Stock policy definitions
Stock policy definitions
Section titled “Stock policy definitions”rConfig publishes a set of ready-made policy definition files in the rconfig/pro-policy-definitions repository on GitHub. They are organised by vendor, and you load them into rConfig with Import Templates (see importing a stock template).
These pages document release v1.2.0. Each vendor page lists every rule in each file, the method it uses and what it checks.
Three kinds of file
Section titled “Three kinds of file”| Kind | What it is |
|---|---|
| Hardening | A set of security checks on one topic, such as management access, AAA, SNMP, logging or services. Assign it as it is, or remove the rules that do not apply to your network. |
| Operational standards | Checks for drift from your own operational standard (NTP, syslog and DNS servers, login banner, interface descriptions, hostname pattern, SNMP location). It is a template to edit: the server and hostname rules use RFC 5737 example values, so expect them to fail until you replace those values with your own. |
| Build template | A starting template for a new device build, with example values (hostnames, addresses, servers) to replace with your own. It is not a compliance check: expect its rules to fail until you replace the example values. |
Vendors and files
Section titled “Vendors and files”The Juniper files are written for display set format and have not yet been checked against a real Junos device (see the Juniper page).
A file needs the highest minimum version of any method it contains. See minimum versions.
Status labels
Section titled “Status labels”Each file’s .meta.yaml sidecar records a status:
| Status | Meaning |
|---|---|
| Lab tested | Expected results are recorded, with rConfig Pro, against at least one lab or sanitised real sample config in the repository. |
| Synthetic tested | Expected results are recorded against synthetic sample configs only. |
| Under review | The file has known problems, explained in its notes. Only pro-base-template/defaultPolicyDefinition.policy, which these pages do not cover, has this status. |
The status says how a file was tested, not that its rules pass on any particular device. It is separate from the Lab tested and Verified statuses on the platform pages, which mean an automated rConfig Pro test asserts the result shown.
References
Section titled “References”Hardening files can list published references for each rule in their sidecar: a NIST SP 800-53 control, a HIPAA 45 CFR section or a NIST CSF 1.1 subcategory. The vendor pages show them where a rule has one. They record the mapping the rule was published with. A rule provides evidence towards a control; it does not make a device compliant with it.