MEDIUM Mixed M29: System Access Controls P3

Pending Compare Branch Scanned: 2026-08-12

Overview

Miscellaneous system access hardening: sets a legal login banner, ensures log rotation is active, disables the emergency debug shell, and restricts tmux in login shells.

Profile: NIST 800-53 Moderate (rhcos4-moderate)

Compliance Checks

Check	Description
`Login banner`	Set /etc/issue legal notice banner
`Log rotation`	Ensure logrotate is activated
`Debug shell`	Disable debug-shell.service
`tmux restriction`	Prevent tmux in login shells

Verification

oc debug node/<node> -- chroot /host bash -c 'cat /etc/issue; systemctl is-enabled debug-shell.service'

← M28 All Groups M30 →

Legend

Remediation Status

✅ PASS (vanilla) Passes on unhardened RHCOS; no remediation needed

🟢 Verified Remediation tested on live cluster, confirmed PASS

🔵 In Progress Remediation actively being developed or tested

🟡 Pending Not yet started; needs remediation work

🟠 Partial Some checks pass or remediation not fully validated

⚪ On Hold Work paused (blocked or deprioritized)

Upstream Verdict

🔼 Candidate Suitable for upstreaming to ComplianceAsCode

🟣 PR Open Upstream PR filed

🎯 RAN Only Only applies to RAN deployments

⚙️ Platform Requires OCP platform-level configuration

✅ Pass Already passing upstream

📍 Site Site/deployment-specific configuration

— N/A Not applicable for upstreaming

Platform

RHCOS Node-level checks (MachineConfig)

OCP Platform-level checks (API/CR)

Mixed Both RHCOS and OCP checks

Severity

HIGH

MEDIUM

LOW

MANUAL

MEDIUM Mixed M29: System Access Controls P3

Overview

Compliance Checks

Verification

Keyboard Shortcuts