Add CIS Debian Linux 13 sections 2-4 to controls file

[israel-villar]

Adds controls for sections 2 (Services), 3 (Network), and 4 (Host Based Firewall) of the CIS Debian Linux 13 Benchmark v1.0.0 to controls/cis_debian13.yml. All level assignments and rule mappings verified against the benchmark PDF.

Description:

• Add Services (section 2) controls: 53 controls covering server services
  to disable (autofs, avahi, dhcp, dns, dnsmasq, ftp, ldap, imap/pop3, nfs,
  nis, cups, rpcbind, rsync, samba, snmp, telnet, tftp, squid, httpd, xinetd,
  xorg, postfix), client packages to remove (nis, rsh, talk, telnet, ldap,
  ftp), time synchronization (systemd-timesyncd, chrony), and job schedulers
  (cron, at).

• Add Network Configuration (section 3) controls: 30 controls covering
  network device settings (IPv6, wireless, bluetooth), unused network kernel
  modules (atm, can, dccp, rds, sctp, tipc), and IPv4/IPv6 sysctl parameters.

• Add Host Based Firewall (section 4) controls: 5 controls covering UFW
  installation, service status, and default incoming/outgoing/routed policies.

Rationale:

• Sections 2–4 of the CIS Debian Linux 13 Benchmark v1.0.0 (published
  2025-12-16) were not yet present in controls/cis_debian13.yml. Section 1
  was added in controls/cis_debian13: Complete and correct section 1 controls #14806. This PR continues the incremental mapping.

• All 88 control IDs have been verified against the benchmark, all rule
  references resolve against current master, and Automated/Manual
  classification matches the benchmark for every control.

Review Hints:

• Build the product to verify the control file is valid:
  ./build_product debian13 --datastream-only

• Only controls/cis_debian13.yml is modified — a single commit, safe to
  review as one diff.

• Related PRs: section 1 pending controls/cis_debian13: Complete and correct section 1 controls #14806, section 5 pending Add Debian 13 PAM support to existing rules #14781,
  sections 6–7 pending.

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jan-cerny]

@israel-villar please rebase this PR on the top of upstream master branch and resolve the conflicts.

[israel-villar]

@israel-villar please rebase this PR on the top of upstream master branch and resolve the conflicts.

@jan-cerny Done — rebased on current upstream/master.

To resolve the conflicts, I compared the controls against the CIS Debian 13 Benchmark PDF and the actual rule definitions in the repo. Out of 85 controls, 41 were identical and 44 differed; in every differing case this branch's mapping turned out to be correct or more complete, e.g.:

• 2.1.3: The CIS Debian 13 benchmark identifies kea as the DHCP server package to check for (Debian 13 replaced isc-dhcp-server with kea) — we added the corresponding rules in PR Add service disable rules for Kea DHCP server (CIS 2.1.3) #14765, which is what this branch uses instead of package_dhcp_removed/service_dhcpd_disabled
• 2.1.16: replace package_telnet-server_removed rule with package_inetutils-telnet_removed.
• 4.1.1–4.1.5: the rules for "ufw service is configured" (4.1.2) had been placed under 4.1.1, leaving 4.1.2-4.1.5 as pending.
• 2.4.1.2/2.4.1.9: remove file_cron_allow_exists rulel.
• 3.2.3-3.2.6 (dccp/rds/sctp/tipc): benchmark specifies Level 1, these were set to Level 2.

So I kept this branch's section 2-4 content as-is and rebased cleanly around it. ./build_product debian13 --datastream-only builds without errors, 343 controls total, no duplicates.

@a-skr flagging this so you're aware — happy to walk through any of the above if you see it differently, no intent to step on your work, just what the rebase surfaced.

@rrskris would appreciate your review whenever you get a chance.

[rrskris]

Thanks for the detailed writeup on the rebase, @israel-villar — that's exactly the kind of trail that makes a reviewer's job easy.

I went through the diff against current upstream (fetched refs/pull/14876/head locally, no build):

• Every rule ID referenced in the changed controls resolves to a real rule.yml — checked all of the DHCP (package_kea_removed, service_kea_dhcp4_server_disabled, service_kea_dhcp6_server_disabled, service_kea_dhcp_ddns_server_disabled), telnet (package_inetutils-telnetd_removed, package_telnetd_removed), cron (file_groupowner_cron_yearly + siblings), kernel-module, and ufw (ufw_default_outgoing_rule, ufw_disabled_routed, check_ufw_active) rules. No dangling references.
• None of those carry a prodtype/platform restriction that would exclude Debian 13, so the new mappings are safe to apply as-is — including the kea swap, which lines up with Debian 13 actually replacing isc-dhcp-server.
• The new notes: on 3.3.1.16 (sysctl_reapply_after_network) checks out word-for-word against that rule's actual remediation — it's describing the real oneshot-service behavior, not a placeholder justification.
• The 4.1.4 level bump to L2 and the 3.2.3–3.2.6 L2→L1 change both match the rationale you gave above; nothing in the diff contradicts it.

No concerns from this pass. I'll leave the merge call to @jan-cerny and @a-skr since they've got the closer history on section 2-4 — just wanted to confirm the mechanics hold up.