Add implementation for rsyslog_logging_configured rule #10063

teacup-on-rockingchair · 2023-01-15T19:28:24Z

Description:

Add implementation for rsyslog_logging_configured rule

Rationale:

Add oval checks, tests and ansible and bash remediation for the rsyslog_logging_configured rule. Based on CIS specification for 'Ensure logging is configured'

openshift-ci · 2023-01-15T19:28:34Z

Hi @teacup-on-rockingchair. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2023-01-15T19:30:11Z

Start a new ephemeral environment with changes proposed in this pull request:

sle12 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

marcusburghardt

While reviewing this PR, I was considering its robustness. The specific requirement in CIS is manual. Not only for SUSE, but for other distros as well. And the reason is probably the same. I can't see a reliable way to automate the check and the remediation for this. Since there is nothing specific about the expected rsyslog entries, it is difficult to find the correct assessment. For the same reason, there is no reliable way to remediate this requirement. In general, CIS requirements marked as manual are not expected to have an automated rule. I would consider to not even include a rule for this. What do you think @teacup-on-rockingchair ?

...ide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml

...tem/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/oval/shared.xml

marcusburghardt · 2023-01-31T12:03:07Z

...stem/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/bash/shared.sh

+# complexity = low
+# disruption = low
+
+{{{ bash_replace_or_append('/etc/rsyslog.conf', '^\*\.\*', "/var/log/messages", '%s %s') }}}


I don't think this is a good approach. This could create log duplication and probably could hit performance issues.

.../logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml

marcusburghardt · 2023-02-14T07:18:40Z

.../logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml

+  lineinfile:
+    dest: /etc/rsyslog.conf
+    regexp: "^\\*\\.\\*"
+    line: "*.* /var/log/messages"


Like in the Bash equivalent, I don't think this is a good approach. This could create log duplication and probably could hit performance issues. Is this rule necessary?

teacup-on-rockingchair · 2023-02-14T10:28:15Z

While reviewing this PR, I was considering its robustness. The specific requirement in CIS is manual. Not only for SUSE, but for other distros as well. And the reason is probably the same. I can't see a reliable way to automate the check and the remediation for this. Since there is nothing specific about the expected rsyslog entries, it is difficult to find the correct assessment. For the same reason, there is no reliable way to remediate this requirement. In general, CIS requirements marked as manual are not expected to have an automated rule. I would consider to not even include a rule for this. What do you think @teacup-on-rockingchair ?

I tend to agree that the rule is kind of tricky to automate. Maybe the best compromise between user experience and robustness would be to have the check, which is generic enough, and drop the remediations, since those seem to enforce only one type of configuration and sysadmins can achieve the target in millions of other valid ways.

marcusburghardt · 2023-02-14T11:35:17Z

While reviewing this PR, I was considering its robustness. The specific requirement in CIS is manual. Not only for SUSE, but for other distros as well. And the reason is probably the same. I can't see a reliable way to automate the check and the remediation for this. Since there is nothing specific about the expected rsyslog entries, it is difficult to find the correct assessment. For the same reason, there is no reliable way to remediate this requirement. In general, CIS requirements marked as manual are not expected to have an automated rule. I would consider to not even include a rule for this. What do you think @teacup-on-rockingchair ?

I tend to agree that the rule is kind of tricky to automate. Maybe the best compromise between user experience and robustness would be to have the check, which is generic enough, and drop the remediations, since those seem to enforce only one type of configuration and sysadmins can achieve the target in millions of other valid ways.

Yes, a check generic enough should be helpful. If there is any relevant corner case which could generate false results during the assessment, they should also be documented in the rule warnings section.

Since the CIS is not specific about the remediation, I agree to drop the remediation and leave the admins to decide about their preferred approaches in alignment to their site policies.

Add oval checks for the rsyslog_logging_configured rule - based on CIS specification for 'Ensure logging is configured' - add warning on the nature and automation of the rule

github-actions · 2023-02-15T08:00:07Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rsyslog_logging_configured'.
--- xccdf_org.ssgproject.content_rule_rsyslog_logging_configured
+++ xccdf_org.ssgproject.content_rule_rsyslog_logging_configured
@@ -6,6 +6,13 @@
 The /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files
 specifies rules for logging and which files are to be used to log certain
 classes of messages.
+
+[warning]:
+This rule does not come with remediation as there is no one way to solve the problem, and
+the requirement from CIS specification does not require one particular way, but persuades
+the system administrator to perform configuration suitable for the specific environment.
+This also means that the OVAL check is too generic, and the user most probably should
+perform additional manual verification.
 
 [reference]:
 4.2.1.4

New datastream is missing bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_logging_configured'.
New datastream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_logging_configured'.

marcusburghardt

Could you also include prodtype and define only the SLE products in the rule.yml, please?

After these minor points this PR should be ready to be merged.

...ide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml

…ation/rsyslog_logging_configured/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>

codeclimate · 2023-02-20T00:34:49Z

Code Climate has analyzed commit ee4f4a5 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.7% (0.0% change).

View more on Code Climate.

teacup-on-rockingchair requested a review from a team as a code owner January 15, 2023 19:28

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jan 15, 2023

marcusburghardt requested changes Jan 31, 2023

View reviewed changes

marcusburghardt self-assigned this Feb 14, 2023

marcusburghardt added SLES SUSE Linux Enterprise Server product related. CIS CIS Benchmark related. New Rule Issues or pull requests related to new Rules. labels Feb 14, 2023

marcusburghardt reviewed Feb 14, 2023

View reviewed changes

.../logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/ansible/shared.yml Outdated Show resolved Hide resolved

marcusburghardt reviewed Feb 14, 2023

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Feb 15, 2023

teacup-on-rockingchair marked this pull request as draft February 15, 2023 05:04

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Feb 15, 2023

Add implementation for rsyslog_logging_configured rule

694f798

Add oval checks for the rsyslog_logging_configured rule - based on CIS specification for 'Ensure logging is configured' - add warning on the nature and automation of the rule

teacup-on-rockingchair force-pushed the add_rsyslog_logging_configured branch from 47c7543 to 694f798 Compare February 15, 2023 07:55

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Feb 15, 2023

teacup-on-rockingchair marked this pull request as ready for review February 15, 2023 07:56

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Feb 15, 2023

marcusburghardt requested changes Feb 17, 2023

View reviewed changes

...ide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_logging_configured/rule.yml Outdated Show resolved Hide resolved

teacup-on-rockingchair and others added 2 commits February 20, 2023 01:47

Update linux_os/guide/system/logging/ensure_rsyslog_log_file_configur…

8176618

…ation/rsyslog_logging_configured/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>

Limit the rule to SLE platforms only

ee4f4a5

marcusburghardt approved these changes Feb 20, 2023

View reviewed changes

marcusburghardt merged commit f743fd6 into ComplianceAsCode:master Feb 20, 2023

Mab879 added this to the 0.1.67 milestone Mar 24, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add implementation for rsyslog_logging_configured rule #10063

Add implementation for rsyslog_logging_configured rule #10063

teacup-on-rockingchair commented Jan 15, 2023

openshift-ci bot commented Jan 15, 2023

github-actions bot commented Jan 15, 2023 •

edited

Loading

marcusburghardt left a comment

marcusburghardt Jan 31, 2023

marcusburghardt Feb 14, 2023

teacup-on-rockingchair commented Feb 14, 2023 •

edited

Loading

marcusburghardt commented Feb 14, 2023

github-actions bot commented Feb 15, 2023 •

edited

Loading

marcusburghardt left a comment

codeclimate bot commented Feb 20, 2023

Add implementation for rsyslog_logging_configured rule #10063

Add implementation for rsyslog_logging_configured rule #10063

Conversation

teacup-on-rockingchair commented Jan 15, 2023

Description:

Rationale:

openshift-ci bot commented Jan 15, 2023

github-actions bot commented Jan 15, 2023 • edited Loading

marcusburghardt left a comment

Choose a reason for hiding this comment

marcusburghardt Jan 31, 2023

Choose a reason for hiding this comment

marcusburghardt Feb 14, 2023

Choose a reason for hiding this comment

teacup-on-rockingchair commented Feb 14, 2023 • edited Loading

marcusburghardt commented Feb 14, 2023

github-actions bot commented Feb 15, 2023 • edited Loading

marcusburghardt left a comment

Choose a reason for hiding this comment

codeclimate bot commented Feb 20, 2023

github-actions bot commented Jan 15, 2023 •

edited

Loading

teacup-on-rockingchair commented Feb 14, 2023 •

edited

Loading

github-actions bot commented Feb 15, 2023 •

edited

Loading