controls/cis_debian13: Map remaining controls in sections 6-7

[israel-villar]

Add logging/auditing (section 6) and system maintenance (section 7) controls to the CIS Debian Linux 13 benchmark mapping.

Section 6 covers:

• 6.1.1: systemd-journald configuration (log file access, rotation, compression, persistent storage, message size, forwarding to syslog)
• 6.1.2: journald configuration via /etc/systemd/journald.conf
• 6.1.3: log file permissions
• 6.2: rsyslog configuration and remote logging
• 6.3: log file access and permissions (logrotate, /var/log)

Section 7 covers:

• 7.1: file permission hardening for system files (/etc/passwd, /etc/group, /etc/shadow, /etc/gshadow and their backups)
• 7.2: local user and group integrity checks

All 205 rule references verified to resolve against current master.

Description:

• Add Logging and Auditing (section 6) controls: 80 controls covering
  systemd-journald service and journal-remote configuration, rsyslog
  installation, service, log forwarding, logrotate, TLS (gtls), and CA
  certificates; auditd service, data retention, 37 audit rules, and file
  access permissions; and AIDE integrity checking.

• Add System Maintenance (section 7) controls: 23 controls covering
  system file and directory access (/etc/passwd, /etc/shadow, /etc/group,
  /etc/gshadow and their backups, /etc/shells, world-writable files, unowned
  files, SUID/SGID review) and local user and group integrity (shadow
  passwords, duplicate UIDs/GIDs/names, home directories, dot files).

Rationale:

• Sections 6 and 7 of the CIS Debian Linux 13 Benchmark v1.0.0 (published
  2025-12-16) were not yet present in controls/cis_debian13.yml. This PR
  continues the incremental mapping started in controls/cis_debian13: Complete and correct section 1 controls #14806 (section 1) and
  follows Add CIS Debian Linux 13 sections 2-4 to controls file #14876 (sections 2–4).

• All 103 control IDs verified against the benchmark PDF, all 205 rule
  references resolve against current master, Automated/Manual classification
  and L1/L2 level assignments match the benchmark for every control.

Review Hints:

• Build the product to verify the control file is valid:
  ./build_product debian13 --datastream-only

• Only controls/cis_debian13.yml is modified — a single commit, safe to
  review as one diff.

• Related PRs: section 1 pending controls/cis_debian13: Complete and correct section 1 controls #14806, sections 2–4 pending Add CIS Debian Linux 13 sections 2-4 to controls file #14876,
  section 5 pending Add Debian 13 PAM support to existing rules #14781.

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jan-cerny]

The selected rules match the respective controls.