martians=1' }
+
+- name: Set FileCreateMode in /etc/rsyslog.conf
+  lineinfile:
+    path: /etc/rsyslog.conf
+    regexp: '^\$FileCreateMode.*'
+    line: '$FileCreateMode 0640'
+
+- name: Restart rsyslog
+  systemd:
+   name: rsyslog
+   state: restarted
+
+- name: Set sshd parameters
+  lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^[#]?Protocol.*', line: 'Protocol 2' }
+    - { regexp: '^[#]?LogLevel.*', line: 'LogLevel INFO' }
+    - { regexp: '^[#]?X11Forwarding.*', line: 'X11Forwarding no' }
+    - { regexp: '^[#]?MaxAuthTries.*', line: 'MaxAuthTries 4' }
+    - { regexp: '^[#]?IgnoreRhosts.*', line: 'IgnoreRhosts yes' }
+    - { regexp: '^[#]?HostbasedAuthentication.*', line: 'HostbasedAuthentication no' }
+    - { regexp: '^[#]?PermitUserEnvironment.*', line: 'PermitUserEnvironment no' }
+    - { regexp: '^[#]?MACs.*', line: 'MACs hmac-sha2-512,hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com' }
+    - { regexp: '^[#]?LoginGraceTime.*', line: 'LoginGraceTime 60' }
+    - { regexp: '^[#]?PermitEmptyPasswords.*', line: 'PermitEmptyPasswords no' }
+    - { regexp: '^[#]?Ciphers.*', line: 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc' }
+    - { regexp: '^[#]?ClientAliveInterval.*', line: 'ClientAliveInterval 36000' }
+    - { regexp: '^[#]?Banner.*', line: 'Banner /etc/issue' }
+
+- name: Set correct permission and ownership on cron files
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0700
+    state: directory
+  with_items:
+    - /etc/cron.d
+    - /etc/cron.hourly
+    - /etc/cron.daily
+    - /etc/cron.weekly
+    - /etc/cron.monthly
+
+- name: Set correct permissions on /etc/crontab
+  file:
+    path: /etc/crontab
+    owner: root
+    group: root
+    mode: 0600
+  
+- name: Only members of wheel are allowed to use su
+  lineinfile:
+    dest: /etc/pam.d/su
+    regexp: '^auth\srequired\spam_wheel.so.*'
+    line: 'auth required pam_wheel.so use_uid'
+
+- name: Fix permissions on /home/infra
+  file:
+    dest: /home/infra
+    owner: infra
+    group: infra
+    recurse: yes
+
+- name: Fix permissions on /var/db/sudo/lectured/infra
+  file:
+    dest: /var/db/sudo/lectured/infra
+    owner: infra
+    group: infra
+
+- name: Delete cron.allow and cron.deny
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/cron.allow
+    - /etc/cron.deny
+    - /etc/at.allow
+    - /etc/at.deny
+
+- name: Re-create cron.allow and at.allow
+  file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: 0600
+    state: touch
+  with_items:
+    - /etc/cron.allow
+    - /etc/at.allow
+
+- name: Remember the last 5 passwords and limit to 3 retries (password-auth)
+  lineinfile:
+    dest: /etc/pam.d/password-auth
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items: 
+    - { regexp: '^password\s+sufficient\s+pam_unix.so.*', line: 'password sufficient pam_unix.so sha512 remember=5' }
+    - { regexp: '^password\s+requisite\s+pam_pwquality.so.*', line: 'password requisite pam_pwquality.so try_first_pass retry=3' }
+    
+- name: Remember the last 5 passwords and limit to 3 retries (system-auth)
+  lineinfile:
+    dest: /etc/pam.d/system-auth
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items: 
+    - { regexp: '^password\s+sufficient\s+pam_unix.so.*', line: 'password sufficient pam_unix.so sha512 remember=5' }
+    - { regexp: '^password\s+requisite\s+pam_pwquality.so.*', line: 'password requisite pam_pwquality.so try_first_pass retry=3' }
+
+- name: Set pwquality parameters
+  lineinfile:
+    dest: /etc/security/pwquality.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - { regexp: '^[#]?minlen.*', line: 'minlen = 14' }
+    - { regexp: '^[#]?dcredit.*', line: 'dcredit = -1' }
+    - { regexp: '^[#]?lcredit.*', line: 'lcredit = -1' }
+    - { regexp: '^[#]?ocredit.*', line: 'ocredit = -1' }
+    - { regexp: '^[#]?ucredit.*', line: 'ucredit = -1' }
+
+- name: Reload sysctl
+  command: sysctl -p
+
+- name: Set permissions to 0640 for files and 750 for directories in /var/log
+  file:
+    dest: /var/log
+    mode: u=rwX,g=rX,o=
+    recurse: yes
+
+- name: Compress rotated log files
+  lineinfile:
+    path: /etc/logrotate.conf
+    regexp: '^#compress.*'
+    line: 'compress'
+
+- name: Set permissions to 640 for newly created log files
+  lineinfile:
+    path: /etc/logrotate.conf
+    regexp: '^create 0660'
+    line: 'create 0640'
+
+- name: Create /etc/hosts.allow
+  file:
+    path: /etc/hosts.allow
+    state: touch
+    owner: root
+    group: root
+    mode: 0644
+  
+- name: Create /etc/hosts.deny
+  file:
+    path: /etc/hosts.deny
+    state: touch
+    owner: root
+    group: root
+    mode: 0644
+
+- name: Overwrite issue.net
+  template:
+    src: issue.net
+    dest: /etc/issue.net
+    owner: root
+    group: root
+    mode: 0644

roles/security/enforce-cis-rhel9/templates/CIS_disable_unused_filesystems.conf

@@ -0,0 +1,22 @@
+# 1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Scored)
+install cramfs /bin/true
+
+# 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled (Scored)
+install freevxfs /bin/true
+
+# 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled (Scored)
+install jffs2 /bin/true
+
+# 1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored)
+install hfs /bin/true
+
+# 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled (Scored)
+install hfsplus /bin/true
+
+# 1.1.1.6 Ensure mounting of squashfs filesystems is disabled (Scored)
+install squashfs /bin/true
+
+# 1.1.1.7 UDF is required for Azure provisioning
+# It is disabled separately, see /etc/cloud/cloud.cfg.d/99-disable-udf.cfg
+
+install vfat /bin/true

roles/security/enforce-cis-rhel9/templates/cis.conf

@@ -0,0 +1,25 @@
+options ipv6 disable=1
+
+# 1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Scored)
+install cramfs /bin/true
+
+# 1.1.1.2 Ensure mounting of freevxfs filesystems is disabled (Scored)
+install freevxfs /bin/true
+
+# 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled (Scored)
+install jffs2 /bin/true
+
+# 1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored)
+install hfs /bin/true
+
+# 1.1.1.5 Ensure mounting of hfsplus filesystems is disabled (Scored)
+install hfsplus /bin/true
+
+# 1.1.1.6 Ensure mounting of squashfs filesystems is disabled (Scored)
+install squashfs /bin/true
+
+# 1.1.1.7 UDF is required for Azure provisioning
+# It is disabled separately, see /etc/cloud/cloud.cfg.d/99-disable-udf.cfg
+
+install dccp /bin/true
+install sctp /bin/true

roles/security/enforce-cis-rhel9/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

roles/security/enforce-cis-rhel9/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - enforce-cis-rhel8

roles/security/enforce-cis-rhel9/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file for enforce-cis-rhel8

roles/security/enforce-repos/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+# tasks file for enforce-repos
+- name: Gather list of all repos, based on installed packages
+  ansible.builtin.shell: sudo dnf list --installed | grep -E '.+\@.+' | sed -E 's/.+\@(\S+)/\1/;s/ +//' | sort | uniq
+  register: used_repos
+
+- name: Get all subscription manager repos on host
+  ansible.builtin.shell: "sudo subscription-manager repos | grep -E 'Repo ID: ' | sed -E 's/.+:\\s+(\\S+)$/\\1/'"
+  register: available_repos
+
+- name: Create new list of repos to enable
+  ansible.builtin.set_fact: 
+    repos_to_enable: "{{ (used_repos.stdout_lines | list) | intersect(available_repos.stdout_lines | list) }}"
+
+- name: Output used_repos list
+  ansible.builtin.debug:
+    var: used_repos
+
+- name: Output available_repos list
+  ansible.builtin.debug:
+    var: available_repos
+
+- name: Output the unique list
+  ansible.builtin.debug:
+    var: repos_to_enable
+
+- name: Enable all disabled baseline repos
+  community.general.rhsm_repository: 
+    name: "{{ repos_to_enable | list }}"
+    state: enabled
+

roles/security/enforce-skat-openscap/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Created by the UFST Linux team

roles/security/enforce-skat-openscap/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+# defaults file for enforce-skat-openscap

roles/security/enforce-skat-openscap/files/issue

@@ -0,0 +1,2 @@
+Udviklings- og Forenklingsstyrelsen
+Advarsel! Kun adgang for autoriseret personale

roles/security/enforce-skat-openscap/files/openscap_DTACB.xml

@@ -0,0 +1,601 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
+  <xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml"/>
+  <xccdf:version time="2018-04-12T13:33:31">1</xccdf:version>
+  <xccdf:Profile id="xccdf_org.ssgproject.content_profile_ospp-rhel7_SKATV1">
+    <xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Danish Tax Authority Configuration Baseline (DTACB)</xccdf:title>
+    <xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile is developed by the Danish Tax Authority
+
+The DTACB is intended to be the core set of security related configuration settings by which all DTA interal servers should comply.
+
+</xccdf:description>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_certified" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_screen_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_password" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_uefi_password" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_interactive_boot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_insmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_modprobe" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_rmmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postdrop" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postqueue" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_audit_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_wireless_disable_interfaces" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_bluetooth_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_bootloader_nousb_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_autofs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rsh_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rsh-server_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_talk_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_talk-server_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_xinetd_removed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_ypbind_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_ypserv_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rexec_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rlogin_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rsh_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_sshd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_telnet_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_xinetd_disabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_ypbind_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_zebra_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_use_kerberos_security_all_exports" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_allow_only_protocol2" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_compression" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts_rsa" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_user_known_hosts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_use_approved_macs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_use_priv_separation" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_system_owned" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_selinux_bootloader" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_group_owner_grub2_cfg" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_user_owner_grub2_cfg" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_removable_partitions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_noexec_removable_partitions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nosuid_removable_partitions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_abrt_anon_write" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_abrt_handle_event" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_cron_can_relabel" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_cron_system_cronjob_use_shares" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_cron_userdomain_transition" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_daemons_dump_core" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_daemons_use_tcp_wrapper" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_daemons_use_tty" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_deny_execmem" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_deny_ptrace" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_domain_fd_use" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_domain_kernel_load_modules" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_fips_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_gpg_web_anon_write" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_guest_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_kerberos_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_logadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_logging_syslogd_can_sendmail" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_logging_syslogd_use_tty" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_login_console_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_mmap_low_allowed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_mock_enable_homedirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_mount_anyfile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_polyinstantiation_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secure_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secure_mode_insmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_secure_mode_policyload" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_direct_dri_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execheap" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execmod" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_execstack" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_mysql_connect_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_ping" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_postgresql_connect_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_rw_noexattrfile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_share_music" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_tcp_server" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_udp_server" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_selinuxuser_use_ssh_chroot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_ssh_chroot_rw_homedirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_ssh_keysign" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_ssh_sysadm_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_staff_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_sysadm_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_unconfined_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_use_ecryptfs_home_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_user_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_bind_vnc_tcp_port" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_exec_bootloader" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_sysadm_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xdm_write_home" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_connect_network" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_exec_content" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_mount_media" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xguest_use_bluetooth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xserver_clients_write_xshm" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xserver_execmem" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sebool_xserver_object_manager" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_prelink" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_install_antivirus" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_install_hids" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ldap_client_start_tls" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_dracut-fips_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_install_PAE_kernel_on_x86-32" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_kdump_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_exec_shield" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_smartcard_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_network_sniffer_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_user_locks" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_dconf_user_profile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_clean_components_post_updating" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_server_minimize_served_info" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_client_restrict_options" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_denial_of_service" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay_set_trusted_networks" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay_smtp_auth_for_untrusted_networks" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_relay_require_tls_for_smtp_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_limit_users" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_configure_firewall" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_firewalld" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_c2s_support" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_encrypt_partitions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sudo" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_no_authenticate" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_bind" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_userowner_shadow_file" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_groupowner_shadow_file" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_docker_selinux_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_have_homedir_login_defs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_openssh-server_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_print_last_log" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_account_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_locking_out_password_attempts" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_system_shutdown" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_telnet_removed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_abrtd_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_ssh_known_hosts_timeout" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_memcache_timeout" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_sssd_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_sssd_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sssd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_ipv6_disable" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_quality_pwquality" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_quality" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_accounts-physical" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_aide" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="false"/>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value">36000</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen">14</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers">time.ccta.dk,time.dmz23.local,time.dmz24.local</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">Udviklings- og Forenklingsstyrelsen\nAdvarsel! Kun adgang for autoriseret personale</xccdf:set-value>
+    <xccdf:set-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout">36000</xccdf:set-value>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="usgcb_default"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" selector="15_minutes"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="15"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="10_minutes"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sshd_listening_port" selector="default"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" selector="disabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" selector="disabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" selector="disabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" selector="enabled"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" selector="root"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" selector="single"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_flush" selector="data"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" selector="rotate"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" selector="6"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" selector="email"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="rhel"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="077"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="35"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" selector="10"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="60"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="7"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" selector="6"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="10_min"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" selector="8"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" selector="2"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" selector="5"/>
+  </xccdf:Profile>
+</xccdf:Tailoring>

roles/security/enforce-skat-openscap/files/ssg-rhel8-ds-tailoring.xml

@@ -0,0 +1,411 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
+  <xccdf:benchmark href="/tmp/SCAP Workbench-LrAwLk/ssg-rhel8-ds.xml"/>
+  <xccdf:version time="2019-11-20T12:33:57">1</xccdf:version>
+  <xccdf:Profile id="xccdf_org.ssgproject.content_profile_ospp_customized">
+    <xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Protection Profile for General Purpose Operating Systems [CUSTOMIZED]</xccdf:title>
+    <xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile reflects mandatory configuration controls identified in the
+NIAP Configuration Annex to the Protection Profile for General Purpose
+Operating Systems (Protection Profile Version 4.2.1).
+
+This configuration profile is consistent with CNSSI-1253, which requires
+U.S. National Security Systems to adhere to certain configuration
+parameters. Accordingly, this configuration profile is suitable for
+use in U.S. National Security Systems.</xccdf:description>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_strictmodes" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_csh_cshrc" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_difok" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_maxclassrepeat" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_hardlinks" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_flush" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_freq" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_iptables_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_policycoreutils_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rng-tools_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_audit_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_iprutils_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_gssproxy_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-python_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-rhtsupport_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-logger_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-plugin-sosreport_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt-cli_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_tuned_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_abrt_removed" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_users_coredumps" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_max_concurrent_login_sessions" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_rngd_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_harden_ssh_client_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_dracut_fips_module" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_auditd_configure_rules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_dac_actions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_kernel_module_loading" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_login_events" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_privileged_commands" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_file_deletion_events" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_file_modification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gnome_screen_locking" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_rpm_verification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_bootloader-grub-legacy" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_account_expiration" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_sssd-ipa_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_usbguard_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_usbguard_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_fapolicyd_mounts" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_service_fapolicyd_enabled" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_libcap-ng-utils_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_python3-subscription-manager-rhsm_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_aide" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_software-integrity" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_package_tmux_installed" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_no_tmux_in_shells" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_tmux_lock_after_time" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_tmux_lock_command" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_screen_locking" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_group_sssd" selected="false"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="0"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="027"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" selector="3"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" selector="4"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_flush" selector="incremental_async"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" selector="10"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" selector="5"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="fips"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" selector="12"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="12"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="120_minutes"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
+    <xccdf:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
+    <xccdf:refine-rule idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" role="unscored" severity="info"/>
+    <xccdf:refine-rule idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" role="unscored" severity="info"/>
+  </xccdf:Profile>
+</xccdf:Tailoring>

roles/security/enforce-skat-openscap/handlers/main.yml

@@ -0,0 +1,2 @@
+---
+# handlers file for enforce-skat-openscap

roles/security/enforce-skat-openscap/meta/main.yml

@@ -0,0 +1,57 @@
+galaxy_info:
+  author: your name
+  description: your description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: license (GPLv2, CC-BY, etc)
+
+  min_ansible_version: 1.2
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list of versions.
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

roles/security/enforce-skat-openscap/tasks/main.yml

@@ -0,0 +1,8 @@
+- import_tasks: rhel9/main.yml
+  when: ansible_distribution_major_version == '9'
+
+- import_tasks: rhel8/main.yml
+  when: ansible_distribution_major_version == '8'
+
+- import_tasks: rhel7/main.yml
+  when: ansible_distribution_major_version == '7'

roles/security/enforce-skat-openscap/tasks/rhel7/collect_use_of_privileged_commands.yml

@@ -0,0 +1,151 @@
+- name: Search for privileged commands
+  shell: "find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null | cat"
+  check_mode: no
+  register: find_result
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+
+# Inserts/replaces the rule in /etc/audit/rules.d
+
+- name: Search /etc/audit/rules.d for audit rule entries
+  find:
+    paths: "/etc/audit/rules.d"
+    recurse: no
+    contains: "^.*path={{ item }} .*$"
+    patterns: "*.rules"
+  with_items:
+    - "{{ find_result.stdout_lines }}"
+  register: files_result
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+  
+- name: Overwrites the rule in rules.d
+  lineinfile:
+    path: "{{ item.1.path }}"
+    line: '-a always,exit -F path={{ item.0.item }} -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged'
+    create: no
+    regexp: "^.*path={{ item.0.item }} .*$"
+  with_subelements:
+    - "{{ files_result.results }}"
+    - files
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+    
+- name: Adds the rule in rules.d
+  lineinfile:
+    path: /etc/audit/rules.d/privileged.rules
+    line: '-a always,exit -F path={{ item.item }} -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged'
+    create: yes
+  with_items:
+    - "{{ files_result.results }}"
+  when: item.matched == 0
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360
+  
+# Adds/overwrites the rule in /etc/audit/audit.rules
+
+- name: Inserts/replaces the rule in audit.rules
+  lineinfile:
+    path: /etc/audit/audit.rules
+    line: '-a always,exit -F path={{ item.item }} -F perm=x -F auid>=1000 -F auid!=4294967295 -F key=privileged'
+    create: yes
+    regexp: "^.*path={{ item.item }} .*$"
+  with_items:
+    - "{{ files_result.results }}"
+  tags:
+    - audit_rules_privileged_commands
+    - medium_severity
+    - restrict_strategy
+    - low_complexity
+    - low_disruption
+    - CCE-27437-3
+    - NIST-800-53-AC-17(7)
+    - NIST-800-53-AU-1(b)
+    - NIST-800-53-AU-2(a)
+    - NIST-800-53-AU-2(c)
+    - NIST-800-53-AU-2(d)
+    - NIST-800-53-AU-2(4)
+    - NIST-800-53-AU-6(9)
+    - NIST-800-53-AU-12(a)
+    - NIST-800-53-AU-12(c)
+    - NIST-800-53-IR-5
+    - NIST-800-171-3.1.7
+    - PCI-DSS-Req-10.2.2
+    - CJIS-5.4.1.1
+    - DISA-STIG-RHEL-07-030360