Add bash and ansible remediation for rsyslog_remote_tls #9484

teacup-on-rockingchair · 2022-09-06T17:33:06Z

Description:

Add bash and ansible remediation scripts for rsyslog_remote_tls rule

Rationale:

Scripts make sure the rsyslog config will contain StreamDriver=gtls

openshift-ci · 2022-09-06T17:33:17Z

Hi @teacup-on-rockingchair. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2022-09-06T17:33:59Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2022-09-06T17:38:37Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls'.
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_tls'.

jan-cerny · 2022-09-08T12:20:42Z

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/bash/shared.sh

+# strategy = configure
+# complexity = low
+# disruption = low
+


The CI fail looks legit:

116/274 Test #117: fedora-bash-shellcheck ................................................***Failed 15.90 sec In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 9: rsyslog_remote_loghost_address='(bash-populate rsyslog_remote_loghost_address)' ^----------------------------^ SC2034: rsyslog_remote_loghost_address appears unused. Verify use (or export if used externally). In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 16: if [! -z "$OMFWD_CONFIG" ]; then ^-- SC1035: You need a space after the [ and before the ]. In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 17: OMFWD_TLS_STREAM=`grep ' StreamDriver="gtls" ' "$OMFWD_CONFIG"` ^--------------^ SC2034: OMFWD_TLS_STREAM appears unused. Verify use (or export if used externally). In /__w/content/content/build/fedora/fixes/bash/rsyslog_remote_tls.sh line 18: if [! -z "!OMFWD_TLS_STREAM" ]; then ^-- SC1035: You need a space after the [ and before the ]. ^---------------^ SC2157: Argument to -z is always false due to literal strings. For more information: https://www.shellcheck.net/wiki/SC1035 -- You need a space after the [ and ... https://www.shellcheck.net/wiki/SC2157 -- Argument to -z is always false du... https://www.shellcheck.net/wiki/SC2034 -- OMFWD_TLS_STREAM appears unused. ...

Should be ok in 79dfba1

jan-cerny · 2022-09-08T12:27:05Z

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/bash/shared.sh

+        sed -i 's/action\s*(\s*type\s*=\s*"omfwd"/action(type="omfwd"\ StreamDriver="gtls"\ /' $OMFWD_CONFIG_FILE
+    fi
+else
+    echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"{{ rsyslog_remote_loghost_address }}\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")"  >> /etc/rsyslog.conf


Instead of Jinja variable here you need to use the bash variable that you created by Jinja macro on line 7.

Suggested change

echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"{{ rsyslog_remote_loghost_address }}\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf

echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"$rsyslog_remote_loghost_address\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf

Thx should be ok in 6453b4d

jan-cerny · 2022-09-08T12:31:37Z

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/bash/shared.sh

+# Get omfwd configuration directive
+OMFWD_CONFIG_OUTPUT=`grep -Pzo '(?s)action\s*\(\s*type\s*=\s*"omfwd".*\)' /etc/rsyslog.conf /etc/rsyslog.d/*.conf`
+OMFWD_CONFIG=`echo "$OMFWD_CONFIG_OUTPUT"| awk 'BEGIN {FS=":"; RS=")\n"}; {print $2}'`
+OMFWD_CONFIG_FILE=`echo OMFWD_CONFIG_OUTPUT| awk 'BEGIN {FS=":"; RS=")\n"}; {print $1}'`


probably a missing $ before OFMD_CONFIG_OUTPUT

🙇 should be ok in 79dfba1

jan-cerny · 2022-09-15T09:23:52Z

linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/ansible/shared.yml

+  register: include_omfwd_config_output
+
+- name: "Get include files directives"
+  shell: "echo \"{{ include_omfwd_config_output.stdout }}\"|grep  'StreamDriver=\"gtls\"'"


It should probably be:

shell: > set -o pipefail echo \"{{ include_omfwd_config_output.stdout }}\" | grep 'StreamDriver=\"gtls\"'

because there is this in Ansible lint:

risky-shell-pipe: Shells that use pipes should set the pipefail option build/ansible_roles/rhel8_anssi_bp28_intermediary/tasks/main.yml:5832 Task/Handler: Get include files directives Error: risky-shell-pipe Shells that use pipes should set the pipefail option

Should be ok in 8e4a9f8

@jan-cerny

…hanks to @jan-cerny for the note

@jan-cerny

Thanks to @jan-cerny for the note

codeclimate · 2022-09-22T06:28:47Z

Code Climate has analyzed commit 8e4a9f8 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 40.5% (0.0% change).

View more on Code Climate.

jan-cerny

The CI fail isn't happening anymore.

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Sep 6, 2022

jan-cerny self-assigned this Sep 8, 2022

jan-cerny requested changes Sep 8, 2022

View reviewed changes

jan-cerny added Ansible Ansible remediation update. Bash Bash remediation update. labels Sep 8, 2022

teacup-on-rockingchair force-pushed the rsyslog_remote_tls_remediation branch from 9be15a5 to 79dfba1 Compare September 14, 2022 07:48

jan-cerny requested changes Sep 15, 2022

View reviewed changes

teacup-on-rockingchair added 4 commits September 22, 2022 08:49

Add bash and ansible remediation for rsyslog_remote_tls

7bc55e4

Drop unnecessary and wrong extra whitespaces

2673735

Use bash variable rsyslog_remote_loghost_address instead of jinja - t…

945274c

…hanks to @jan-cerny for the note

Fix ansible lint warning

8e4a9f8

Thanks to @jan-cerny for the note

teacup-on-rockingchair force-pushed the rsyslog_remote_tls_remediation branch from 6453b4d to 8e4a9f8 Compare September 22, 2022 05:49

jan-cerny added this to the 0.1.65 milestone Sep 26, 2022

jan-cerny approved these changes Sep 26, 2022

View reviewed changes

jan-cerny merged commit 8ee0745 into ComplianceAsCode:master Sep 26, 2022

vojtapolasek mentioned this pull request Oct 4, 2022

rule rsyslog_remote_tls fails after kickstart installation #9623

Closed

teacup-on-rockingchair mentioned this pull request Jan 27, 2023

Request Merge Rights #10130

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add bash and ansible remediation for rsyslog_remote_tls #9484

Add bash and ansible remediation for rsyslog_remote_tls #9484

teacup-on-rockingchair commented Sep 6, 2022

openshift-ci bot commented Sep 6, 2022

github-actions bot commented Sep 6, 2022

github-actions bot commented Sep 6, 2022

jan-cerny Sep 8, 2022

teacup-on-rockingchair Sep 14, 2022

jan-cerny Sep 8, 2022

teacup-on-rockingchair Sep 14, 2022

jan-cerny Sep 8, 2022

teacup-on-rockingchair Sep 14, 2022

jan-cerny Sep 15, 2022

teacup-on-rockingchair Sep 22, 2022

codeclimate bot commented Sep 22, 2022

jan-cerny left a comment

	echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"{{ rsyslog_remote_loghost_address }}\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf
	echo "action(type=\"omfwd\" protocol=\"tcp\" Target=\"$rsyslog_remote_loghost_address\" port=\"6514\" StreamDriver=\"gtls\" StreamDriverMode=\"1\" StreamDriverAuthMode=\"x509/name\" streamdriver.CheckExtendedKeyPurpose=\"on\")" >> /etc/rsyslog.conf

Add bash and ansible remediation for rsyslog_remote_tls #9484

Add bash and ansible remediation for rsyslog_remote_tls #9484

Conversation

teacup-on-rockingchair commented Sep 6, 2022

Description:

Rationale:

openshift-ci bot commented Sep 6, 2022

github-actions bot commented Sep 6, 2022

github-actions bot commented Sep 6, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codeclimate bot commented Sep 22, 2022

jan-cerny left a comment

Choose a reason for hiding this comment