Postfix network listening to loopback-only #4832
Conversation
|
@70k10 Thanks for this PR! Can you make the |
| @@ -22,7 +22,11 @@ | |||
|
|
|||
| <ind:textfilecontent54_object id="obj_postfix_network_listening_disabled" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" version="1"> | |||
| <ind:filepath>/etc/postfix/main.cf</ind:filepath> | |||
| <ind:pattern operation="pattern match">^[\s]*inet_interfaces[\s]*=[\s]*localhost[\s]*$</ind:pattern> | |||
| {{% if product == "rhel6" %}} | |||
| <ind:pattern operation="pattern match">^[\s]*inet_interfaces[\s]*=[\s]*(localhost|loopback-only)[\s]*$</ind:pattern> | |||
There was a problem hiding this comment.
Instead of inet_interfaces[\s]*=[\s]*(localhost|loopback-only), let's make this a variable for customization sake.
See linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/rule.yml and linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_flush.var for an example.
There was a problem hiding this comment.
Sure thing, thanks for the reference.
|
@redhatrises Updated the check/remediation with a new variable. I think it is right, but scap-workbench was acting strange so it was hard to tell if the RHEL6 STIG applied the variable properly. I did see my changes in the ds-1.2.xml though. |
| <ind:instance datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
|
|
||
| <ind:textfilecontent54_state id="state_postfix_network_listening_disabled" version="1"> | ||
| <ind:subexpression operation="equals" var_ref="var_postfix_inet_interfaces" /> |
There was a problem hiding this comment.
Probably should add datatype="string" here.
@70k10 IIRC you need to add the datatype to the state. Also, looks like there are conflicts with |
|
@redhatrises I changed the state and fixed up the CCEs. Wasn't exactly sure if the datatype was necessary there as I found another example where that was omitted. |
|
LGTM |
Description:
Add remediation and update the OVAL checks to support loopback-only inet_interface line.
Rationale:
This is a CIS requirement. Also, still accepting localhost for RHEL6 per the RHEL6 STIG so we support both that and CIS for RHEL6/7/8.