From 4bd83858e18233c1c3cf651d2b1316cb61c4271e Mon Sep 17 00:00:00 2001 From: svet-se Date: Mon, 2 Sep 2024 16:19:19 +0300 Subject: [PATCH 1/6] Add rule package_audit-audispd-plugins_installed to sle micro 5 stig profile --- controls/stig_slmicro5.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml index 14e3ba5e66a..8be7277110d 100644 --- a/controls/stig_slmicro5.yml +++ b/controls/stig_slmicro5.yml @@ -1399,8 +1399,9 @@ controls: levels: - medium title: The audit-audispd-plugins package must be installed on SLEM 5. - rules: [] - status: pending + rules: + - package_audit-audispd-plugins_installed + status: automated - id: SLEM-05-653025 levels: @@ -1410,7 +1411,6 @@ controls: week of audit records when audit records are not immediately sent to a central audit record storage facility. rules: - - package_audit-audispd-plugins_installed - auditd_audispd_configure_sufficiently_large_partition status: automated From 7fe3562e3463d9d698737938735b003106518374 Mon Sep 17 00:00:00 2001 From: svet-se Date: Mon, 2 Sep 2024 16:33:08 +0300 Subject: [PATCH 2/6] Add rule smartcard_pam_enabled to sle micro 5 stig profile --- controls/stig_slmicro5.yml | 5 +++-- .../smartcard_pam_enabled/ansible/shared.yml | 10 +++------- .../smartcard_pam_enabled/bash/shared.sh | 2 +- .../smart_card_login/smartcard_pam_enabled/rule.yml | 1 + .../smartcard_pam_enabled/tests/commented.fail.sh | 2 +- .../smartcard_pam_enabled/tests/correct.pass.sh | 2 +- .../smartcard_pam_enabled/tests/nothing.fail.sh | 2 +- .../smartcard_pam_enabled/tests/substring.fail.sh | 2 +- shared/references/cce-slmicro5-avail.txt | 1 - 9 files changed, 12 insertions(+), 15 deletions(-) diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml index 8be7277110d..05c1f38b42c 100644 --- a/controls/stig_slmicro5.yml +++ b/controls/stig_slmicro5.yml @@ -1256,8 +1256,9 @@ controls: title: SLEM 5 must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM). - rules: [] - status: pending + rules: + - smartcard_pam_enabled + status: automated - id: SLEM-05-612020 levels: diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml index 30f35d2e02f..25c60eb44e5 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml @@ -1,18 +1,14 @@ -# platform = multi_platform_sle,Ubuntu 20.04 +# platform = multi_platform_sle,multi_platform_slmicro,Ubuntu 20.04 # reboot = false # strategy = restrict # complexity = low # disruption = low -{{%- if 'sle' in product %}} +{{%- if 'sle' in product or 'slmicro' in product %}} {{%- set pam_package = "pam_pkcs11" %}} -{{%- else %}} - {{%- set pam_package = "libpam-pkcs11" %}} -{{% endif %}} - -{{%- if 'sle' in product %}} {{%- set pam_pkcs11_control_flag = "sufficient" %}} {{%- else %}} + {{%- set pam_package = "libpam-pkcs11" %}} {{%- set pam_pkcs11_control_flag = "\u005Bsuccess=2 default=ignore\u005D" %}} {{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh index 2e796f6bc2c..248946795c2 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = multi_platform_sle,Ubuntu 20.04 +# platform = multi_platform_sle,multi_platform_slmicro,Ubuntu 20.04 {{% if 'ubuntu' in product %}} {{{ bash_ensure_pam_module_option('/etc/pam.d/common-auth', 'auth', '[success=2 default=ignore]', 'pam_pkcs11.so', '', '', '# here are the per-package modules') }}} {{% else %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml index 8a82e9e4d24..2b812b097d2 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml @@ -53,6 +53,7 @@ severity: medium identifiers: cce@sle12: CCE-83208-9 cce@sle15: CCE-85556-9 + cce@slmicro5: CCE-93800-1 references: disa: CCI-000765,CCI-000766,CCI-000767,CCI-000768,CCI-000187,CCI-001948,CCI-001953,CCI-001954,CCI-004047 diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh index 3750cac24ac..91934ecd5b3 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 {{% if 'ubuntu' in product %}} sed -i '/^auth.*pam_unix.so/i # auth [success=2 default=ignore] pam_pkcs11.so' /etc/pam.d/common-auth diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh index 37f5fff8eca..517c970aa92 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 {{% if 'ubuntu' in product %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh index d57f93ef014..df8aa9695b4 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 echo "auth [success=1 default=ignore] pam_unix.so nullok" > /etc/pam.d/common-auth diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh index 4773c829ed6..67fa5d22551 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 {{% if 'ubuntu' in product %}} diff --git a/shared/references/cce-slmicro5-avail.txt b/shared/references/cce-slmicro5-avail.txt index 9bdd0325515..35d9eb90b14 100644 --- a/shared/references/cce-slmicro5-avail.txt +++ b/shared/references/cce-slmicro5-avail.txt @@ -16,7 +16,6 @@ CCE-93743-3 CCE-93757-3 CCE-93777-1 CCE-93783-9 -CCE-93800-1 CCE-93801-9 CCE-93802-7 CCE-93803-5 From 506cb1895f25f639037e00446b42286e502c0114 Mon Sep 17 00:00:00 2001 From: svet-se Date: Tue, 3 Sep 2024 10:16:08 +0300 Subject: [PATCH 3/6] Remove rule aide_periodic_cron_checking from sle micro 5 stig profile --- controls/stig_slmicro5.yml | 5 ++--- .../aide/aide_periodic_cron_checking/bash/shared.sh | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml index 05c1f38b42c..4491d9b3f3a 100644 --- a/controls/stig_slmicro5.yml +++ b/controls/stig_slmicro5.yml @@ -1355,9 +1355,8 @@ controls: title: Advanced Intrusion Detection Environment (AIDE) must verify the baseline SLEM 5 configuration at least weekly. - rules: - - aide_periodic_cron_checking - status: automated + rules: [] + status: pending - id: SLEM-05-651035 levels: diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh index 9114988a2b4..dfa5c1b6c89 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro +# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle {{{ bash_package_install("aide") }}} From fd14f6d101b5198afe99649c5c6c2e411d2e14c0 Mon Sep 17 00:00:00 2001 From: svet-se Date: Tue, 3 Sep 2024 14:35:25 +0300 Subject: [PATCH 4/6] Add rule aide_periodic_checking_systemd_timer to sle micro 5 stig profile --- controls/stig_slmicro5.yml | 5 +++-- .../aide/aide_periodic_checking_systemd_timer/rule.yml | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml index 4491d9b3f3a..67eb37321ff 100644 --- a/controls/stig_slmicro5.yml +++ b/controls/stig_slmicro5.yml @@ -1355,8 +1355,9 @@ controls: title: Advanced Intrusion Detection Environment (AIDE) must verify the baseline SLEM 5 configuration at least weekly. - rules: [] - status: pending + rules: + - aide_periodic_checking_systemd_timer + status: automated - id: SLEM-05-651035 levels: diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml index 24569ec1f4a..a6c54db1837 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml @@ -22,6 +22,7 @@ severity: medium identifiers: cce@sle12: CCE-92366-4 cce@sle15: CCE-92516-4 + cce@slmicro5: CCE-93721-9 references: cis-csc: 1,11,12,13,14,15,16,2,3,5,7,8,9 From 3c77c175a632ba641f63dbe28fe55f678f4226d6 Mon Sep 17 00:00:00 2001 From: svet-se Date: Tue, 3 Sep 2024 14:38:02 +0300 Subject: [PATCH 5/6] Update the cce-slmicro5-avail for rule aide_periodic_checking_systemd_timer --- shared/references/cce-slmicro5-avail.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/shared/references/cce-slmicro5-avail.txt b/shared/references/cce-slmicro5-avail.txt index 35d9eb90b14..0e6e097e16a 100644 --- a/shared/references/cce-slmicro5-avail.txt +++ b/shared/references/cce-slmicro5-avail.txt @@ -9,7 +9,6 @@ CCE-93709-4 CCE-93713-6 CCE-93711-0 CCE-93712-8 -CCE-93721-9 CCE-93722-7 CCE-93726-8 CCE-93743-3 From 460137d29b38fb742f880486a9adcd48b0d803ba Mon Sep 17 00:00:00 2001 From: svet-se Date: Wed, 4 Sep 2024 10:14:47 +0300 Subject: [PATCH 6/6] Add rule aide_scan_notification to sle micro 5 stig profile --- controls/stig_slmicro5.yml | 5 +++-- .../aide/aide_scan_notification/ansible/shared.yml | 2 +- .../aide/aide_scan_notification/bash/shared.sh | 2 +- .../aide/aide_scan_notification/oval/shared.xml | 10 +++++----- .../aide/aide_scan_notification/rule.yml | 5 +++-- shared/references/cce-slmicro5-avail.txt | 1 - 6 files changed, 13 insertions(+), 12 deletions(-) diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml index 67eb37321ff..c98339e791f 100644 --- a/controls/stig_slmicro5.yml +++ b/controls/stig_slmicro5.yml @@ -1366,8 +1366,9 @@ controls: SLEM 5 must notify the system administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions. - rules: [] - status: pending + rules: + - aide_scan_notification + status: automated - id: SLEM-05-652010 levels: diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml index 6544d5d94ca..d486ed81786 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml @@ -12,7 +12,7 @@ with_items: - aide -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} - name: "{{{ rule_title }}} check service" ansible.builtin.blockinfile: create: yes diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh index c3a4301f91c..972a4813cfb 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh @@ -3,7 +3,7 @@ {{{ bash_package_install("aide") }}} {{{ bash_instantiate_variables("var_aide_scan_notification_email") }}} -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} # create unit file for periodic aide database check cat > /etc/systemd/system/aidecheck.service < -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} @@ -52,7 +52,7 @@ ^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$ 1 -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} @@ -61,7 +61,7 @@ /etc/systemd/system/aidecheck.service - ^ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$ + ^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$ 1 /etc/systemd/system/aidecheck.service - ^Before\=.*aidecheck-notify.service$ + ^.*Before\=.*aidecheck-notify.service.*$ 1 /etc/systemd/system/aidecheck.service - ^Wants\=.*aidecheck-notify.service.*$ + ^.*Wants\=.*aidecheck-notify.service.*$ 1 {{% endif %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml index d786e13096f..028e6dc2f8d 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml @@ -32,6 +32,7 @@ identifiers: cce@rhel10: CCE-90177-7 cce@sle12: CCE-83048-9 cce@sle15: CCE-91214-7 + cce@slmicro5: CCE-93722-7 references: cis-csc: 1,11,12,13,15,16,2,3,5,7,8,9 @@ -54,7 +55,7 @@ ocil_clause: 'AIDE has not been configured or has not been configured to notify ocil: |- To determine that periodic AIDE execution has been scheduled, run the following command: -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} 
$ sudo systemctl status  aidecheck-notify|grep loaded
The output should return that the service is loaded. Also we should make sure that notification service is started by the check: @@ -73,7 +74,7 @@ fixtext: |- The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} $ cat > /etc/systemd/system/aidecheck-notify.service <