Below table provides the sections of CIS hardening benchmark for RedHat Enterprise Linux (RHEL) 7.x that are covered by the script and the files being created/modified to address the recommendations.

NOTE: Screenshots are included for sections where the difference can be noticed to verify the implementation of CIS script.

CIS Sections	File Created/Modified
Section 1
1.1.1.1 Ensure mounting of cramfs filesystems is disabled	/etc/modprobe.d/CIS.conf
1.1.1.2 Ensure mounting of squashfs filesystems is disabled	/etc/modprobe.d/CIS.conf
1.1.1.3 Ensure mounting of udf filesystems is disabled	/etc/modprobe.d/CIS.conf
Pre-CIS	Post-CIS
1.1.3 Ensure noexec option set on /tmp partition	/etc/fstab
1.1.4 Ensure nodev option set on /tmp partition	/etc/fstab
1.1.5 Ensure nosuid option set on /tmp partition	/etc/fstab
1.1.23 Disable Automounting
1.2.1 Ensure GPG keys are configured	Just checks the current configuration and provides results in the output. No modification.
1.4.3 Ensure authentication required for single user mode	/etc/sysconfig/init
1.5.1 Ensure core dumps are restricted	/etc/sysconfig/init
Pre-CIS	Post-CIS
1.5.4 Ensure prelink is not installed	Remove prelink package (if installed) using ‘yum’ command.
1.7.1 Ensure message of the day is	/etc/motd
1.7.2 Ensure local login warning banner is configured properly	/etc/issue
1.7.3 Ensure remote login warning banner is /etc/issue.net configured properly	/etc/issue.net
1.7.4 Ensure permissions on /etc/motd are configured	/etc/motd
1.7.6 Ensure permissions on /etc/issue.net are configured	/etc/issue

Section 2
2.2.2 Ensure X11 Server components are not Remove xorg-x11 packages using ‘yum’ installed	Remove xorg-x11 packages using ‘yum’ command.
Pre-CIS	Post-CIS
2.2.18 Ensure rpcbind is not installed or the rpcbind services are masked	Disable rpmcbind service.
2.3.1 Ensure NIS Client is not installed	Remove ypbind package using ‘yum’ command.

Section 3
3.2.1 Ensure IP forwarding is disabled	/etc/sysctl.conf
3.2.2 Ensure packet redirect sending is disabled	/etc/sysctl.conf
Pre-CIS	Post-CIS
3.3.1 Ensure source routed packets are not accepted	/etc/sysctl.conf
3.3.2 Ensure ICMP redirects are not accepted	/etc/sysctl.conf
Pre-CIS	Post-CIS
3.3.3 Ensure secure ICMP redirects are not accepted	/etc/sysctl.conf
3.3.4 Ensure suspicious packets are logged	/etc/sysctl.conf
3.3.5 Ensure broadcast ICMP requests are ignored	/etc/sysctl.conf
3.3.6 Ensure bogus ICMP responses are ignored	/etc/sysctl.conf
3.3.7 Ensure Reverse Path Filtering is enabled	/etc/sysctl.conf
3.3.8 Ensure TCP SYN Cookies is enabled	/etc/sysctl.conf
3.3.9 Ensure IPv6 router advertisements are not accepted	/etc/sysctl.conf
3.4.1 Ensure DCCP is disabled	/etc/modprobe.d/CIS.conf
3.4.2 Ensure SCTP is disabled	/etc/modprobe.d/CIS.conf
Pre-CIS	Post-CIS

Section 4
4.1.1.2 Ensure auditd service is enabled and running	Enable auditd service.
4.1.2.1 Ensure audit log storage size is configured	/etc/audit/auditd.conf
4.1.2.2 Ensure audit logs are not automatically deleted	/etc/audit/auditd.conf
Pre-CIS	Post-CIS
4.1.2.3 Ensure system is disabled when audit /etc/audit/auditd.conf logs are full	/etc/audit/auditd.conf
Pre-CIS	Post-CIS
4.1.2.4 Ensure audit_backlog_limit is sufficient	/etc/default/grub
4.1.3 Ensure events that modify date and time information are collected	/etc/audit/audit.rules
4.1.4 Ensure events that modify user/group information are collected	/etc/audit/audit.rules
4.1.5 Ensure events that modify the system's /etc/audit/audit.rules network environment are collected	/etc/audit/audit.rules
4.1.6 Ensure events that modify the system's Mandatory Access Controls are collected	/etc/audit/audit.rules
4.1.7 Ensure login and logout events are collected	/etc/audit/audit.rules
4.1.8 Ensure session initiation information is collected	/etc/audit/audit.rules
4.1.9 Ensure discretionary access control permission modification events are collected	/etc/audit/audit.rules
4.1.10 Ensure unsuccessful unauthorized file access attempts are collected	/etc/audit/audit.rules
4.1.11 Ensure use of privileged commands is collected	/etc/audit/audit.rules
4.1.12 Ensure successful file system mounts are collected	/etc/audit/audit.rules
4.1.13 Ensure file deletion events by users are collected	/etc/audit/audit.rules
4.1.14 Ensure changes to system command executions (sudo) are collected	/etc/audit/audit.rules
4.1.15 Ensure system administrator command executions (sudo) are collected	/etc/audit/audit.rules
4.1.16 Ensure kernel module loading and unloading is collected	/etc/audit/audit.rules
4.1.17 Ensure the audit configuration is immutable	/etc/audit/audit.rules
4.2.1.2 Ensure rsyslog Service is enabled and running	Enable rsyslog service.
4.2.1.4 Ensure logging is configured	/etc/rsyslog.conf
4.2.1.3 Ensure rsyslog default file permissions configured	/etc/rsyslog.conf
4.2.1.5 Ensure rsyslog is configured to send logs to a remote log host	/etc/rsyslog.conf
4.2.1.6 Ensure remote rsyslog messages are /etc/rsyslog.conf only accepted on designated log hosts	/etc/rsyslog.conf
4.2.3 Ensure permissions on all logfiles are configured	/var/log
4.2.4 Ensure logrotate is configured	/etc/logrotate.conf and /etc/logrotate.d/ NOTE: Not modified by script. The script points out that customer should make necessary changes as per internal policy.

Section 5
5.1.1 Ensure cron daemon is enabled and running	Enable crond service.
5.1.2 Ensure permissions on /etc/crontab are configured	/etc/crontab
5.1.3 Ensure permissions on /etc/cron.hourly are configured	/etc/cron.hourly
5.1.4 Ensure permissions on /etc/cron.daily are configured	/etc/cron.daily
Pre-CIS	Post-CIS
5.1.5 Ensure permissions on /etc/cron.weekly are configured	/etc/cron.weekly
5.1.6 Ensure permissions on /etc/cron.monthly are configured	/etc/cron.monthly
5.1.7 Ensure permissions on /etc/cron.d are configured	/etc/cron.d
Pre-CIS