Below table provides the sections of CIS hardening benchmark for Rocky Linux 9.x that are covered by the script and the files being created/modified to address the recommendations.

NOTE: Screenshots are included for sections where the difference can be noticed to verify the implementation of CIS script.

CIS Sections	File Created/Modified
Section 1
1.1.1.1 Ensure mounting of squashfs filesystems is disabled	/etc/modprobe.d/CIS.conf
1.1.1.2 Ensure mounting of udf filesystems is disabled	/etc/modprobe.d/CIS.conf
Pre-CIS	Post-CIS
1.1.2.2 Ensure nodev option set on /tmp partition	/etc/fstab
1.1.2.3 Ensure noexec option set on /tmp partition	/etc/fstab
1.1.2.4 Ensure nosuid option set on /tmp partition	/etc/fstab
1.2.1 Ensure GPG keys are configured	Just checks the current configuration and provides results in the output. No modification.
1.7.1 Ensure message of the day is configured properly	/etc/motd
1.7.2 Ensure local login warning banner is configured properly	/etc/issue
1.7.3 Ensure remote login warning banner is /etc/issue.net configured properly	/etc/issue.net
1.7.4 Ensure permissions on /etc/motd are configured	/etc/motd
1.7.5 Ensure permissions on /etc/issue are configured	/etc/issue
1.7.6 Ensure permissions on /etc/issue.net are configured	/etc/issue.net

Section 2
2.2.1 Ensure X11 Server components are not installed	Remove xorg-x11 packages using ‘yum’ command.
Pre-CIS	Post-CIS
2.2.17 Ensure rpcbind is not installed or the rpcbind services are masked	Disable rpmcbind service.

Section 4
4.1.1.2 Ensure auditing for processes that start prior to auditd is enabled	/etc/default/grub
4.1.1.4 Ensure auditd service is enabled	Enable auditd service.
4.1.2.1 Ensure audit log storage size is configured	/etc/audit/auditd.conf
4.1.2.2 Ensure audit logs are not automatically deleted	/etc/audit/auditd.conf
Pre-CIS	Post-CIS
4.1.2.3 Ensure system is disabled when audit logs are full	/etc/audit/auditd.conf
Pre-CIS	Post-CIS
4.1.3.1 Ensure changes to system administration scope (sudoers) is collected	/etc/audit/audit.rules
4.1.3.4 Ensure events that modify date and time information are collected	/etc/audit/audit.rules
4.1.3.5 Ensure events that modify the system's network environment are collected	/etc/audit/audit.rules
4.1.3.7 Ensure unsuccessful unauthorized file access attempts are collected	/etc/audit/audit.rules
4.1.3.8 Ensure events that modify user/group /etc/audit/audit.rules information are collected	/etc/audit/audit.rules
4.1.3.9 Ensure discretionary access control permission modification events are collected	/etc/audit/audit.rules
4.1.3.10 Ensure successful file system mounts are collected	/etc/audit/audit.rules
4.1.3.11 Ensure session initiation information is collected	/etc/audit/audit.rules
4.1.3.12 Ensure login and logout events are collected	/etc/audit/audit.rules
4.1.3.13 Ensure file deletion events by users are collected	/etc/audit/audit.rules
4.1.3.14 Ensure events that modify the system's Mandatory Access Controls are collected	/etc/audit/audit.rules
4.1.3.19 Ensure kernel module loading and unloading is collected	/etc/audit/audit.rules
4.1.3.20 Ensure the audit configuration is immutable	/etc/audit/audit.rules
4.2.1.1 Ensure rsyslog is installed	Script checks whether rsyslog package is installed or not. If not, prints message requesting user to install the package.
4.2.1.2 Ensure rsyslog Service is enabled and running	Enable rsyslog service.
4.2.1.4 Ensure rsyslog default file permissions configured	/etc/rsyslog.conf
4.2.1.5 Ensure logging is configured	/etc/rsyslog.conf
4.2.1.6 Ensure rsyslog is configured to send logs to a remote log host	/etc/rsyslog.conf
4.2.1.7 Ensure rsyslog is not configured to receive logs from a remote client	/etc/rsyslog.conf
4.3 Ensure logrotate is configured	/etc/logrotate.conf and /etc/logrotate.d/ NOTE: Not modified by script. The script points out that customer should make necessary changes as per internal policy.

Section 5
5.1.1 Ensure cron daemon is enabled	Enable crond service.
5.1.2 Ensure permissions on /etc/crontab are configured	/etc/crontab
5.1.3 Ensure permissions on /etc/cron.hourly are configured	/etc/cron.hourly
5.1.4 Ensure permissions on /etc/cron.daily are configured	/etc/cron.daily
Pre-CIS	Post-CIS
5.1.5 Ensure permissions on /etc/cron.weekly are configured	/etc/cron.weekly
5.1.6 Ensure permissions on /etc/cron.monthly are configured	/etc/cron.monthly
5.1.7 Ensure permissions on /etc/cron.d are configured	/etc/cron.d
Pre-CIS	Post-CIS
5.1.8 Ensure cron is restricted to authorized users	/etc/cron.allow NOTE: Only file is created by script with right permissions. Customer is requested to add necessary users as per internal policy.
5.1.9 Ensure at is restricted to authorized users	/etc/at.allow NOTE: Only file is created by script with right permissions. Customer is requested to add necessary users as per internal policy.
5.2.1 Ensure permissions on /etc/ssh/sshd_config are configured	/etc/ssh/sshd_config
5.2.4 Ensure SSH access is limited	/etc/ssh/sshd_config NOTE: As per the script message, make necessary changes to allow-deny users.
5.2.5 Ensure SSH LogLevel is appropriate	/etc/ssh/sshd_config
5.2.6 Ensure SSH PAM is enabled	/etc/ssh/sshd_config
5.2.8 Ensure SSH HostbasedAuthentication is disabled	/etc/ssh/sshd_config
5.2.9 Ensure SSH PermitEmptyPasswords is disabled	/etc/ssh/sshd_config
5.2.10 Ensure SSH PermitUserEnvironment is disabled	/etc/ssh/sshd_config
5.2.11 Ensure SSH IgnoreRhosts is enabled	/etc/ssh/sshd_config
5.2.12 Ensure SSH X11 forwarding is disabled	/etc/ssh/sshd_config
5.2.15 Ensure SSH warning banner is configured	/etc/issue.net NOTE: As per the script message, make necessary changes to file for appropriate login message.
5.2.16 Ensure SSH MaxAuthTries is set to 4 or less	/etc/ssh/sshd_config
5.2.19 Ensure SSH LoginGraceTime is set to one minute or less	/etc/ssh/sshd_config
5.2.20 Ensure SSH Idle Timeout Interval is configured	/etc/ssh/sshd_config
5.3.7 Ensure access to the su command is restricted	/etc/pam.d/su Script message: Please remember to put the appropriate users into /etc/group under the wheel entry to give them su access after this script completes.
5.5.1 Ensure password creation requirements are configured	/etc/pam.d/password-auth and /etc/pam.d/system-auth
5.5.2 Ensure lockout for failed password attempts is configured	/etc/pam.d/password-auth and /etc/pam.d/system-auth
5.5.3 Ensure password reuse is limited	/etc/pam.d/password-auth and /etc/pam.d/system-auth
5.5.4 Ensure password hashing algorithm is SHA-512 or yescrypt	/etc/pam.d/password-auth and /etc/pam.d/system-auth
5.6.1.1 Ensure password expiration is 365 days or less	/etc/login.defs
5.6.1.2 Ensure minimum days between password changes is configured	/etc/login.defs
5.6.1.3 Ensure password expiration warning days is 7 or more	/etc/login.defs
5.6.1.4 Ensure inactive password lock is 30 days or less	Set the default password inactivity period to 30 days and inactivate the users with passwords older than 30 days.
Pre-CIS	Post-CIS