Slmicro5 auth,security and audit STIG rules #12192

teacup-on-rockingchair · 2024-07-21T19:33:00Z

Description:

Add some rules for the STIG support for SLE MicroOS 5.X platform

Rationale:

Add some user account related DISA STIG rules for SLE Micro 5.x platform

enabled slmicro5 platform for accounts_passwords_pam_faildelay_delay and accounts_logon_fail_delay rules
implemented new rule accounts_passwords_pam_tally2_file_selinux in the context of STIG SLEM-05-412030 requirement "SLEM 5 must use the default pam_tally2 tally directory."
Enable some specifics of the package applicability cheks for slmicro5
Add selinux basic support rules for slmicro5
Add package_audit-audispd-plugins_installed rule for slmicro5
Add to STIG for slmicro5 rules for audit of selinux commands
Drop allocated CCEs from availabiility list

Review Hints:

Tested on SLE MicroOS 5.X platform running the checks , then in transactional update run the bash remediation script generated by the xccdf generate fix command and then after exit and reboot run the oval checks again to make sure they pass.

github-actions · 2024-07-21T19:34:24Z

Start a new ephemeral environment with changes proposed in this pull request:

sle12 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-07-21T19:52:06Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12192
This image was built from commit: 9b94058

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12192

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12192 make deploy-local

github-actions · 2024-07-23T04:48:29Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember
@@ -5,6 +5,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_remember=''
 
@@ -12,10 +13,12 @@
 VALUE_NAMES+=("remember")
 ARGS+=("")
 NEW_ARGS+=("")
+
 VALUES+=("")
 VALUE_NAMES+=("")
 ARGS+=("use_authtok")
 NEW_ARGS+=("use_authtok")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -48,6 +51,9 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_pwhistory.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_pwhistory.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_dcredit' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_dcredit
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_dcredit
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_dcredit=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("dcredit")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_difok' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_difok
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_difok
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_difok=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("difok")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_lcredit' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_lcredit
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_lcredit
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_lcredit=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("lcredit")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_minlen' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_minlen
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_minlen
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_minlen=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("minlen")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_ocredit' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_ocredit
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_ocredit
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_ocredit=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("ocredit")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_retry
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_retry=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("retry")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_ucredit' differs.
--- xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_ucredit
+++ xccdf_org.ssgproject.content_rule_cracklib_accounts_password_pam_ucredit
@@ -3,6 +3,7 @@
 declare -a VALUE_NAMES=()
 declare -a ARGS=()
 declare -a NEW_ARGS=()
+declare -a DEL_ARGS=()
 
 var_password_pam_ucredit=''
 
@@ -10,6 +11,7 @@
 VALUE_NAMES+=("ucredit")
 ARGS+=("")
 NEW_ARGS+=("")
+
 
 for idx in "${!VALUES[@]}"
 do
@@ -42,5 +44,8 @@
 do
     if ! grep -q -P "^\s*password\s+requisite\s+pam_cracklib.so.*\s+${ARGS[$idx]}\s*$" /etc/pam.d/common-password ; then
         sed --follow-symlinks -i -E -e "s/^\\s*password\\s+requisite\\s+pam_cracklib.so.*\$/& ${NEW_ARGS[$idx]}/" /etc/pam.d/common-password
+        if [ -n "${DEL_ARGS[$idx]}" ]; then
+            sed --follow-symlinks -i -E -e "s/\s+${DEL_ARGS[$idx]}\S+\s+/ /g" /etc/pam.d/common-password
+        fi
     fi
 done

jan-cerny · 2024-07-24T08:03:38Z

...counts-pam/locking_out_password_attempts/accounts_passwords_pam_tally2_file_selinux/rule.yml

+
+    unconfined_u:object_r:faillog_t:s0 /var/log/faillock
+
+    If the security context type of the tally directory is not "tallylog_t", this is a finding.


should be faillog_t

Thanks for the note , should be fixed in 9b94058 🙇

- enabled slmicro5 platform for accounts_passwords_pam_faildelay_delay and accounts_logon_fail_delay rules - implemented new rule accounts_passwords_pam_tally2_file_selinux in the context of STIG SLEM-05-412030 requirement "SLEM 5 must use the default pam_tally2 tally directory."

- Enable some specifics of the package applicability cheks for slmicro5

…lly directory STIG requirement Also fixed some platform references

@jan-cerny

tallylog_t term was carbon copied from DISA spec, which later discovered had a mistake, and though DISA were contacted and opened a ticket on their side, we forgot to fix the rule sections involving the tallylog_t. Thanks @jan-cerny 🙇

codeclimate · 2024-07-29T11:43:31Z

Code Climate has analyzed commit 9b94058 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

teacup-on-rockingchair marked this pull request as draft July 21, 2024 19:33

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 21, 2024

teacup-on-rockingchair force-pushed the slmicro5_auth_security_rules branch 2 times, most recently from 3da1c08 to db702a7 Compare July 23, 2024 04:44

teacup-on-rockingchair force-pushed the slmicro5_auth_security_rules branch from db702a7 to 0a75dea Compare July 23, 2024 04:49

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 23, 2024

teacup-on-rockingchair force-pushed the slmicro5_auth_security_rules branch from 0a75dea to 5c4bf63 Compare July 23, 2024 05:07

teacup-on-rockingchair marked this pull request as ready for review July 23, 2024 05:39

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 23, 2024

jan-cerny reviewed Jul 24, 2024

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jul 24, 2024

teacup-on-rockingchair added 10 commits July 26, 2024 00:53

Add slmicro5 rule package_policycoreutils_installed

ad38787

- Enable some specifics of the package applicability cheks for slmicro5

Add selinux basic support rules for slmicro5

3dced9f

Add package_audit-audispd-plugins_installed rule for slmicro5

8f3801a

Add to STIG for slmicro5 rules for audit of selinux commands

8463bc2

Drop allocated CCEs from availabiility list

b1bcccd

Fix description of rule

83682b7

Assign accounts_passwords_pam_tally2_file_selinux to pam component

3c6bbe5

Add accounts_passwords_pam_tally2_file rule for default pam_tally2 ta…

0ea87c2

…lly directory STIG requirement Also fixed some platform references

Fix description of rule

9b94058

tallylog_t term was carbon copied from DISA spec, which later discovered had a mistake, and though DISA were contacted and opened a ticket on their side, we forgot to fix the rule sections involving the tallylog_t. Thanks @jan-cerny 🙇

teacup-on-rockingchair force-pushed the slmicro5_auth_security_rules branch from 0643f88 to 9b94058 Compare July 29, 2024 11:01

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jul 29, 2024

jan-cerny self-assigned this Jul 29, 2024

jan-cerny added this to the 0.1.74 milestone Jul 29, 2024

teacup-on-rockingchair requested a review from jan-cerny July 29, 2024 12:59

jan-cerny approved these changes Jul 29, 2024

View reviewed changes

jan-cerny merged commit 2ff314f into ComplianceAsCode:master Jul 29, 2024
91 of 96 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Slmicro5 auth,security and audit STIG rules #12192

Slmicro5 auth,security and audit STIG rules #12192

teacup-on-rockingchair commented Jul 21, 2024 •

edited

Loading

github-actions bot commented Jul 21, 2024

github-actions bot commented Jul 21, 2024 •

edited

Loading

github-actions bot commented Jul 23, 2024 •

edited

Loading

jan-cerny Jul 24, 2024

teacup-on-rockingchair Jul 25, 2024 •

edited

Loading

codeclimate bot commented Jul 29, 2024


		unconfined_u:object_r:faillog_t:s0 /var/log/faillock

		If the security context type of the tally directory is not "tallylog_t", this is a finding.

Slmicro5 auth,security and audit STIG rules #12192

Slmicro5 auth,security and audit STIG rules #12192

Conversation

teacup-on-rockingchair commented Jul 21, 2024 • edited Loading

Description:

Rationale:

Review Hints:

github-actions bot commented Jul 21, 2024

github-actions bot commented Jul 21, 2024 • edited Loading

github-actions bot commented Jul 23, 2024 • edited Loading

jan-cerny Jul 24, 2024

Choose a reason for hiding this comment

teacup-on-rockingchair Jul 25, 2024 • edited Loading

Choose a reason for hiding this comment

codeclimate bot commented Jul 29, 2024

teacup-on-rockingchair commented Jul 21, 2024 •

edited

Loading

github-actions bot commented Jul 21, 2024 •

edited

Loading

github-actions bot commented Jul 23, 2024 •

edited

Loading

teacup-on-rockingchair Jul 25, 2024 •

edited

Loading