Add CIS iptables rules

[dodys]

Description:

• Add new rules:

  • package_ufw_removed
  • package_iptables-persistent_installed
  • packages_iptables-persistent_removed

• Add existing rules to Ubuntu CIS profile:

  • set_iptables_default_rule
  • set_ip6tables_default_rule
  • set_loopback_traffic
  • set_ipv6_loopback_traffic

• Remove Ubuntu from service_iptables_enabled

Rationale:

• Those rules are needed for CIS on Ubuntu 22.04 and/or 20.04.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

ubuntu2004 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_service_iptables_enabled'.
--- xccdf_org.ssgproject.content_rule_service_iptables_enabled
+++ xccdf_org.ssgproject.content_rule_service_iptables_enabled
@@ -396,9 +396,6 @@
 [reference]:
 PR.PT-4
 
-[reference]:
-3.5.3.1.1
-
 [rationale]:
 The iptables service provides the system's host-based firewalling
 capability for IPv4 and ICMP.

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic'.
--- xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic
+++ xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic
@@ -14,6 +14,9 @@
 [reference]:
 Req-1.4.1
 
+[reference]:
+3.5.3.3.2
+
 [rationale]:
 Loopback traffic is generated between processes on machine and is
 typically critical to operation of the system. The loopback interface

New datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic'.
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_ipv6_loopback_traffic'.
New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic'.
--- xccdf_org.ssgproject.content_rule_set_loopback_traffic
+++ xccdf_org.ssgproject.content_rule_set_loopback_traffic
@@ -3,20 +3,20 @@
 Set configuration for loopback traffic
 
 [description]:
-Configure the loopback interface to accept traffic. 
-Configure all other interfaces to deny traffic to the loopback 
+Configure the loopback interface to accept traffic.
+Configure all other interfaces to deny traffic to the loopback
 network.
 
 [warning]:
-Changing firewall settings while connected over network can 
+Changing firewall settings while connected over network can
 result in being locked out of the system.
 
 [reference]:
 Req-1.4.1
 
 [rationale]:
-Loopback traffic is generated between processes on machine and is 
-typically critical to operation of the system. The loopback interface 
-is the only place that loopback network traffic should be seen, all 
+Loopback traffic is generated between processes on machine and is
+typically critical to operation of the system. The loopback interface
+is the only place that loopback network traffic should be seen, all
 other interfaces should ignore traffic on this network as an
 anti-spoofing measure.

OCIL for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic' differs.
--- ocil:ssg-set_loopback_traffic_ocil:questionnaire:1
+++ ocil:ssg-set_loopback_traffic_ocil:questionnaire:1
@@ -1,10 +1,12 @@
-Verify that the loopback interface is configured:
+Run the following commands and verify output:
 
-# nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
+# iptables -L INPUT -v -n | grep lo | grep ACCEPT
 
-If IPv6 is enabled, verify that the IPv6 loopback interface is configured:
 
-# nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
+# iptables -L INPUT -v -n | grep 127.0.0.0\/8 | grep DROP
+
+
+# iptables -L OUTPUT -v -n | grep lo | grep ACCEPT
 
 Is it the case that loopback traffic is not configured?
 
New datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic'.
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_loopback_traffic'.

[Mab879]

Thanks for the PR. There are a couple of items I found during my review.

[codeclimate]

Code Climate has analyzed commit 258dea1 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.5%.

View more on Code Climate.

[Mab879]

Thanks for the PR! Override CODEOWNERS since @dodys can't merge this PR.

[Mab879]

Automatus failures are expected due to the prodtype.