From 49b0ed553a842d15ed5f942dd9825aa89eb84078 Mon Sep 17 00:00:00 2001
From: "steven.y.gui" <steven_ygui@163.com>
Date: Mon, 26 Jun 2023 17:09:54 +0800
Subject: [PATCH] enable-76-rules-for-openEuler

---
 .../rule.yml                                  | 30 +++++++
 .../services/ftp/package_ftp_removed/rule.yml | 22 +++++
 .../tftp/package_tftp-server_removed/rule.yml |  2 +-
 .../tftp/package_tftp_removed/rule.yml        |  2 +-
 .../package_net-snmp_removed/rule.yml         |  2 +-
 .../disable_host_auth/oval/shared.xml         | 20 +++++
 .../sshd_allow_only_protocol2/oval/shared.xml | 20 +++++
 .../oval/shared.xml                           | 20 +++++
 .../sshd_disable_rhosts/oval/shared.xml       | 20 +++++
 .../sshd_enable_pam/policy/stig/shared.yml    | 26 ++++++
 .../ssh/ssh_server/sshd_enable_pam/rule.yml   | 26 ++++++
 .../sshd_use_strong_ciphers/rule.yml          |  2 +-
 .../sshd_use_strong_kex/oval/shared.xml       | 73 ++++++++++++++++
 .../ssh_server/sshd_use_strong_kex/rule.yml   | 17 ++++
 .../ssh_server/sshd_use_strong_macs/rule.yml  |  2 +-
 .../sshd_use_strong_pubkey/oval/shared.xml    |  1 +
 .../sshd_use_strong_pubkey/rule.yml           | 13 +++
 .../guide/services/ssh/sshd_strong_kex.var    | 19 +++++
 .../oval/shared.xml                           |  1 +
 .../rule.yml                                  |  7 +-
 .../oval/shared.xml                           | 12 ++-
 .../rule.yml                                  |  8 +-
 .../oval/shared.xml                           | 13 ++-
 .../rule.yml                                  |  2 +-
 .../oval/shared.xml                           |  1 +
 .../rule.yml                                  |  2 +-
 ...nts_passwords_pam_faillock_unlock_time.var |  1 +
 .../oval/shared.xml                           | 32 +++++++
 .../no_name_contained_in_password/rule.yml    | 12 +++
 .../accounts_password_pam_dcredit/rule.yml    |  2 +-
 .../oval/shared.xml                           | 27 ++++++
 .../accounts_password_pam_dictcheck/rule.yml  | 28 ++++++
 .../accounts_password_pam_lcredit/rule.yml    |  2 +-
 .../accounts_password_pam_minclass/rule.yml   |  2 +-
 .../accounts_password_pam_minlen/rule.yml     |  2 +-
 .../accounts_password_pam_ocredit/rule.yml    |  2 +-
 .../oval/shared.xml                           |  1 +
 .../accounts_password_pam_retry/rule.yml      |  7 +-
 .../accounts_password_pam_ucredit/rule.yml    |  2 +-
 .../var_password_pam_dictcheck.var            | 16 ++++
 .../oval/shared.xml                           |  1 +
 .../rule.yml                                  |  2 +-
 .../verify_owner_password/oval/shared.xml     | 60 +++++++++++++
 .../verify_owner_password/rule.yml            | 12 +++
 .../require_singleuser_auth/oval/shared.xml   | 21 ++++-
 .../require_singleuser_auth/rule.yml          |  2 +-
 .../account_unique_group_id/oval/shared.xml   | 51 +++++++++++
 .../account_unique_group_id/rule.yml          | 11 +++
 .../account_unique_id/oval/shared.xml         | 51 +++++++++++
 .../account_unique_id/policy/stig/shared.yml  | 15 ++++
 .../account_unique_id/rule.yml                | 11 +++
 .../tests/correct_value.pass.sh               |  2 +
 .../tests/wrong_value.fail.sh                 |  5 ++
 .../accounts_are_necessary/oval/shared.xml    | 25 ++++++
 .../accounts_are_necessary/rule.yml           | 20 +++++
 .../group_unique_id/oval/shared.xml           | 50 +++++++++++
 .../group_unique_id/policy/stig/shared.yml    | 15 ++++
 .../group_unique_id/rule.yml                  | 12 +++
 .../tests/correct_value.pass.sh               |  4 +
 .../group_unique_id/tests/wrong_value.fail.sh |  5 ++
 .../group_unique_name/oval/shared.xml         | 50 +++++++++++
 .../group_unique_name/rule.yml                | 12 +++
 .../tests/correct_value.pass.sh               |  4 +
 .../tests/wrong_value.fail.sh                 |  5 ++
 .../oval/shared.xml                           | 30 +++++++
 .../login_accounts_are_necessary/rule.yml     | 31 +++++++
 .../accounts_maximum_age_login_defs/rule.yml  |  5 ++
 .../gid_passwd_group_same/oval/shared.xml     |  3 +-
 .../accounts_tmout/oval/shared.xml            |  1 +
 .../accounts-session/accounts_tmout/rule.yml  |  7 +-
 .../oval/shared.xml                           | 83 ++++++++++++++++++
 .../rule.yml                                  |  2 +-
 .../accounts_umask_etc_bashrc/oval/shared.xml |  1 +
 .../accounts_umask_etc_bashrc/rule.yml        |  9 +-
 .../accounts_umask_interactive_users/rule.yml |  2 +-
 .../oval/shared.xml                           | 20 +++++
 .../grub2_nosmap_argument_absent/rule.yml     | 25 ++++++
 .../oval/shared.xml                           | 20 +++++
 .../grub2_nosmep_argument_absent/rule.yml     | 25 ++++++
 .../grub2_uefi_password/rule.yml              |  2 +-
 .../oval/shared.xml                           |  1 +
 .../oval/shared.xml                           |  1 +
 .../file_permissions_ungroupowned/rule.yml    |  2 +-
 .../files/no_empty_symlink_files/rule.yml     | 26 ++++++
 .../no_files_unowned_by_user/oval/shared.xml  |  1 +
 .../files/no_files_unowned_by_user/rule.yml   |  2 +-
 .../files/no_hide_exec_files/oval/shared.xml  | 40 +++++++++
 .../files/no_hide_exec_files/rule.yml         | 14 +++
 .../sysctl_kernel_kptr_restrict/rule.yml      |  8 +-
 .../sysctl_kernel_dmesg_restrict/rule.yml     |  2 +-
 .../oval/shared.xml                           |  1 +
 .../configure_ssh_crypto_policy/rule.yml      |  2 +-
 .../package_python2_removed/rule.yml          | 18 ++++
 .../oval/shared.xml                           |  1 +
 .../ensure_gpgcheck_never_disabled/rule.yml   |  2 +-
 .../cpe/openeuler2203-cpe-dictionary.xml      | 61 +++++++++++++
 openeuler2203/profiles/standard.profile       | 85 +++++++++++++++++++
 .../oval/installed_env_has_login_defs.xml     |  4 +
 shared/macros-oval.jinja                      | 73 ++++++++++++++++
 shared/templates/template_OVAL_sysctl         |  4 +
 ssg/constants.py                              |  4 +-
 101 files changed, 1526 insertions(+), 37 deletions(-)
 create mode 100644 linux_os/guide/services/cron_and_at/no_lowprivilege_users_writeable_cmds_in_crontab_file/rule.yml
 create mode 100644 linux_os/guide/services/ftp/package_ftp_removed/rule.yml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/disable_host_auth/oval/shared.xml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/oval/shared.xml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/oval/shared.xml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/oval/shared.xml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/policy/stig/shared.yml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/oval/shared.xml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/rule.yml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/oval/shared.xml
 create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/rule.yml
 create mode 100644 linux_os/guide/services/ssh/sshd_strong_kex.var
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/verify_owner_password/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/verify_owner_password/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/policy/stig/shared.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/policy/stig/shared.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/correct_value.pass.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/wrong_value.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/correct_value.pass.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/wrong_value.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/oval/shared.xml
 create mode 100644 linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml
 create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/oval/shared.xml
 create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/rule.yml
 create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/oval/shared.xml
 create mode 100644 linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/rule.yml
 create mode 100644 linux_os/guide/system/permissions/files/no_empty_symlink_files/rule.yml
 create mode 100644 linux_os/guide/system/permissions/files/no_hide_exec_files/oval/shared.xml
 create mode 100644 linux_os/guide/system/permissions/files/no_hide_exec_files/rule.yml
 create mode 100644 linux_os/guide/system/software/system-tools/package_python2_removed/rule.yml

diff --git a/linux_os/guide/services/cron_and_at/no_lowprivilege_users_writeable_cmds_in_crontab_file/rule.yml b/linux_os/guide/services/cron_and_at/no_lowprivilege_users_writeable_cmds_in_crontab_file/rule.yml
new file mode 100644
index 0000000..ef1fc32
--- /dev/null
+++ b/linux_os/guide/services/cron_and_at/no_lowprivilege_users_writeable_cmds_in_crontab_file/rule.yml
@@ -0,0 +1,30 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Commands/Bashes In Crontab File Are Not Writeable By Low-privilege Users'
+
+description: |-
+    <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+    <p>Use below cli commands to check if there is any low-privilege users writeable commands/bashes in <tt>/etc/crontab</tt></p>
+    <ul>
+    <li>Step 1: list the commands/bashes from <tt>/etc/crontab</tt>
+    <pre>
+    # cat /etc/crontab
+    /bin/example.sh
+    </pre>
+    </li>
+    <li>Step 2: check the right of the commands/bashes file
+    <pre>
+    # ll /bin/example.sh
+    -rwxrwxrwx. 1 root root 200 Mar 17 18:00 /bin/example.sh
+    </pre>
+    </li>
+    </ul>
+    So, the wirteable flag of other users is present(-rwxr<tt>w</tt>xr<tt>w</tt>x.) and it is a risk.
+
+rationale: |-
+    If any symlink files have no camonical path, it should be removed.
+
+severity: medium
+
diff --git a/linux_os/guide/services/ftp/package_ftp_removed/rule.yml b/linux_os/guide/services/ftp/package_ftp_removed/rule.yml
new file mode 100644
index 0000000..ee68c97
--- /dev/null
+++ b/linux_os/guide/services/ftp/package_ftp_removed/rule.yml
@@ -0,0 +1,22 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Remove ftp Client'
+
+description: |-
+    FTP is a simple file transfer protocol,
+    it does not support authentication and can be easily hacked. The package
+    <tt>ftp</tt> is a client program that allows for connections to a <tt>ftp</tt> server.
+
+rationale: |-
+    It is recommended that FTP be removed, unless there is a specific need
+    for FTP. In that case, use extreme caution when configuring
+    the services.
+
+severity: low
+
+template:
+    name: package_removed
+    vars:
+        pkgname: ftp
diff --git a/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml b/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml
index 37a9b68..700e673 100644
--- a/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml
+++ b/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Uninstall tftp-server Package'
 
diff --git a/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml b/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml
index 2e7858e..de45e4b 100644
--- a/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml
+++ b/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: rhel6,rhel7,rhel8
+prodtype: openeuler2203,rhel6,rhel7,rhel8
 
 title: 'Remove tftp Daemon'
 
diff --git a/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml b/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml
index 817463d..6484570 100644
--- a/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml
+++ b/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: debian10,debian9,fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: debian10,debian9,fedora,ocp4,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Uninstall net-snmp Package'
 
diff --git a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/oval/shared.xml
new file mode 100644
index 0000000..8178251
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="disable_host_auth" version="1">
+    <metadata>
+      <title>Disable Host-Based Authentication</title>
+      {{{- oval_affected(products) }}}
+      <description>To disable host-based authentication.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="To disable host-based authentication" test_ref="test_disable_host_auth" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test host-based authentication disabled" id="test_disable_host_auth" version="1">
+    <ind:object object_ref="object_disable_host_auth" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_disable_host_auth" version="1">
+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+    <ind:pattern operation="pattern match">^HostbasedAuthentication[\s]+no$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/oval/shared.xml
new file mode 100644
index 0000000..9446c3f
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="sshd_allow_only_protocol2" version="1">
+    <metadata>
+      <title>Allow Only SSH Protocol 2</title>
+      {{{- oval_affected(products) }}}
+      <description>Only SSH protocol version 2 connections should be permitted.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="tests that there are only SSH protocol version 2 connections should be permitted" test_ref="test_sshd_allow_only_protocol2" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="test that there are only SSH protocol version 2 connections should be permitted" id="test_sshd_allow_only_protocol2" version="1">
+    <ind:object object_ref="object_sshd_allow_only_protocol2" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_sshd_allow_only_protocol2" version="1">
+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+    <ind:pattern operation="pattern match">^Protocol[\s]+2$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/oval/shared.xml
new file mode 100644
index 0000000..44c5eab
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="sshd_disable_empty_passwords" version="1">
+    <metadata>
+      <title>Disable SSH Access via Empty Passwords</title>
+      {{{- oval_affected(products) }}}
+      <description>Disable SSH Access via Empty Passwords.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="To disable SSH access via empty passwords" test_ref="test_sshd_disable_empty_passwords" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test empty passwords accessing disabled" id="test_sshd_disable_empty_passwords" version="1">
+    <ind:object object_ref="object_sshd_disable_empty_passwords" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_sshd_disable_empty_passwords" version="1">
+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+    <ind:pattern operation="pattern match">^PermitEmptyPasswords[\s]+no$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/oval/shared.xml
new file mode 100644
index 0000000..22a1069
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="sshd_disable_rhosts" version="1">
+    <metadata>
+      <title>Disable SSH Support for .rhosts Files</title>
+      {{{- oval_affected(products) }}}
+      <description>Disable SSH Support for .rhosts Files.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="To disable SSH support for .rhosts files" test_ref="test_sshd_disable_rhosts" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test .rhosts files supporting disabled" id="test_sshd_disable_rhosts" version="1">
+    <ind:object object_ref="object_sshd_disable_rhosts" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_sshd_disable_rhosts" version="1">
+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+    <ind:pattern operation="pattern match">^IgnoreRhosts[\s]+yes$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/policy/stig/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/policy/stig/shared.yml
new file mode 100644
index 0000000..5a3d8ee
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/policy/stig/shared.yml
@@ -0,0 +1,26 @@
+srg_requirement: |-
+    {{{ full_name }}} must enable the Pluggable Authenitcation Module (PAM) interface for SSHD.
+
+vuldiscussion: |-
+    When UsePAM is set to yes, PAM runs through account and session types properly. This is
+    important if you want to restrict access to services based off of IP, time or other factors of
+    the account. Additionally, you can make sure users inherit certain environment variables
+    on login or disallow access to the server.
+
+checktext: |-
+    Verify the {{{ full_name }}} SSHD is configured to allow for the UsePAM interface with the following command:
+
+    $ sudo grep -i usepam /etc/ssh/sshd_config
+
+    UsePAM yes
+
+    If the "UsePAM" keyword is set to "no", is missing, or is commented out, this is a finding.
+
+fixtext: |-
+    Configure the {{{ full_name }}} SSHD to use the UsePAM interface add or modify the following line in "/etc/ssh/sshd_config".
+
+    UsePAM yes
+
+    Restart the SSH daemon for the settings to take effect:
+
+    $ sudo systemctl restart sshd.service
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml
new file mode 100644
index 0000000..e303b2c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml
@@ -0,0 +1,26 @@
+documentation_complete: true
+
+title: 'Enable PAM'
+
+description: |-
+    UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
+    enable PAM authentication using ChallengeResponseAuthentication and
+    PasswordAuthentication in addition to PAM account and session module processing for all
+    authentication types.
+
+rationale: |-
+    When UsePAM is set to yes, PAM runs through account and session types properly. This is
+    important if you want to restrict access to services based off of IP, time or other factors of
+    the account. Additionally, you can make sure users inherit certain environment variables
+    on login or disallow access to the server.
+
+severity: medium
+
+
+template:
+    name: sshd_lineinfile
+    vars:
+        missing_parameter_pass: 'false'
+        parameter: UsePAM
+        rule_id: sshd_enable_pam
+        value: 'yes'
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_ciphers/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_ciphers/rule.yml
index d476fda..59bb6a6 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_ciphers/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_ciphers/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,rhel6,rhel7
+prodtype: ol7,openeuler2203,rhel6,rhel7
 
 title: 'Use Only Strong Ciphers'
 
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/oval/shared.xml
new file mode 100644
index 0000000..d8d13d8
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/oval/shared.xml
@@ -0,0 +1,73 @@
+<def-group>
+  <definition class="compliance" id="sshd_use_strong_kex" version="1">
+    {{{ oval_metadata("Limit the Key Exchange Algorithms to those which are FIPS-approved.") }}}
+    {{% if product in ['openeuler2203'] %}}
+    <criteria comment="SSH is configured correctly or is not installed">
+      <criterion comment="Check KexAlgorithms in /etc/ssh/sshd_config"
+            test_ref="test_sshd_use_strong_kex" />
+    </criteria>
+    {{% else %}}
+    <criteria comment="SSH is configured correctly or is not installed"
+        operator="OR">
+      <criteria comment="sshd is not installed" operator="AND">
+        <extend_definition comment="sshd is not required or requirement is unset"
+            definition_ref="sshd_not_required_or_unset" />
+        {{% if product in ['opensuse', 'sle12', 'sle15'] %}}
+        <extend_definition comment="package openssh removed"
+            definition_ref="package_openssh_removed" />
+        {{% else %}}
+        <extend_definition comment="package openssh-server removed"
+            definition_ref="package_openssh-server_removed" />
+        {{% endif %}}
+      </criteria>
+      <criteria comment="sshd is installed and configured" operator="AND">
+        <extend_definition comment="sshd is required or requirement is unset"
+            definition_ref="sshd_required_or_unset" />
+        {{% if product in ['opensuse', 'sle12', 'sle15'] %}}
+        <extend_definition comment="package openssh installed"
+            definition_ref="package_openssh_installed" />
+        {{% else %}}
+        <extend_definition comment="package openssh-server installed"
+            definition_ref="package_openssh-server_installed" />
+        {{% endif %}}
+        <criterion comment="Check KexAlgorithms in /etc/ssh/sshd_config"
+            test_ref="test_sshd_use_strong_kex" />
+      </criteria>
+    </criteria>
+    {{% endif %}}
+  </definition>
+
+  <ind:variable_test check="at least one"
+  comment="tests the value of KexAlgorithms setting in the /etc/ssh/sshd_config file"
+  id="test_sshd_use_strong_kex" version="1">
+    <ind:object object_ref="obj_sshd_use_strong_kex" />
+    <ind:state state_ref="ste_sshd_use_strong_kex" />
+  </ind:variable_test>
+
+  <ind:variable_object id="obj_sshd_use_strong_kex" version="1">
+    <ind:var_ref>var_sshd_config_kex</ind:var_ref>
+  </ind:variable_object>
+
+  <ind:variable_state comment="approved strong kex" id="ste_sshd_use_strong_kex" version="1">
+    <ind:value operation="equals" datatype="string" var_ref="var_sshd_strong_kex" var_check="at least one" />
+  </ind:variable_state>
+
+  <ind:textfilecontent54_object id="obj_sshd_config_kex" version="1">
+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*(?i)KexAlgorithms(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <local_variable id="var_sshd_config_kex" datatype="string" version="1" comment="MACs values splitted on comma">
+    <split delimiter=",">
+      <object_component item_field="subexpression" object_ref="obj_sshd_config_kex" />
+    </split>
+  </local_variable>
+
+  <local_variable id="var_sshd_strong_kex" datatype="string" version="1" comment="approved strong KEX values splitted on comma">
+    <split delimiter=",">
+      <variable_component var_ref="sshd_strong_kex" />
+    </split>
+  </local_variable>
+  <external_variable comment="SSH Approved KEX by FIPS" datatype="string" id="sshd_strong_kex" version="1" />
+</def-group>
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/rule.yml
new file mode 100644
index 0000000..2f94f68
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/rule.yml
@@ -0,0 +1,17 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Use Only Strong Key Exchange algorithms'
+
+description: |-
+    Limit the Key Exchange to strong algorithms.
+
+rationale: |-
+    Key exchange is any method in cryptography by which cryptographic keys are exchanged
+    between two parties, allowing use of a cryptographic algorithm. If the sender and receiver
+    wish to exchange encrypted messages, each must be equipped to encrypt messages to be
+    sent and decrypt messages received
+
+severity: medium
+
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_macs/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_macs/rule.yml
index e5631ce..66d0402 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_macs/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_macs/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,rhel6,rhel7
+prodtype: ol7,openeuler2203,rhel6,rhel7
 
 title: 'Use Only Strong MACs'
 
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/oval/shared.xml
new file mode 100644
index 0000000..3c13a96
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/oval/shared.xml
@@ -0,0 +1 @@
+{{{ oval_sshd_config(parameter="PubkeyAcceptedKeyTypes", value="((ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512),?)+") }}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/rule.yml
new file mode 100644
index 0000000..cdc3061
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/rule.yml
@@ -0,0 +1,13 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Use Only Strong Algorithms For Public Key'
+
+description: |-
+    Limit the algorithm of public key to strong algorithms.
+
+rationale: |-
+    Week algorithms will introduce risks.
+
+severity: medium
diff --git a/linux_os/guide/services/ssh/sshd_strong_kex.var b/linux_os/guide/services/ssh/sshd_strong_kex.var
new file mode 100644
index 0000000..36b03ba
--- /dev/null
+++ b/linux_os/guide/services/ssh/sshd_strong_kex.var
@@ -0,0 +1,19 @@
+documentation_complete: true
+
+title: 'SSH Strong KEX by FIPS'
+
+description: "Specify the FIPS approved KEXs (Key Exchange Algorithms) algorithms\n\tthat are used for methods in cryptography by which cryptographic keys are exchanged between two parties"
+
+type: string
+
+operator: equals
+
+interactive: false
+
+options:
+    default: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+    cis_rhel7: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+    cis_sle12: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+    cis_sle15: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+    cis_ubuntu2004: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
+    standard_openeuler2203: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/oval/shared.xml
index 28eecc8..5165c15 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/oval/shared.xml
@@ -8,6 +8,7 @@
         <platform>multi_platform_fedora</platform>
         <platform>multi_platform_rhv</platform>
         <platform>multi_platform_ol</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The passwords to remember should be set correctly.</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
index 579ffc0..1d926b7 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Limit Password Reuse'
 
@@ -20,6 +20,11 @@ description: |-
     </li>
     </ul>
     The DoD STIG requirement is 5 passwords.
+    {{% if product in ["openeuler2203"] %}}
+    Considering the usability of the community release of openEuler in different scenarios, 
+    the openEuler release does not disable historical passwords by default. 
+    Please configure historical passwords based on the site requirements.
+    {{% endif %}}
 
 rationale: 'Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml
index db91fa9..0139186 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml
@@ -129,8 +129,12 @@
   <ind:textfilecontent54_object id="object_accounts_passwords_pam_faillock_preauth_silent_system-auth" version="1">
     <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
-         pam_unix.so module in auth section -->
+    pam_unix.so module in auth section -->
+    {{% if product in ["openeuler2203"] %}}
+    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*audit[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% else %}}
     <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% endif %}}
     <!-- Check only the first instance -->
     <ind:instance datatype="int" operation="equals">1</ind:instance>
   </ind:textfilecontent54_object>
@@ -178,8 +182,12 @@
   <ind:textfilecontent54_object id="object_accounts_passwords_pam_faillock_preauth_silent_password-auth" version="1">
     <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
-         pam_unix.so module in auth section -->
+    pam_unix.so module in auth section -->
+    {{% if product in ["openeuler2203"] %}}
+    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*audit[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% else %}}
     <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% endif %}}
     <!-- Check only the first instance -->
     <ind:instance datatype="int" operation="equals">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml
index 5575bd3..a06d04e 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Set Deny For Failed Password Attempts'
 
@@ -17,6 +17,12 @@ description: |-
     <li> add the following line immediately <tt>before</tt> the <tt>pam_unix.so</tt> statement in the <tt>ACCOUNT</tt> section:
     <pre>account required pam_faillock.so</pre></li>
     </ul>
+    {{% if product in ["openeuler2203"] %}}
+    Considering the usability of the community release of openEuler in different scenarios, 
+    the openEuler release does not provide this security function by default. 
+    Please configure the default number of failures and lockout duration based on 
+    the actual application scenario and requirements.
+    {{% endif %}}
 
 rationale: |-
     Locking out user accounts after a number of incorrect attempts
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/shared.xml
index 402feab..da09d06 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/shared.xml
@@ -9,6 +9,7 @@
         <platform>multi_platform_fedora</platform>
         <platform>multi_platform_rhv</platform>
         <platform>multi_platform_ol</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The root account should be configured to deny access after the number of defined
       failed attempts has been reached.</description>
@@ -37,8 +38,12 @@
     <ind:behaviors singleline="true" />
     <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
-         pam_unix.so module in auth section -->
+    pam_unix.so module in auth section -->
+    {{% if product in ["openeuler2203"] %}}
+    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+audit[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% else %}}
     <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% endif %}}
     <!-- Check only the first instance -->
     <ind:instance datatype="int" operation="equals">1</ind:instance>
   </ind:textfilecontent54_object>
@@ -72,8 +77,12 @@
     <ind:behaviors singleline="true" />
     <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
     <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
-         pam_unix.so module in auth section -->
+    pam_unix.so module in auth section -->
+    {{% if product in ["openeuler2203"] %}}
+    <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+audit[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% else %}}
     <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
+    {{% endif %}}
     <!-- Check only the first instance -->
     <ind:instance datatype="int" operation="equals">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml
index 03329a6..6615efa 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Configure the root Account for Failed Password Attempts'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml
index ad3e2f1..057aca8 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml
@@ -7,6 +7,7 @@
         <platform>multi_platform_fedora</platform>
         <platform>multi_platform_rhv</platform>
         <platform>multi_platform_ol</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The number of allowed failed logins should be set correctly.</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
index e4403bb..dccf1b7 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel6,rhel7,rhel8,rhv4
+prodtype: fedora,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4
 
 title: 'Set Lockout Time for Failed Password Attempts'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_accounts_passwords_pam_faillock_unlock_time.var b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_accounts_passwords_pam_faillock_unlock_time.var
index 46c73e4..206b03e 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_accounts_passwords_pam_faillock_unlock_time.var
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_accounts_passwords_pam_faillock_unlock_time.var
@@ -17,5 +17,6 @@ options:
     604800: 604800
     86400: 86400
     900: 900
+    300: 300
     default: 0
     never: 0
diff --git a/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/oval/shared.xml
new file mode 100644
index 0000000..af4a11e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/oval/shared.xml
@@ -0,0 +1,32 @@
+<def-group>
+  <definition class="compliance" id="no_name_contained_in_password" version="1">
+    <metadata>
+      <title>Accounts password should not be contained substring of name</title>
+      {{{- oval_affected(products) }}}
+      <description>Accounts password should not be contained substring of name.</description>
+    </metadata>
+    <criteria operator="AND" comment="Check that there is no usercheck=0 in pam files">
+      <criterion comment="Check /etc/pam.d/password-auth" test_ref="test_password_auth_no_name_in_password" />
+      <criterion comment="Check /etc/pam.d/system-auth" test_ref="test_system_no_name_in_password" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test that there is no substring in password" id="test_password_auth_no_name_in_password" version="1">
+    <ind:object object_ref="object_test_password_auth_no_name_in_password" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test that there is no substring in password" id="test_system_no_name_in_password" version="1">
+    <ind:object object_ref="object_test_system_no_name_in_password" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_test_password_auth_no_name_in_password" version="1">
+    <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^.*usercheck[\s]*=[\s]*0.*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="object_test_system_no_name_in_password" version="1">
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^.*usercheck[\s]*=[\s]*0.*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/rule.yml b/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/rule.yml
new file mode 100644
index 0000000..fa84a3b
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/rule.yml
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Accounts Name Should Not Be Contained In Password'
+
+description: |-
+    Accounts name should not be contained in password.
+    There is no usercheck=0.
+
+rationale: |-
+    If the passowrd contains substring of accounts name, it is a risk.
+
+severity: high
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml
index 86ec1e6..629a797 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Minimum Digit Characters'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/oval/shared.xml
new file mode 100644
index 0000000..13bbae4
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/oval/shared.xml
@@ -0,0 +1,27 @@
+<def-group>
+  <definition class="compliance" id="accounts_password_pam_dictcheck" version="3">
+    {{{ oval_metadata("Check dictcheck in pwquality") }}}
+    <criteria comment="conditions for dictcheck are satisfied">
+      <criterion comment="pwquality.conf" test_ref="test_password_pam_pwquality_dictcheck" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" state_operator="AND"
+    comment="check the configuration of /etc/security/pwquality.conf"
+    id="test_password_pam_pwquality_dictcheck" version="3">
+    <ind:object object_ref="obj_password_pam_pwquality_dictcheck" />
+    <ind:state state_ref="state_password_pam_dictcheck" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_password_pam_pwquality_dictcheck" version="3">
+    <ind:filepath operation="pattern match">{{{ filepath_regex }}}</ind:filepath>
+    <ind:pattern operation="pattern match">^\s*dictcheck[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_password_pam_dictcheck" version="3">
+    <ind:subexpression datatype="int" operation="equals" var_ref="var_password_pam_dictcheck" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="External variable for pam_dictcheck" datatype="int" id="var_password_pam_dictcheck" version="3" />
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
new file mode 100644
index 0000000..1dc59f5
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
+
+description: |-
+    The pam_pwquality module's <tt>dictcheck</tt> check if passwords contains dictionary words. When
+    <tt>dictcheck</tt> is set to <tt>1</tt> passwords will be checked for dictionary words.
+    {{% if product in ["openeuler2203"] %}}
+    Considering the usability of the community release of openEuler in different scenarios, 
+    the weak password dictionary check is not configured for the openEuler release by default. 
+    Please configure the weak password dictionary check based on the site requirements.
+    {{% endif %}}
+
+rationale: |-
+    Use of a complex password helps to increase the time and resources required to compromise the password.
+    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
+    guessing and brute-force attacks.
+    <br /><br />
+    Password complexity is one factor of several that determines how long it takes to crack a password. The more
+    complex the password, the greater the number of possible combinations that need to be tested before the
+    password is compromised.
+    <br /><br />
+    Passwords with dictionary words may be more vulnerable to password-guessing attacks.
+
+severity: medium
+
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml
index 159a832..4e63274 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml
index 5c596d0..866fa5f 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Minimum Different Categories'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml
index 7db443b..3b65cb6 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Minimum Length'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml
index bdef268..0597fe9 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Minimum Special Characters'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/oval/shared.xml
index d888d78..4588489 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/oval/shared.xml
@@ -8,6 +8,7 @@
         <platform>multi_platform_ol</platform>
         <platform>multi_platform_rhel</platform>
         <platform>multi_platform_wrlinux</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The password retry should meet minimum requirements</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
index 099cbbf..50853ed 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session'
 
@@ -10,6 +10,11 @@ description: |-
     show <tt>retry=<sub idref="var_password_pam_retry" /></tt>, or a lower value if
     site policy is more restrictive.
     The DoD requirement is a maximum of 3 prompts per session.
+    {{% if product in ["openeuler2203"] %}}
+    Considering the usability of the community release of openEuler in different scenarios, 
+    the values of retry are not configured in the openEuler release by default. 
+    Please set it based on the site requirements.
+    {{% endif %}}
 
 rationale: |-
     Setting the password retry prompts that are permitted on a per-session basis to a low value
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml
index 7b5fe67..203da95 100644
--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters'
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
new file mode 100644
index 0000000..26452c3
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+title: dictcheck
+
+description: |-
+    Prevent the use of dictionary words for passwords.
+
+type: number
+
+operator: equals
+
+interactive: false
+
+options:
+    1: 1
+    default: 1
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
index 3770a64..4cb9dc0 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml
@@ -8,6 +8,7 @@
         <platform>multi_platform_fedora</platform>
         <platform>multi_platform_rhv</platform>
         <platform>multi_platform_ol</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
index 1c4032c..9bd46d6 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: "Set PAM's Password Hashing Algorithm"
 
diff --git a/linux_os/guide/system/accounts/accounts-pam/verify_owner_password/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/verify_owner_password/oval/shared.xml
new file mode 100644
index 0000000..bfd0b01
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/verify_owner_password/oval/shared.xml
@@ -0,0 +1,60 @@
+<def-group>
+  <definition class="compliance" id="verify_owner_password" version="1">
+    <metadata>
+      <title>Accounts password should be verified during modifying</title>
+      {{{- oval_affected(products) }}}
+      <description>Accounts password should be verified during modifying.</description>
+    </metadata>
+    <criteria operator="AND" comment="Check that there is pam_unix.so in pam files">
+      <criteria operator="AND" comment="Check /etc/pam.d/password-auth">
+        <criterion comment="Check pam_unix.so" test_ref="test_password_auth_unix" />
+        <criterion comment="Check pam_deny.so" test_ref="test_password_auth_deny" />
+      </criteria>
+      <criteria operator="AND" comment="Check /etc/pam.d/system-auth">
+        <criterion comment="Check pam_unix.so" test_ref="test_system_auth_unix" />
+        <criterion comment="Check pam_deny.so" test_ref="test_system_auth_deny" />
+      </criteria>
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test that there is pam_unix.so in pam files" id="test_password_auth_unix" version="1">
+    <ind:object object_ref="object_test_password_auth_unix" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test that there is pam_unix.so in pam files" id="test_password_auth_deny" version="1">
+    <ind:object object_ref="object_test_password_auth_deny" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test that there is pam_unix.so in pam files" id="test_system_auth_unix" version="1">
+    <ind:object object_ref="object_test_system_auth_unix" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test that there is pam_unix.so in pam files" id="test_system_auth_deny" version="1">
+    <ind:object object_ref="object_test_system_auth_deny" />
+  </ind:textfilecontent54_test>
+
+
+  <ind:textfilecontent54_object id="object_test_password_auth_unix" version="1">
+    <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^password[\s]+sufficient[\s]+pam_unix\.so.*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="object_test_password_auth_deny" version="1">
+    <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^password[\s]+required[\s]+pam_deny\.so.*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="object_test_system_auth_unix" version="1">
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^password[\s]+sufficient[\s]+pam_unix\.so.*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="object_test_system_auth_deny" version="1">
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^password[\s]+required[\s]+pam_deny\.so.*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-pam/verify_owner_password/rule.yml b/linux_os/guide/system/accounts/accounts-pam/verify_owner_password/rule.yml
new file mode 100644
index 0000000..b03948a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/verify_owner_password/rule.yml
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Accounts Password Should Be Verified When Changing'
+
+description: |-
+    Accounts password should be verified when it is modifying.
+    It is done by pam_unix.so.
+
+rationale: |-
+    Anyone can change the password if no verifying.
+
+severity: high
diff --git a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml
index 827129d..9dd6b89 100644
--- a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml
@@ -11,8 +11,12 @@
       <criterion comment="Conditions are satisfied"
       test_ref="test_require_rescue_service" />
       <criterion test_ref="test_require_rescue_service_runlevel1" />
+      {{%- if product in ["openeuler2203"] -%}}
+      <criterion test_ref="test_require_emergency_service" />
+      {{%- else -%}}
       <criterion test_ref="test_no_custom_runlevel1_target" negate="true"/>
       <criterion test_ref="test_no_custom_rescue_service" negate="true"/>
+      {{%- endif -%}}
     </criteria>
     {{%- else -%}}
     <criteria>
@@ -24,7 +28,7 @@
   {{%- if init_system == "systemd" -%}}
   <ind:textfilecontent54_test check="all" check_existence="all_exist"
     comment="Tests that
-    {{% if product in ["fedora", "rhel8"] -%}}
+    {{% if product in ["fedora", "rhel8", "openeuler2203"] -%}}
     /usr/lib/systemd/systemd-sulogin-shell
     {{%- else -%}}
     /sbin/sulogin
@@ -36,7 +40,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_require_rescue_service" version="1">
     <ind:filepath>/usr/lib/systemd/system/rescue.service</ind:filepath>
-    {{%- if product in ["fedora", "rhel8"] -%}}
+    {{%- if product in ["fedora", "rhel8", "openeuler2203"] -%}}
     <ind:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind:pattern>
     {{%- else -%}}
     <ind:pattern operation="pattern match">^ExecStart=\-/bin/sh[\s]+-c[\s]+\"(/usr)?/sbin/sulogin;[\s]+/usr/bin/systemctl[\s]+--fail[\s]+--no-block[\s]+default\"</ind:pattern>
@@ -90,4 +94,17 @@
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   {{%- endif -%}}
+
+  {{%- if product in ["openeuler2203"] -%}}
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
+    comment="Tests that the systemd-sulogin-shell is in the emergency.service"
+    id="test_require_emergency_service" version="1">
+    <ind:object object_ref="obj_require_emergency_service" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_require_emergency_service" version="1">
+    <ind:filepath>/usr/lib/systemd/system/emergency.service</ind:filepath>
+    <ind:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+emergency</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+  {{%- endif -%}}
 </def-group>
diff --git a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml
index c81e8cc..568163e 100644
--- a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ocp4,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Require Authentication for Single User Mode'
 
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/oval/shared.xml
new file mode 100644
index 0000000..8d31f9a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/oval/shared.xml
@@ -0,0 +1,51 @@
+<def-group>
+  <definition class="compliance" id="account_unique_group_id" version="1">
+    {{{ oval_metadata("All accounts on the system should have unique master group IDs for proper accountability.") }}}
+      <criteria comment="There should not exist duplicate user master group IDs entries in /etc/passwd">
+        <criterion test_ref="test_etc_passwd_no_duplicate_user_group_ids" />
+      </criteria>
+
+  </definition>
+
+  <!-- collect information about all users -->
+  <unix:password_object id="obj_all_user_group_ids" version="1">
+    <unix:username operation="pattern match">^(?!sync|shutdown|halt|operator).*</unix:username>
+  </unix:password_object>
+
+  <!-- variable storing count of all uids - including duplicates -->
+  <local_variable id="variable_count_of_all_user_group_ids" datatype="int" version="1"
+  comment="Count of all group ids (including duplicates if any)">
+    <count>
+      <object_component item_field="group_id" object_ref="obj_all_user_group_ids" />
+    </count>
+  </local_variable>
+
+  <!-- Turn the OVAL variable representing count of user ids into OVAL object
+       (for use in <variable_test> below)-->
+  <ind:variable_object id="obj_count_of_all_user_group_ids" version="1">
+    <ind:var_ref>variable_count_of_all_user_group_ids</ind:var_ref>
+  </ind:variable_object>
+
+  <!-- OVAL variable to hold the count of unique user ids defined in /etc/passwd -->
+  <local_variable id="variable_count_of_unique_user_group_ids" datatype="int" version="1"
+  comment="Count of unique group ids">
+    <count>
+      <unique>
+        <object_component item_field="group_id" object_ref="obj_all_user_group_ids" />
+      </unique>
+    </count>
+  </local_variable>
+
+  <!-- this state checks that both counts (unique and non-unique) are the same -->
+  <ind:variable_state id="state_no_duplicate_user_group_ids" version="1">
+    <ind:value var_ref="variable_count_of_unique_user_group_ids" datatype="int"
+    operation="equals" var_check="at least one" />
+  </ind:variable_state>
+
+  <ind:variable_test id="test_etc_passwd_no_duplicate_user_group_ids" check="all" check_existence="all_exist"
+  comment="There should not exist duplicate user group ids in /etc/passwd" version="1">
+    <ind:object object_ref="obj_count_of_all_user_group_ids" />
+    <ind:state state_ref="state_no_duplicate_user_group_ids" />
+  </ind:variable_test>
+
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/rule.yml
new file mode 100644
index 0000000..01b1ea9
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_group_id/rule.yml
@@ -0,0 +1,11 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Accounts on the System Have Unique Master Group IDs'
+
+description: 'Change user master group IDs, or delete accounts.'
+
+rationale: 'To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.'
+
+severity: medium
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
new file mode 100644
index 0000000..491ad45
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/oval/shared.xml
@@ -0,0 +1,51 @@
+<def-group>
+  <definition class="compliance" id="account_unique_id" version="1">
+    {{{ oval_metadata("All accounts on the system should have unique IDs for proper accountability.") }}}
+      <criteria comment="There should not exist duplicate user IDs entries in /etc/passwd">
+        <criterion test_ref="test_etc_passwd_no_duplicate_user_ids" />
+      </criteria>
+
+  </definition>
+
+  <!-- collect information about all users -->
+  <unix:password_object id="obj_all_uids" version="1">
+    <unix:username operation="pattern match">.*</unix:username>
+  </unix:password_object>
+
+  <!-- variable storing count of all uids - including duplicates -->
+  <local_variable id="variable_count_of_all_uids" datatype="int" version="1"
+  comment="Count of all uids (including duplicates if any)">
+    <count>
+      <object_component item_field="user_id" object_ref="obj_all_uids" />
+    </count>
+  </local_variable>
+
+  <!-- Turn the OVAL variable representing count of user ids into OVAL object
+       (for use in <variable_test> below)-->
+  <ind:variable_object id="obj_count_of_all_uids" version="1">
+    <ind:var_ref>variable_count_of_all_uids</ind:var_ref>
+  </ind:variable_object>
+
+  <!-- OVAL variable to hold the count of unique user ids defined in /etc/passwd -->
+  <local_variable id="variable_count_of_unique_uids" datatype="int" version="1"
+  comment="Count of unique uids">
+    <count>
+      <unique>
+        <object_component item_field="user_id" object_ref="obj_all_uids" />
+      </unique>
+    </count>
+  </local_variable>
+
+  <!-- this state checks that both counts (unique and non-unique) are the same -->
+  <ind:variable_state id="state_no_duplicate_uids" version="1">
+    <ind:value var_ref="variable_count_of_unique_uids" datatype="int"
+    operation="equals" var_check="at least one" />
+  </ind:variable_state>
+
+  <ind:variable_test id="test_etc_passwd_no_duplicate_user_ids" check="all" check_existence="all_exist"
+  comment="There should not exist duplicate user ids in /etc/passwd" version="1">
+    <ind:object object_ref="obj_count_of_all_uids" />
+    <ind:state state_ref="state_no_duplicate_uids" />
+  </ind:variable_test>
+
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/policy/stig/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/policy/stig/shared.yml
new file mode 100644
index 0000000..cfe5f91
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/policy/stig/shared.yml
@@ -0,0 +1,15 @@
+srg_requirement: |-
+    {{{ full_name }}} duplicate User IDs (UIDs) must not exist for interactive users.
+
+vuldiscussion: |-
+    To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.
+
+checktext: |-
+    Verify that {{{ full_name }}} contains no duplicate User IDs (UIDs) for interactive users with the following command:
+
+    $ sudo awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd
+
+    If output is produced and the accounts listed are interactive user accounts, this is a finding.
+
+fixtext: |-
+    Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate User ID (UID) with a unique UID.
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
new file mode 100644
index 0000000..687a0c3
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml
@@ -0,0 +1,11 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Accounts on the System Have Unique User IDs'
+
+description: 'Change user IDs (UIDs), or delete accounts, so each has a unique id.'
+
+rationale: 'To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.'
+
+severity: medium
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
new file mode 100644
index 0000000..645c46e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/correct_value.pass.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+# remediation = none
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
new file mode 100644
index 0000000..cc7f221
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/tests/wrong_value.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# remediation = none
+
+echo "test_user:x:30090:30090:Test User:/home/test_user:/usr/bin/bash" >> /etc/passwd
+echo "test_user_2:x:30090:30090:Test User 2:/home/test_user_2:/usr/bin/bash" >> /etc/passwd
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/oval/shared.xml
new file mode 100644
index 0000000..e2047d9
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/oval/shared.xml
@@ -0,0 +1,25 @@
+<def-group>
+  <definition class="compliance" id="accounts_are_necessary" version="1">
+    <metadata>
+      <title>All Accounts are Necessary</title>
+      <affected family="unix">
+        <platform>openEuler 22.03LTS</platform>
+      </affected>
+      <description>All Accounts are Necessary</description>
+    </metadata>
+    <criteria>
+      <criterion comment="Check /etc/passwd all accounts are necessary" test_ref="accounts_are_necessary_test" />
+    </criteria>
+  </definition>
+
+  <unix:password_object id="accounts_are_necessary_object" version="1">
+    <unix:username datatype="string" operation="pattern match">.*</unix:username>
+  </unix:password_object>
+  
+  <unix:password_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
+  check="all" check_existence="none_exist" comment="List all accounts on the system"
+  id="accounts_are_necessary_test" version="1">
+    <unix:object object_ref="accounts_are_necessary_object" />
+  </unix:password_test>
+</def-group>
+  
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/rule.yml
new file mode 100644
index 0000000..143fe8a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_are_necessary/rule.yml
@@ -0,0 +1,20 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'All Accounts Are Necessary'
+
+description: |-
+    <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+    <p>If any account is not necessary, it should be removed from <tt>/etc/passwd</tt>.</p>
+    <ul>
+    <li>Use below cli command to list all accounts in system:
+    <pre># cat /etc/passwd | awk  -F ":" '{print $1}'</pre>
+    </li>
+    </ul>
+
+rationale: |-
+    It is a risk if an account exists in system but it is not necessary.
+
+severity: medium
+
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/oval/shared.xml
new file mode 100644
index 0000000..b3425ec
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/oval/shared.xml
@@ -0,0 +1,50 @@
+<def-group>
+    <definition class="compliance" id="{{{rule_id}}}" version="1">
+        {{{ oval_metadata("All groups on the system should have unique names for proper accountability.") }}}
+        <criteria comment="There should not exist duplicate group ids entries in /etc/passwd">
+            <criterion test_ref="test_etc_group_no_duplicate_group_ids"/>
+        </criteria>
+    </definition>
+
+    <ind:textfilecontent54_object id="obj_all_group_ids" version="1" comment="Get all group ids">
+        <ind:filepath>/etc/group</ind:filepath>
+        <ind:pattern operation="pattern match">^.+:.+:(\d+):.*$</ind:pattern>
+        <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+    </ind:textfilecontent54_object>
+
+    <!-- variable storing count of all group ids - including duplicates -->
+    <local_variable id="variable_count_of_all_group_ids" datatype="int" version="1"
+                    comment="Count of all group ids (including duplicates if any)">
+        <count>
+            <object_component item_field="subexpression" object_ref="obj_all_group_ids"/>
+        </count>
+    </local_variable>
+
+    <!-- OVAL variable to hold the count of unique group ids defined in /etc/group -->
+    <local_variable id="variable_count_of_unique_group_ids" datatype="int" version="1"
+                    comment="Count of unique group ids">
+        <count>
+            <unique>
+                <object_component item_field="subexpression" object_ref="obj_all_group_ids"/>
+            </unique>
+        </count>
+    </local_variable>
+
+    <!-- Turn the OVAL variable representing count of user ids into OVAL object
+       (for use in <variable_test> below)-->
+    <ind:variable_object id="obj_count_of_all_group_ids" version="1">
+        <ind:var_ref>variable_count_of_all_group_ids</ind:var_ref>
+    </ind:variable_object>
+
+    <!-- this state checks that both counts (unique and non-unique) are the same -->
+    <ind:variable_state id="state_no_duplicate_group_ids" version="1">
+        <ind:value var_ref="variable_count_of_unique_group_ids" datatype="int"
+                   operation="equals" var_check="at least one"/>
+    </ind:variable_state>
+
+    <ind:variable_test id="test_etc_group_no_duplicate_group_ids" check="all" check_existence="all_exist"
+                       comment="There should not exist duplicate group ids in /etc/passwd" version="1">
+        <ind:object object_ref="obj_count_of_all_group_ids"/>
+        <ind:state state_ref="state_no_duplicate_group_ids"/>
+    </ind:variable_test>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/policy/stig/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/policy/stig/shared.yml
new file mode 100644
index 0000000..6944a01
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/policy/stig/shared.yml
@@ -0,0 +1,15 @@
+srg_requirement: |-
+    {{{ full_name }}} groups must have unique Group ID (GID).
+
+vuldiscussion: |-
+    To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.
+
+checktext: |-
+    Verify that {{{ full_name }}} contains no duplicate Group IDs (GID) for interactive users with the following command:
+
+     $  cut -d : -f 3 /etc/group | uniq -d
+
+    If the system has duplicate group ids, this is a finding.
+
+fixtext: |-
+    Edit the file "/etc/group" and provide each group that has a duplicate Group ID (GID) with a unique GID.
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/rule.yml
new file mode 100644
index 0000000..66925eb
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/rule.yml
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Groups on the System Have Unique Group ID'
+
+description: 'Change the group name or delete groups, so each has a unique id.'
+
+rationale: 'To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.'
+
+severity: medium
+
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/correct_value.pass.sh
new file mode 100644
index 0000000..031b46c
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/correct_value.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# remediation = no
+
+groupadd cac_test$(date +%s)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/wrong_value.fail.sh
new file mode 100644
index 0000000..d8d9f7e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_id/tests/wrong_value.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# remediation = no
+
+echo "testgroup1:x:1004:" >> /etc/group
+echo "testgroup:x:1004:" >> /etc/group
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/oval/shared.xml
new file mode 100644
index 0000000..a1d46bb
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/oval/shared.xml
@@ -0,0 +1,50 @@
+<def-group>
+    <definition class="compliance" id="{{{rule_id}}}" version="1">
+        {{{ oval_metadata("All groups on the system should have unique names for proper accountability.") }}}
+        <criteria comment="There should not exist duplicate group names entries in /etc/passwd">
+            <criterion test_ref="test_etc_group_no_duplicate_group_names"/>
+        </criteria>
+    </definition>
+
+    <ind:textfilecontent54_object id="obj_all_group_names" version="1" comment="Get all group names">
+        <ind:filepath>/etc/group</ind:filepath>
+        <ind:pattern operation="pattern match">^(.+):.+</ind:pattern>
+        <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+    </ind:textfilecontent54_object>
+
+    <!-- variable storing count of all group names - including duplicates -->
+    <local_variable id="variable_count_of_all_group_names" datatype="int" version="1"
+                    comment="Count of all group names (including duplicates if any)">
+        <count>
+            <object_component item_field="subexpression" object_ref="obj_all_group_names"/>
+        </count>
+    </local_variable>
+
+    <!-- OVAL variable to hold the count of unique group names defined in /etc/group -->
+    <local_variable id="variable_count_of_unique_group_names" datatype="int" version="1"
+                    comment="Count of unique group names">
+        <count>
+            <unique>
+                <object_component item_field="subexpression" object_ref="obj_all_group_names"/>
+            </unique>
+        </count>
+    </local_variable>
+
+    <!-- Turn the OVAL variable representing count of user ids into OVAL object
+       (for use in <variable_test> below)-->
+    <ind:variable_object id="obj_count_of_all_group_names" version="1">
+        <ind:var_ref>variable_count_of_all_group_names</ind:var_ref>
+    </ind:variable_object>
+
+    <!-- this state checks that both counts (unique and non-unique) are the same -->
+    <ind:variable_state id="state_no_duplicate_group_names" version="1">
+        <ind:value var_ref="variable_count_of_unique_group_names" datatype="int"
+                   operation="equals" var_check="at least one"/>
+    </ind:variable_state>
+
+    <ind:variable_test id="test_etc_group_no_duplicate_group_names" check="all" check_existence="all_exist"
+                       comment="There should not exist duplicate group names in /etc/passwd" version="1">
+        <ind:object object_ref="obj_count_of_all_group_names"/>
+        <ind:state state_ref="state_no_duplicate_group_names"/>
+    </ind:variable_test>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/rule.yml
new file mode 100644
index 0000000..d3bc722
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/rule.yml
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Groups on the System Have Unique Group Names'
+
+description: 'Change the group name or delete groups, so each has a unique name.'
+
+rationale: 'To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.'
+
+severity: medium
+
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/correct_value.pass.sh
new file mode 100644
index 0000000..031b46c
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/correct_value.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# remediation = no
+
+groupadd cac_test$(date +%s)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/wrong_value.fail.sh
new file mode 100644
index 0000000..e375c55
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/group_unique_name/tests/wrong_value.fail.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# remediation = no
+
+echo "testgroup:x:1004:" >> /etc/group
+echo "testgroup:x:1005:" >> /etc/group
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/oval/shared.xml
new file mode 100644
index 0000000..ac39f98
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/oval/shared.xml
@@ -0,0 +1,30 @@
+<def-group>
+  <definition class="compliance" id="login_accounts_are_necessary" version="1">
+    <metadata>
+      <title>All Login Accounts are Necessary</title>
+      <affected family="unix">
+        <platform>openEuler 22.03LTS</platform>
+      </affected>
+      <description>All Login Accounts are Necessary</description>
+    </metadata>
+    <criteria>
+      <criterion comment="Check /etc/passwd all login accounts are necessary" test_ref="login_accounts_are_necessary_test" />
+    </criteria>
+  </definition>
+
+  <unix:password_state id="login_accounts_are_necessary_state" version="1">
+    <unix:login_shell operation="pattern match">.*nologin.*</unix:login_shell>
+  </unix:password_state>
+
+  <unix:password_object id="login_accounts_are_necessary_object" version="1">
+    <unix:username datatype="string" operation="pattern match">.*</unix:username>
+    <filter action="exclude">login_accounts_are_necessary_state</filter>
+  </unix:password_object>
+  
+  <unix:password_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
+  check="all" check_existence="none_exist" comment="List all login accounts on the system"
+  id="login_accounts_are_necessary_test" version="1">
+    <unix:object object_ref="login_accounts_are_necessary_object" />
+  </unix:password_test>
+</def-group>
+  
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/rule.yml
new file mode 100644
index 0000000..7fd34bc
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-restrictions/login_accounts_are_necessary/rule.yml
@@ -0,0 +1,31 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'All Login Accounts Are Necessary'
+
+description: |-
+    <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+    If any account need not login, it should be removed from <tt>/etc/passwd</tt>
+    or it should be marked by <tt>"nologin"</tt>.
+    <p>It can be checked as below cli commands:</p>
+    <ul>
+    <li>List all nologin accounts, then check it manually:
+    <pre># cat /etc/passwd | grep "\/sbin\/nologin\|\/bin\/false" | awk -F ":" '{print $1}'</pre>
+    </li>
+    <li>List all login accounts, then check it manually:
+    <pre># cat /etc/passwd | grep -v "\/sbin\/nologin\|\/bin\/false" | awk -F ":" '{print $1}'</pre>
+    </li>
+    <li>List all accounts which the password are locked:
+    <pre># cat /etc/passwd | awk -F ":" '{print $1}' | xargs -I '{}' passwd -S '{}' | awk '($2=="L" || $2=="LK") {print $1}'</pre>
+    </li>
+    <li>List all accounts which the password are not locked:
+    <pre># cat /etc/passwd | awk -F ":" '{print $1}' | xargs -I '{}' passwd -S '{}' | awk '($2!="L" &amp;&amp; $2!="LK") {print $1}'</pre>
+    </li>
+    </ul>
+
+rationale: |-
+    It is a risk if an account can login system but it is not necessary.
+
+severity: medium
+
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml
index d41a0eb..738fb8b 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml
@@ -10,6 +10,11 @@ description: |-
     A value of 180 days is sufficient for many environments.
     The DoD requirement is 60.
     The profile requirement is <tt><sub idref="var_accounts_maximum_age_login_defs" /></tt>.
+    {{% if product in ["openeuler2203"] %}}
+    Considering the usability of the community release of openEuler in different scenarios,
+    the password expiration time is not configured in the openEuler release by default.
+    Please set the password expiration time based on the site requirements.
+    {{% endif %}}
 
 rationale: |-
     Any password, no matter how complex, can eventually be cracked. Therefore, passwords
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/oval/shared.xml
index 34d605b..781cd3f 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/oval/shared.xml
@@ -7,7 +7,8 @@
         <platform>multi_platform_fedora</platform>
         <platform>multi_platform_ol</platform>
         <platform>multi_platform_rhel</platform>
-        <platform>multi_platform_wrlinux</platform>
+	<platform>multi_platform_wrlinux</platform>
+	<platform>multi_platform_openeuler</platform>
       </affected>
       <description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/oval/shared.xml
index c68effb..bcb50bd 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/oval/shared.xml
@@ -8,6 +8,7 @@
         <platform>multi_platform_ol</platform>
         <platform>multi_platform_rhel</platform>
         <platform>multi_platform_wrlinux</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>Checks interactive shell timeout</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
index cdfa67d..437abe6 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Set Interactive Session Timeout'
 
@@ -9,6 +9,11 @@ description: |-
     all user sessions will terminate based on inactivity. The <tt>TMOUT</tt>
     setting in <tt>/etc/profile</tt> should read as follows:
     <pre>TMOUT=<sub idref="var_accounts_tmout" /></pre>
+    {{% if product in ["openeuler2203"] %}}
+    Considering the usability of the community release of openEuler in different scenarios, 
+    the session timeout interval is not configured by default in the openEuler release. 
+    Please configure the session timeout interval based on the site requirements.
+    {{% endif %}}
 
 rationale: |-
     Terminating an idle session within a short time period reduces
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml
new file mode 100644
index 0000000..56b3396
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/oval/shared.xml
@@ -0,0 +1,83 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("All Interactive Users Home Directories Must Exist") }}}
+    <criteria operator="OR">
+      <criterion test_ref="test_accounts_user_interactive_home_directory_exists"
+                 comment="All Interactive Users Home Directories Must Exist"/>
+      <criterion test_ref="test_accounts_user_interactive_home_directory_exists_users"
+                 comment="Interactive users don't exist on the system"/>
+    </criteria>
+  </definition>
+
+  {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}}
+  {{{ create_interactive_users_list_object(interactive_users_object) }}}
+
+  <!-- #### create a local variable composed by the list of home dirs from /etc/passwd #### -->
+  <local_variable id="var_accounts_user_interactive_home_directory_exists_dirs_list"
+                  datatype="string" version="1"
+                  comment="Variable including all home dirs from interactive users">
+    <object_component item_field="home_dir"
+                      object_ref="{{{ interactive_users_object }}}"/>
+  </local_variable>
+
+  <!-- #### create a local variable composed by the number of home dirs from /etc/passwd #### -->
+  <local_variable id="var_accounts_user_interactive_home_directory_exists_dirs_count"
+                  datatype="int" version="1"
+                  comment="Variable including expected count of home dirs present on the system">
+    <count>
+      <variable_component var_ref="var_accounts_user_interactive_home_directory_exists_dirs_list"/>
+    </count>
+  </local_variable>
+
+  <!-- #### create a file_object to check existence of home dirs on file system #### -->
+  <unix:file_object id="object_accounts_user_interactive_home_directory_exists_dirs_fs"
+                    version="1">
+    <unix:path var_ref="var_accounts_user_interactive_home_directory_exists_dirs_list"
+               var_check="at least one"/>
+    <unix:filename xsi:nil="true"/>
+  </unix:file_object>
+
+  <!-- #### create a local variable with the number of home dirs present on file system #### -->
+  <local_variable id="var_accounts_user_interactive_home_directory_exists_dirs_count_fs"
+                  datatype="int" version="1"
+                  comment="Variable including number of home dirs present on file system">
+    <count>
+      <object_component item_field="path"
+                  object_ref="object_accounts_user_interactive_home_directory_exists_dirs_fs"/>
+    </count>
+  </local_variable>
+
+  <!-- #### create a variable object with count of home dirs from file system #### -->
+  <ind:variable_object id="object_accounts_user_interactive_home_directory_exists_dirs_count_fs"
+                       version="1">
+    <ind:var_ref>var_accounts_user_interactive_home_directory_exists_dirs_count_fs</ind:var_ref>
+  </ind:variable_object>
+
+  <!-- #### create a variable state with count of home dirs from /etc/passwd #### -->
+  <ind:variable_state id="state_accounts_user_interactive_home_directory_exists_dirs_count_pw"
+                      version="1">
+    <ind:value datatype="int" operation="equals" var_check="at least one"
+               var_ref="var_accounts_user_interactive_home_directory_exists_dirs_count"/>
+  </ind:variable_state>
+
+  <!-- #### test_accounts_user_interactive_home_directory_exists #### -->
+  <ind:variable_test id="test_accounts_user_interactive_home_directory_exists" check="all"
+                     check_existence="at_least_one_exists" version="1"
+                     comment="Check the existence of interactive users.">
+    <ind:object object_ref="object_accounts_user_interactive_home_directory_exists_dirs_count_fs"/>
+    <ind:state state_ref="state_accounts_user_interactive_home_directory_exists_dirs_count_pw"/>
+  </ind:variable_test>
+
+  <!-- #### create of variable object with count of home dirs from /etc/passwd #### -->
+  <ind:variable_object id="object_accounts_user_interactive_home_directory_exists_dirs_count_pw"
+                       version="1">
+    <ind:var_ref>var_accounts_user_interactive_home_directory_exists_dirs_count</ind:var_ref>
+  </ind:variable_object>
+
+  <!-- #### test_accounts_user_interactive_home_directory_exists_users #### -->
+  <ind:variable_test id="test_accounts_user_interactive_home_directory_exists_users" check="all"
+                     check_existence="none_exist" version="1"
+                     comment="Check the existence of interactive users.">
+    <ind:object object_ref="object_accounts_user_interactive_home_directory_exists_dirs_count_pw"/>
+  </ind:variable_test>
+</def-group>
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml
index d51679f..6163f3d 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: rhel7,rhel8,rhv4,wrlinux1019
+prodtype: openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'All Interactive Users Home Directories Must Exist'
 
diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml
index 73e457d..9bbd226 100644
--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml
@@ -6,6 +6,7 @@
         <platform>multi_platform_rhel</platform>
         <platform>multi_platform_wrlinux</platform>
         <platform>multi_platform_ol</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The default umask for users of the bash shell</description>
     </metadata>
diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml
index 9b189bc..a6d933c 100644
--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,ol8,rhel6,rhel7,rhel8
+prodtype: ol7,ol8,openeuler2203,rhel6,rhel7,rhel8
 
 title: 'Ensure the Default Bash Umask is Set Correctly'
 
@@ -9,6 +9,13 @@ description: |-
     add or correct the <tt>umask</tt> setting in <tt>/etc/bashrc</tt> to read
     as follows:
     <pre>umask <sub idref="var_accounts_user_umask" /></pre>
+    {{% if product in ["openeuler2203"] %}}
+    After UMASK is set to 077, the default permission on the created file is 600, 
+    and the default permission on the directory is 700. 
+    Considering the usability of the community release of openEuler in different scenarios, 
+    the openEuler release does not configure the UMASK by default. 
+    Please configure the UMASK based on the site requirements.
+    {{% endif %}}
 
 rationale: |-
     The umask value influences the permissions assigned to files when they are created.
diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml
index 7e6b11a..6271928 100644
--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure the Default Umask is Set Correctly For Interactive Users'
 
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/oval/shared.xml
new file mode 100644
index 0000000..40d201e
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="grub2_nosmap_argument_absent" version="1">
+    {{{ oval_metadata("SMAP should not be set.") }}}
+      <criteria comment="SMAP not set">
+        <criterion test_ref="test_grub2_nosmap_argument_absent" />
+      </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="No SMAP" id="test_grub2_nosmap_argument_absent" version="1">
+    <ind:object object_ref="obj_grub2_nosmap_argument_absent" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_grub2_nosmap_argument_absent" version="1">
+    <ind:filepath>/proc/cmdline</ind:filepath>
+    <ind:pattern operation="pattern match">^.*nosmap.*$</ind:pattern>
+    <ind:instance datatype="int" operation="equals">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+
+</def-group>
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/rule.yml
new file mode 100644
index 0000000..51dab28
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/grub2_nosmap_argument_absent/rule.yml
@@ -0,0 +1,25 @@
+documentation_complete: true
+
+title: 'Ensure SMAP is not disabled during boot'
+
+description: |-
+    The SMAP is used to prevent the supervisor mode from unintentionally reading/writing into
+    memory pages in the user space, it is enabled by default since Linux kernel 3.7.
+    But it could be disabled through kernel boot parameters.
+
+    Ensure that Supervisor Mode Access Prevention (SMAP) is not disabled by
+    the <tt>nosmap</tt> boot paramenter option.
+
+    Check that the line <pre>GRUB_CMDLINE_LINUX="..."</pre> within <tt>/etc/default/grub</tt>
+    doesn't contain the argument <tt>nosmap</tt>.
+    Run the following command to update command line for already installed kernels:
+    <pre># grubby --update-kernel=ALL --remove-args="nosmap"</pre>
+
+rationale: |-
+    Disabling SMAP can facilitate exploitation of vulnerabilities caused by unintended access and
+    manipulation of data in the user space.
+
+severity: medium
+
+platform: machine
+
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/oval/shared.xml
new file mode 100644
index 0000000..359bc84
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="grub2_nosmep_argument_absent" version="1">
+    {{{ oval_metadata("SMEP should not be set.") }}}
+      <criteria comment="SMEP not set">
+        <criterion test_ref="test_grub2_nosmep_argument_absent" />
+      </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="No SMEP" id="test_grub2_nosmep_argument_absent" version="1">
+    <ind:object object_ref="obj_grub2_nosmep_argument_absent" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_grub2_nosmep_argument_absent" version="1">
+    <ind:filepath>/proc/cmdline</ind:filepath>
+    <ind:pattern operation="pattern match">^.*nosmep.*$</ind:pattern>
+    <ind:instance datatype="int" operation="equals">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+
+</def-group>
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/rule.yml
new file mode 100644
index 0000000..f39bbb7
--- /dev/null
+++ b/linux_os/guide/system/bootloader-grub2/grub2_nosmep_argument_absent/rule.yml
@@ -0,0 +1,25 @@
+documentation_complete: true
+
+title: 'Ensure SMEP is not disabled during boot'
+
+description: |-
+    The SMEP is used to prevent the supervisor mode from executing user space code,
+    it is enabled by default since Linux kernel 3.0. But it could be disabled through
+    kernel boot parameters.
+
+    Ensure that Supervisor Mode Execution Prevention (SMEP) is not disabled by
+    the <tt>nosmep</tt> boot paramenter option.
+
+    Check that the line <pre>GRUB_CMDLINE_LINUX="..."</pre> within <tt>/etc/default/grub</tt>
+    doesn't contain the argument <tt>nosmep</tt>.
+    Run the following command to update command line for already installed kernels:
+    <pre># grubby --update-kernel=ALL --remove-args="nosmep"</pre>
+
+rationale: |-
+    Disabling SMEP can facilitate exploitation of certain vulnerabilities because it allows
+    the kernel to unintentionally execute code in less privileged memory space.
+
+severity: medium
+
+platform: machine
+
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml
index d12c53c..0c629cb 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_uefi_password/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ocp4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,ocp4,ol7,ol8,openeuler2203,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Set the UEFI Boot Loader Password'
 
diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/oval/shared.xml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/oval/shared.xml
index 12df194..18a5974 100644
--- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/oval/shared.xml
+++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/oval/shared.xml
@@ -6,6 +6,7 @@
         <platform>Red Hat Virtualization 4</platform>
         <platform>multi_platform_ol</platform>
         <platform>multi_platform_rhel</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>The sticky bit should be set for all world-writable directories.</description>
     </metadata>
diff --git a/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/oval/shared.xml b/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/oval/shared.xml
index ed85608..d364e2b 100644
--- a/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/oval/shared.xml
+++ b/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/oval/shared.xml
@@ -7,6 +7,7 @@
         <platform>multi_platform_fedora</platform>
         <platform>multi_platform_rhel</platform>
         <platform>multi_platform_wrlinux</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>All files should be owned by a group</description>
     </metadata>
diff --git a/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml
index e51cd7e..efd5046 100644
--- a/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml
+++ b/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure All Files Are Owned by a Group'
 
diff --git a/linux_os/guide/system/permissions/files/no_empty_symlink_files/rule.yml b/linux_os/guide/system/permissions/files/no_empty_symlink_files/rule.yml
new file mode 100644
index 0000000..5db67ea
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/no_empty_symlink_files/rule.yml
@@ -0,0 +1,26 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Symlink Files Have Canonical Path'
+
+description: |-
+    <p><tt>It can not be scanned automatically, please check it manually.</tt></p>
+    <p>If any symlink files have no camonical path, it should be removed.</p>
+    <ul>
+    <li>You can use below cli command to find out all symlink files which have no canonical path under current path:
+    <pre># find ./ -type l -follow</pre>
+    </li>
+    <li>Or find it under root path bug exclude some dirs:
+    <pre># find / -path /var -prune -o -path /run -prune -o -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o -type l -follow</pre>
+    </li>
+    <li>Or find it under the whole disk partition:
+    <pre># find / -xdev -type l -follow</pre>
+    </li>
+    </ul>
+
+rationale: |-
+    If any symlink files have no camonical path, it should be removed.
+
+severity: medium
+
diff --git a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/oval/shared.xml b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/oval/shared.xml
index 75d95d4..64429cc 100644
--- a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/oval/shared.xml
+++ b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/oval/shared.xml
@@ -6,6 +6,7 @@
         <platform>Red Hat Virtualization 4</platform>
         <platform>multi_platform_rhel</platform>
         <platform>multi_platform_wrlinux</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>All files should be owned by a user</description>
     </metadata>
diff --git a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml
index f2fb1f2..2903767 100644
--- a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml
+++ b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,rhel6,rhel7,rhel8,rhv4,wrlinux1019
+prodtype: fedora,openeuler2203,rhel6,rhel7,rhel8,rhv4,wrlinux1019
 
 title: 'Ensure All Files Are Owned by a User'
 
diff --git a/linux_os/guide/system/permissions/files/no_hide_exec_files/oval/shared.xml b/linux_os/guide/system/permissions/files/no_hide_exec_files/oval/shared.xml
new file mode 100644
index 0000000..107fed0
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/no_hide_exec_files/oval/shared.xml
@@ -0,0 +1,40 @@
+<def-group>
+  <definition class="compliance" id="no_hide_exec_files" version="1">
+    <metadata>
+      <title>All hidden executable files</title>
+      <affected family="unix">
+        <platform>multi_platform_openeuler</platform>
+      </affected>
+      <description>Find out all hidden executable files</description>
+    </metadata>
+    <criteria>
+      <criterion comment="Check all hidden exec files" test_ref="test_no_hide_exec_files" />
+    </criteria>
+  </definition>
+
+  <unix:file_state id="symlink_file_list_match" version="1">
+    <unix:type operation="equals">symbolic link</unix:type>
+  </unix:file_state>
+
+  <unix:file_state id="exec_file_list_match" version="1">
+    <unix:type operation="equals">regular</unix:type>
+    <unix:uexec datatype="boolean">false</unix:uexec>
+    <unix:gexec datatype="boolean">false</unix:gexec>
+    <unix:oexec datatype="boolean">false</unix:oexec>
+  </unix:file_state>
+
+  <unix:file_object comment="all local files" id="object_no_hide_exec_files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" />
+    <unix:path>/</unix:path>
+    <unix:filename operation="pattern match">^\..*</unix:filename>
+    <filter action="exclude">symlink_file_list_match</filter>
+    <filter action="exclude">exec_file_list_match</filter>
+  </unix:file_object>
+  
+  <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
+  check="all" check_existence="none_exist" comment="Check all exec files"
+  id="test_no_hide_exec_files" version="1">
+    <unix:object object_ref="object_no_hide_exec_files" />
+  </unix:file_test>
+</def-group>
+  
diff --git a/linux_os/guide/system/permissions/files/no_hide_exec_files/rule.yml b/linux_os/guide/system/permissions/files/no_hide_exec_files/rule.yml
new file mode 100644
index 0000000..5c8bc4b
--- /dev/null
+++ b/linux_os/guide/system/permissions/files/no_hide_exec_files/rule.yml
@@ -0,0 +1,14 @@
+documentation_complete: true
+
+prodtype: openeuler2203
+
+title: 'Ensure All Executable Files are not hidden'
+
+description: |-
+    Find out all hidden executable files from system.
+
+rationale: |-
+    If a executable file is hidden, it maybe will introduce risks, since it can not be fould easily
+
+severity: medium
+
diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
index 2408bd0..a5bd907 100644
--- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml
@@ -2,7 +2,13 @@ documentation_complete: true
 
 title: 'Restrict Exposed Kernel Pointer Addresses Access'
 
-description: '{{{ describe_sysctl_option_value(sysctl="kernel.kptr_restrict", value="1") }}}'
+description: |-
+    {{{ describe_sysctl_option_value(sysctl="kernel.kptr_restrict", value="1") }}}
+    {{% if product in ["openeuler2203"] %}}
+    To ensure easy maintenance and location, 
+    the kptr_restrict parameter is set to 0 by default in the openEuler release. 
+    Please set this parameter based on the site requirements.
+    {{% endif %}}
 
 rationale: |-
     Exposing kernel pointers (through procfs or <tt>seq_printf()</tt>) exposes
diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml
index bf58274..0ccf428 100644
--- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml
+++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ocp4,ol7,ol8,rhel6,rhel7,rhel8,rhv4
+prodtype: fedora,ocp4,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4
 
 title: 'Restrict Access to Kernel Message Buffer'
 
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/oval/shared.xml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/oval/shared.xml
index 637b76d..cfb23ef 100644
--- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/oval/shared.xml
@@ -6,6 +6,7 @@
         <platform>multi_platform_fedora</platform>
         <platform>Red Hat Enterprise Linux 8</platform>
         <platform>Oracle Linux 8</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>SSH should be configured to use the system-wide crypto policy setting.</description>
     </metadata>
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
index b9d8b06..5442718 100644
--- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol8,rhel8
+prodtype: fedora,ol8,openeuler2203,rhel8
 
 title: 'Configure SSH to use System Crypto Policy'
 
diff --git a/linux_os/guide/system/software/system-tools/package_python2_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_python2_removed/rule.yml
new file mode 100644
index 0000000..1147e9b
--- /dev/null
+++ b/linux_os/guide/system/software/system-tools/package_python2_removed/rule.yml
@@ -0,0 +1,18 @@
+documentation_complete: true
+
+prodtype: openeuler2203 
+
+title: 'Uninstall All Python2 Packages'
+
+description: |-
+    {{{ describe_package_remove(package="python2") }}}
+
+rationale: |-
+    python2 related packages should be removed.
+
+severity: medium
+
+template:
+    name: package_removed
+    vars:
+        pkgname: python2
diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/oval/shared.xml b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/oval/shared.xml
index 600c7c0..26c1de9 100644
--- a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/oval/shared.xml
+++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/oval/shared.xml
@@ -8,6 +8,7 @@
         <platform>multi_platform_rhv</platform>
         <platform>multi_platform_rhel</platform>
         <platform>multi_platform_ol</platform>
+        <platform>multi_platform_openeuler</platform>
       </affected>
       <description>Ensure all yum or dnf repositories utilize signature checking.</description>
     </metadata>
diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml
index fc460dc..e1b4280 100644
--- a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml
+++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml
@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: fedora,ol7,ol8,rhel6,rhel7,rhel8,rhv4
+prodtype: fedora,ol7,ol8,openeuler2203,rhel6,rhel7,rhel8,rhv4
 
 title: 'Ensure gpgcheck Enabled for All {{{ pkg_manager }}} Package Repositories'
 
diff --git a/openeuler2203/cpe/openeuler2203-cpe-dictionary.xml b/openeuler2203/cpe/openeuler2203-cpe-dictionary.xml
index 986a804..f0eb8a8 100644
--- a/openeuler2203/cpe/openeuler2203-cpe-dictionary.xml
+++ b/openeuler2203/cpe/openeuler2203-cpe-dictionary.xml
@@ -7,4 +7,65 @@
             <!-- the check references an OVAL file that contains an inventory definition -->
             <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_OS_is_openeuler2203</check>
       </cpe-item>
+      <cpe-item name="cpe:/o:openEuler:openEuler:22.03LTS_SP1:ga:server">
+            <title xml:lang="en-us">openEuler 22.03 LTS</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_OS_is_openeuler2203</check>
+      </cpe-item>
+      <cpe-item name="cpe:/o:openEuler:openEuler:22.03LTS_SP2:ga:server">
+            <title xml:lang="en-us">openEuler 22.03 LTS</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_OS_is_openeuler2203</check>
+      </cpe-item>
+
+      <cpe-item name="cpe:/a:container">
+            <title xml:lang="en-us">Container</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_is_a_container</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:machine">
+            <title xml:lang="en-us">Bare-metal or Virtual Machine</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_is_a_machine</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:gdm">
+            <title xml:lang="en-us">Package gdm is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_gdm_package</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:libuser">
+            <title xml:lang="en-us">Package libuser is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_libuser_package</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:nss-pam-ldapd">
+            <title xml:lang="en-us">Package nss-pam-ldapd is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_nss-pam-ldapd_package</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:pam">
+            <title xml:lang="en-us">Package pam is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_pam_package</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:login_defs">
+            <title xml:lang="en-us">Package providing /etc/login.defs is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_login_defs</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:sssd">
+            <title xml:lang="en-us">Package sssd-common is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_sssd-common_package</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:systemd">
+            <title xml:lang="en-us">Package systemd is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_systemd_package</check>
+      </cpe-item>
+      <cpe-item name="cpe:/a:yum">
+            <title xml:lang="en-us">Package yum is installed</title>
+            <!-- the check references an OVAL file that contains an inventory definition -->
+            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_yum_package</check>
+      </cpe-item>
 </cpe-list>
diff --git a/openeuler2203/profiles/standard.profile b/openeuler2203/profiles/standard.profile
index 6fd9707..7f6f0e3 100644
--- a/openeuler2203/profiles/standard.profile
+++ b/openeuler2203/profiles/standard.profile
@@ -9,3 +9,88 @@ description: |-
 
 selections:
     - package_telnet_removed
+    - package_tftp-server_removed
+    - package_tftp_removed
+    - package_net-snmp_removed
+    - accounts_no_uid_except_zero
+    - file_owner_etc_passwd
+    - file_groupowner_etc_passwd
+    - file_permissions_etc_passwd
+    - file_owner_etc_shadow
+    - file_groupowner_etc_shadow
+    - file_permissions_etc_shadow
+    - file_owner_etc_group
+    - file_groupowner_etc_group
+    - file_permissions_etc_group
+    - file_owner_etc_gshadow
+    - file_groupowner_etc_gshadow
+    - file_permissions_etc_gshadow
+    - accounts_user_interactive_home_directory_exists
+    - gid_passwd_group_same
+    - var_password_pam_minlen=8
+    - accounts_password_pam_minlen
+    - accounts_password_pam_minclass
+    - var_password_pam_ucredit=0
+    - accounts_password_pam_ucredit
+    - var_password_pam_lcredit=0
+    - accounts_password_pam_lcredit
+    - var_password_pam_dcredit=0
+    - accounts_password_pam_dcredit
+    - var_password_pam_ocredit=0
+    - accounts_password_pam_ocredit
+    - accounts_password_pam_retry
+    - accounts_password_pam_unix_remember
+    - set_password_hashing_algorithm_systemauth
+    - accounts_maximum_age_login_defs
+    - var_accounts_minimum_age_login_defs=0
+    - accounts_minimum_age_login_defs
+    - accounts_password_warn_age_login_defs
+    - sshd_disable_empty_passwords
+    - grub2_uefi_password
+    - require_singleuser_auth
+    - accounts_passwords_pam_faillock_deny
+    - accounts_passwords_pam_faillock_deny_root
+    - var_accounts_passwords_pam_faillock_unlock_time=300
+    - accounts_passwords_pam_faillock_unlock_time
+    - var_accounts_tmout=5_min
+    - accounts_tmout
+    - sshd_allow_only_protocol2
+    - sshd_disable_rhosts
+    - disable_host_auth
+    - configure_ssh_crypto_policy
+    - sysctl_kernel_randomize_va_space
+    - sysctl_kernel_dmesg_restrict
+    - sysctl_kernel_kptr_restrict
+    - no_files_unowned_by_user
+    - file_permissions_ungroupowned
+    - dir_perms_world_writable_sticky_bits
+    - var_accounts_user_umask=077
+    - accounts_umask_etc_bashrc
+    - service_auditd_enabled
+    - auditd_data_retention_max_log_file_action
+    - auditd_data_retention_num_logs
+    - service_rsyslog_enabled
+    - package_python2_removed
+    - ensure_gpgcheck_never_disabled
+    - login_accounts_are_necessary
+    - accounts_are_necessary
+    - group_unique_id
+    - account_unique_id
+    - account_unique_group_id
+    - account_unique_name
+    - group_unique_name
+    - accounts_password_pam_dictcheck
+    - verify_owner_password
+    - no_name_contained_in_password
+    - sshd_strong_kex=standard_openeuler2203
+    - sshd_use_strong_kex
+    - sshd_use_strong_pubkey
+    - sshd_enable_pam
+    - sshd_use_strong_macs
+    - sshd_use_strong_ciphers
+    - grub2_nosmap_argument_absent
+    - grub2_nosmep_argument_absent
+    - package_ftp_removed
+    - no_empty_symlink_files
+    - no_hide_exec_files
+    - no_lowprivilege_users_writeable_cmds_in_crontab_file
diff --git a/shared/checks/oval/installed_env_has_login_defs.xml b/shared/checks/oval/installed_env_has_login_defs.xml
index 94ecbda..e304b19 100644
--- a/shared/checks/oval/installed_env_has_login_defs.xml
+++ b/shared/checks/oval/installed_env_has_login_defs.xml
@@ -21,7 +21,11 @@
     <linux:object object_ref="obj_env_has_login_defs_installed" />
   </linux:rpminfo_test>
   <linux:rpminfo_object id="obj_env_has_login_defs_installed" version="1">
+{{% if product == "openeuler2203" %}}
+    <linux:name>shadow</linux:name>
+{{% else %}}
     <linux:name>shadow-utils</linux:name>
+{{% endif %}}
   </linux:rpminfo_object>
 {{% elif pkg_system == "dpkg" %}}
   <linux:dpkginfo_test check="all" check_existence="all_exist"
diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja
index 867e083..111ba3c 100644
--- a/shared/macros-oval.jinja
+++ b/shared/macros-oval.jinja
@@ -34,6 +34,7 @@
     <criteria comment="{{{ application }}} is configured correctly and configuration file exists"
     operator="AND">
     {{%- endif %}}
+    {{%- if product != "openeuler2203" %}}
     {{%- if application == "sshd" %}}
 {{#-
     This condition is here to avoid regression in sshd configuration rules.
@@ -46,6 +47,7 @@
         {{{- application_not_required_or_requirement_unset() }}}
         {{{- application_required_or_requirement_unset() }}}
     {{%- endif %}}
+    {{%- endif %}}
     <criteria comment="{{{ application }}} is configured correctly"
     operator="OR">
         {{{- oval_line_in_file_criterion(path, parameter) }}}
@@ -53,10 +55,12 @@
         {{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass) }}}
         {{%- endif %}}
     </criteria>
+    {{%- if product != "openeuler2203" %}}
     {{%- if application == "sshd" %}}
     </criteria> {{# close criteria left open in application_required_or_requirement_unset #}}
     </criteria>
     {{%- endif %}}
+    {{%- endif %}}
     {{%- if missing_config_file_fail %}}
         {{{- oval_config_file_exists_criterion(path) }}}
     </criteria>
@@ -368,7 +372,11 @@
     <linux:object object_ref="obj_{{{ test_id }}}" />
   </linux:rpminfo_test>
   <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
+{{% if package == "python2" %}}
+    <linux:name operation="pattern match">python2-.*</linux:name>
+{{% else %}}
     <linux:name>{{{ package }}}</linux:name>
+{{% endif %}}
   </linux:rpminfo_object>
 {{% elif pkg_system == "dpkg" %}}
   <linux:dpkginfo_test check="all" check_existence="none_exist"
@@ -490,3 +498,68 @@
 
   </def-group>
 {{%- endmacro %}}
+
+
+{{#
+  Macro which generates the OVAL metadata section
+
+:param description: The text to place in the description section
+:type description: str
+:param title: Optional, the associated rule title is used by default
+:type title: str
+:param affected_platforms: Optional, list of unix platform strings (e.g. "Fedora") to put under the affected element. Uses the oval_affected macro by default under the hood.
+:type affected_platforms: str
+
+#}}
+{{%- macro oval_metadata(description, title="", affected_platforms=None) -%}}
+    <metadata>
+{{%- if title %}}
+        <title>{{{ title }}}</title>
+{{%- else %}}
+        <title>{{{ rule_title }}}</title>
+{{%- endif -%}}
+{{%- if affected_platforms %}}
+            <affected family="unix">
+{{%- for platform in affected_platforms %}}
+                <platform>{{{ platform }}}</platform>
+{{%- endfor %}}
+            </affected>
+{{%- else %}}
+        {{{ oval_affected(products) | indent -}}}
+{{%- endif %}}
+        <description>{{{ description }}}{{{ caller() if caller else '' }}}</description>
+    </metadata>
+{{%- endmacro %}}
+
+{{#
+  Extract from /etc/passwd a list composed of password objects related to non-system UIDs.
+  This list is then filtered to exclude some special usernames and users with /sbin/nologin shell.
+
+  The macro receives a string as parameter, which is used as the password_object id in the rule.
+
+  :param object_id: Object id to be created.
+  :type object_id: str
+#}}
+{{%- macro create_interactive_users_list_object(object_id) -%}}
+  {{%- set ignored_users_list="(nobody|nfsnobody)" %}}
+
+  <unix:password_object id="{{{ object_id }}}" version="1">
+    <unix:username datatype="string" operation="pattern match">.*</unix:username>
+    <filter action="include">state_{{{ rule_id }}}_users_uids</filter>
+    <filter action="exclude">state_{{{ rule_id }}}_users_ignored</filter>
+    <filter action="exclude">state_{{{ rule_id }}}_users_nologin_shell</filter>
+  </unix:password_object>
+
+  <unix:password_state id="state_{{{ rule_id }}}_users_uids" version="1">
+    <unix:user_id datatype="int" operation="greater than or equal">{{{ uid_min }}}</unix:user_id>
+  </unix:password_state>
+
+  <unix:password_state id="state_{{{ rule_id }}}_users_ignored" version="1">
+    <unix:username datatype="string" operation="pattern match">^{{{ ignored_users_list }}}$</unix:username>
+  </unix:password_state>
+
+  <unix:password_state id="state_{{{ rule_id }}}_users_nologin_shell" version="1">
+    <unix:login_shell datatype="string" operation="pattern match">^/sbin/nologin$</unix:login_shell>
+  </unix:password_state>
+{{%- endmacro %}}
+
diff --git a/shared/templates/template_OVAL_sysctl b/shared/templates/template_OVAL_sysctl
index f84fc3d..62ae26d 100644
--- a/shared/templates/template_OVAL_sysctl
+++ b/shared/templates/template_OVAL_sysctl
@@ -23,7 +23,9 @@
       <description>The "{{{ SYSCTLVAR }}}" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
     </metadata>
     <criteria operator="AND">
+{{% if product not in ["openeuler2203"] %}}
       <extend_definition comment="{{{ SYSCTLVAR }}} configuration setting check" definition_ref="sysctl_static_{{{ SYSCTLID }}}" />
+{{% endif %}}
       <extend_definition comment="{{{ SYSCTLVAR }}} runtime setting check" definition_ref="sysctl_runtime_{{{ SYSCTLID }}}" />
     </criteria>
   </definition>
@@ -47,7 +49,9 @@
       <extend_definition comment="is IPv6 enabled?" definition_ref="sysctl_kernel_ipv6_disable" />
 {{% endif %}}
       <criteria operator="AND">
+{{% if product not in ["openeuler2203"] %}}
         <extend_definition comment="{{{ SYSCTLVAR }}} configuration setting check" definition_ref="sysctl_static_{{{ SYSCTLID }}}" />
+{{% endif %}}
         <extend_definition comment="{{{ SYSCTLVAR }}} runtime setting check" definition_ref="sysctl_runtime_{{{ SYSCTLID }}}" />
       </criteria>
     </criteria>
diff --git a/ssg/constants.py b/ssg/constants.py
index 401c60d..aa081d8 100644
--- a/ssg/constants.py
+++ b/ssg/constants.py
@@ -120,7 +120,7 @@ FULL_NAME_TO_PRODUCT_MAPPING = {
     "Red Hat OpenShift Container Platform 4": "ocp4",
     "Oracle Linux 7": "ol7",
     "Oracle Linux 8": "ol8",
-    "openEuler 22.03 LTS": "openeuler2203",
+    "multi_platform_openeuler": "openeuler2203",
     "openSUSE": "opensuse",
     "Red Hat Enterprise Linux 6": "rhel6",
     "Red Hat Enterprise Linux 7": "rhel7",
@@ -224,6 +224,8 @@ PRODUCT_TO_CPE_MAPPING = {
     ],
     "openeuler2203": [
         "cpe:/o:openEuler:openEuler:22.03LTS:ga:server",
+        "cpe:/o:openEuler:openEuler:22.03LTS_SP1:ga:server",
+        "cpe:/o:openEuler:openEuler:22.03LTS_SP2:ga:server",
     ],
     "opensuse": [
         "cpe:/o:opensuse:leap:42.1",
-- 
2.21.0.windows.1

