-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
New rules to complete CIS requirements for SSH Keys #10552
Conversation
The Bash and Ansible remediation generated by the file_owner and file_groupowner templates were including many unnecessary blank lines at the beginning of the resulted remediations due to the way the jinja2 lines were declared. It was fixed to remove the unnecessary spaces at the beginning.
The id attribute was included by product so new templated rules using the file_groupowner template can use this attribute more flexibly.
The requirement 5.3.2 for RHEL7 and 5.2.2 for RHEL8 and RHEL9 were updated to automated after the inclusion of new rules related to owner and group-owner of ssh private keys.
The requirement 5.3.3 for RHEL7 and 5.2.3 for RHEL8 and RHEL9 were updated to automated after the inclusion of new rules related to owner and group-owner of ssh public keys.
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership' differs.
--- xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership
+++ xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership
@@ -2,17 +2,11 @@
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
chgrp 0 /sbin/auditctl
-
chgrp 0 /sbin/aureport
-
chgrp 0 /sbin/ausearch
-
chgrp 0 /sbin/autrace
-
chgrp 0 /sbin/auditd
-
chgrp 0 /sbin/rsyslogd
-
chgrp 0 /sbin/augenrules
else
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_audit_tools_ownership' differs.
--- xccdf_org.ssgproject.content_rule_file_audit_tools_ownership
+++ xccdf_org.ssgproject.content_rule_file_audit_tools_ownership
@@ -2,17 +2,11 @@
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
chown 0 /sbin/auditctl
-
chown 0 /sbin/aureport
-
chown 0 /sbin/ausearch
-
chown 0 /sbin/autrace
-
chown 0 /sbin/auditd
-
chown 0 /sbin/rsyslogd
-
chown 0 /sbin/augenrules
else
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/issue
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/issue.net
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/motd
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_issue
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_issue
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/issue
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/issue.net
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_motd
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_motd
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/motd
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
+++ xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
@@ -2,7 +2,6 @@
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
find /etc/audit/ -maxdepth 1 -type f ! -gid 0 -regex '^audit(\.rules|d\.conf)$' -exec chgrp 0 {} \;
-
find /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0 -regex '^.*\.rules$' -exec chgrp 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/group-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/gshadow-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/passwd-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/shadow-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/group
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/gshadow
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/passwd
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
@@ -1,4 +1 @@
-
-
-
chgrp 0 /etc/shadow
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/group-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/gshadow-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/passwd-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/shadow-
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_group
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/group
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/gshadow
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/passwd
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_shadow
@@ -1,4 +1 @@
-
-
-
chown 0 /etc/shadow
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_var_log' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_var_log
+++ xccdf_org.ssgproject.content_rule_file_groupowner_var_log
@@ -1,4 +1 @@
-
-
-
find -H /var/log/ -maxdepth 1 -type d -exec chgrp 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages
+++ xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages
@@ -1,4 +1 @@
-
-
-
chgrp 0 /var/log/messages
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog
+++ xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog
@@ -1,4 +1 @@
-
-
-
chgrp 4 /var/log/syslog
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_var_log' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_var_log
+++ xccdf_org.ssgproject.content_rule_file_owner_var_log
@@ -1,4 +1 @@
-
-
-
find -H /var/log/ -maxdepth 1 -type d -exec chown 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_var_log_messages' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_var_log_messages
+++ xccdf_org.ssgproject.content_rule_file_owner_var_log_messages
@@ -1,4 +1 @@
-
-
-
chown 0 /var/log/messages
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog
+++ xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog
@@ -1,4 +1 @@
-
-
-
chown 104 /var/log/syslog
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs' differs.
--- xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs
+++ xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs
@@ -1,10 +1,4 @@
-
-
-
find -H /lib/ -type d -exec chgrp 0 {} \;
-
find -H /lib64/ -type d -exec chgrp 0 {} \;
-
find -H /usr/lib/ -type d -exec chgrp 0 {} \;
-
find -H /usr/lib64/ -type d -exec chgrp 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs' differs.
--- xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs
+++ xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs
@@ -1,14 +1,6 @@
-
-
-
find -H /bin/ -type d -exec chown 0 {} \;
-
find -H /sbin/ -type d -exec chown 0 {} \;
-
find -H /usr/bin/ -type d -exec chown 0 {} \;
-
find -H /usr/sbin/ -type d -exec chown 0 {} \;
-
find -H /usr/local/bin/ -type d -exec chown 0 {} \;
-
find -H /usr/local/sbin/ -type d -exec chown 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs' differs.
--- xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs
+++ xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs
@@ -1,10 +1,4 @@
-
-
-
find -H /lib/ -type d -exec chown 0 {} \;
-
find -H /lib64/ -type d -exec chown 0 {} \;
-
find -H /usr/lib/ -type d -exec chown 0 {} \;
-
find -H /usr/lib64/ -type d -exec chown 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries
+++ xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries
@@ -1,16 +1,7 @@
-
-
-
chgrp 0 /sbin/auditctl
-
chgrp 0 /sbin/aureport
-
chgrp 0 /sbin/ausearch
-
chgrp 0 /sbin/autrace
-
chgrp 0 /sbin/auditd
-
chgrp 0 /sbin/audispd
-
chgrp 0 /sbin/augenrules
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries
+++ xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries
@@ -1,16 +1,7 @@
-
-
-
chown 0 /sbin/auditctl
-
chown 0 /sbin/aureport
-
chown 0 /sbin/ausearch
-
chown 0 /sbin/autrace
-
chown 0 /sbin/auditd
-
chown 0 /sbin/audispd
-
chown 0 /sbin/augenrules
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_library_dirs' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_library_dirs
+++ xccdf_org.ssgproject.content_rule_file_ownership_library_dirs
@@ -1,5 +1,3 @@
-
-
find /lib/ -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;
bash remediation for rule 'xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files' differs.
--- xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
+++ xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
@@ -1,13 +1,8 @@
-
-
find /lib/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
-
find /lib64/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
-
find /usr/lib/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
-
find /usr/lib64/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \; |
Code Climate has analyzed commit 791d47c and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 52.4% (0.0% change). View more on Code Climate. |
I'm waving the automatus tests as they pass locally on a vm. |
I have a suspicion that this is what is causing the fails in I guess the group id for ssh_keys is changing or is different depending on the deployment and we have these hardcoded values: content/products/rhel8/product.yml Line 30 in 0c6b8fb
|
Yes, these IDs don't seem to be so stable as expected. Thanks for #10622 |
Description:
It was introduced new templated rules to satisfy the following CIS requirements for RHEL:
Rationale:
Review Hints:
These are templated rules, so a run of Automatus should be enough.
It is also good to check the generated CIS guide.