Skip to content

Commit 50e28b5

Browse files
atomic111atomic111
authored
Merge pull request #44 from juju4/master
essay: differentiate redhat/debian, add extra conditions
2 parents b4fd1b3 + f5f905d commit 50e28b5

File tree

4 files changed

+164
-49
lines changed

4 files changed

+164
-49
lines changed

‎Rakefile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#!/usr/bin/env rake
2-
# encoding: utf-8
32

43
require 'rake/testtask'
54
require 'rubocop/rake_task'

‎controls/os_spec.rb‎

Lines changed: 109 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# encoding: utf-8
21
#
32
# Copyright 2015, Patrick Muench
43
#
@@ -18,6 +17,62 @@
1817
# author: Dominik Richter
1918
# author: Patrick Muench
2019

20+
login_defs_umask = attribute('login_defs_umask', default: '027', description: 'Default umask to set in login.defs')
21+
login_defs_passmaxdays = attribute('login_defs_passmaxdays', default: '60', description: 'Default password maxdays to set in login.defs')
22+
login_defs_passmindays = attribute('login_defs_passmindays', default: '7', description: 'Default password mindays to set in login.defs')
23+
login_defs_passwarnage = attribute('login_defs_passwarnage', default: '7', description: 'Default password warnage (days) to set in login.defs')
24+
if os.redhat?
25+
shadow_group = 'root'
26+
elsif os.debian?
27+
shadow_group = 'shadow'
28+
end
29+
blacklist = attribute(
30+
'blacklist',
31+
default: [
32+
# blacklist as provided by NSA
33+
'/usr/bin/rcp', '/usr/bin/rlogin', '/usr/bin/rsh',
34+
# sshd must not use host-based authentication (see ssh cookbook)
35+
'/usr/libexec/openssh/ssh-keysign',
36+
'/usr/lib/openssh/ssh-keysign',
37+
# misc others
38+
'/sbin/netreport', # not normally required for user
39+
'/usr/sbin/usernetctl', # modify interfaces via functional accounts
40+
# connecting to ...
41+
'/usr/sbin/userisdnctl', # no isdn...
42+
'/usr/sbin/pppd', # no ppp / dsl ...
43+
# lockfile
44+
'/usr/bin/lockfile',
45+
'/usr/bin/mail-lock',
46+
'/usr/bin/mail-unlock',
47+
'/usr/bin/mail-touchlock',
48+
'/usr/bin/dotlockfile',
49+
# need more investigation, blacklist for now
50+
'/usr/bin/arping',
51+
'/usr/sbin/arping',
52+
'/usr/sbin/uuidd',
53+
'/usr/bin/mtr', # investigate current state...
54+
'/usr/lib/evolution/camel-lock-helper-1.2', # investigate current state...
55+
'/usr/lib/pt_chown', # pseudo-tty, needed?
56+
'/usr/lib/eject/dmcrypt-get-device',
57+
'/usr/lib/mc/cons.saver' # midnight commander screensaver
58+
# from Ubuntu xenial, need to investigate
59+
# '/sbin/unix_chkpwd',
60+
# '/sbin/pam_extrausers_chkpwd',
61+
# '/usr/lib/x86_64-linux-gnu/utempter/utempter',
62+
# '/usr/sbin/postdrop',
63+
# '/usr/sbin/postqueue',
64+
# '/usr/bin/ssh-agent',
65+
# '/usr/bin/mlocate',
66+
# '/usr/bin/crontab',
67+
# '/usr/bin/screen',
68+
# '/usr/bin/expiry',
69+
# '/usr/bin/wall',
70+
# '/usr/bin/chage',
71+
# '/usr/bin/bsd-write'
72+
],
73+
description: 'blacklist of suid/sgid program on system'
74+
)
75+
2176
control 'os-01' do
2277
impact 1.0
2378
title 'Trusted hosts login'
@@ -38,13 +93,21 @@
3893
it { should exist }
3994
it { should be_file }
4095
it { should be_owned_by 'root' }
41-
its('group') { should eq 'root' }
96+
its('group') { should eq shadow_group }
4297
it { should_not be_executable }
4398
it { should be_writable.by('owner') }
4499
it { should be_readable.by('owner') }
45-
it { should_not be_readable.by('group') }
46100
it { should_not be_readable.by('other') }
47101
end
102+
if os.redhat?
103+
describe file('/etc/shadow') do
104+
it { should_not be_readable.by('group') }
105+
end
106+
elsif os.debian?
107+
describe file('/etc/shadow') do
108+
it { should be_readable.by('group') }
109+
end
110+
end
48111
end
49112

50113
control 'os-03' do
@@ -86,27 +149,38 @@
86149
it { should be_owned_by 'root' }
87150
its('group') { should eq 'root' }
88151
it { should_not be_executable }
89-
it { should_not be_writable }
90152
it { should be_readable.by('owner') }
91153
it { should be_readable.by('group') }
92154
it { should be_readable.by('other') }
93155
end
94156
describe login_defs do
95157
its('ENV_SUPATH') { should include('/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin') }
96158
its('ENV_PATH') { should include('/usr/local/bin:/usr/bin:/bin') }
97-
its('UMASK') { should include('027') }
98-
its('PASS_MAX_DAYS') { should eq '60' }
99-
its('PASS_MIN_DAYS') { should eq '7' }
100-
its('PASS_WARN_AGE') { should eq '7' }
159+
its('UMASK') { should include(login_defs_umask) }
160+
its('PASS_MAX_DAYS') { should eq login_defs_passmaxdays }
161+
its('PASS_MIN_DAYS') { should eq login_defs_passmindays }
162+
its('PASS_WARN_AGE') { should eq login_defs_passwarnage }
101163
its('LOGIN_RETRIES') { should eq '5' }
102164
its('LOGIN_TIMEOUT') { should eq '60' }
103165
its('UID_MIN') { should eq '1000' }
104166
its('GID_MIN') { should eq '1000' }
105-
its('SYS_UID_MIN') { should eq '100' }
106-
its('SYS_UID_MAX') { should eq '999' }
107-
its('SYS_GID_MIN') { should eq '100' }
108-
its('SYS_GID_MAX') { should eq '999' }
109-
its('ENCRYPT_METHOD') { should eq 'SHA512' }
167+
end
168+
end
169+
170+
control 'os-05b' do
171+
impact 1.0
172+
title 'Check login.defs - RedHat specific'
173+
desc 'Check owner and permissions for login.defs. Also check the configured PATH variable and umask in login.defs'
174+
if os.redhat?
175+
describe file('/etc/login.defs') do
176+
it { should_not be_writable }
177+
end
178+
describe login_defs do
179+
its('SYS_UID_MIN') { should eq '100' }
180+
its('SYS_UID_MAX') { should eq '999' }
181+
its('SYS_GID_MIN') { should eq '100' }
182+
its('SYS_GID_MAX') { should eq '999' }
183+
end
110184
end
111185
end
112186

@@ -115,36 +189,7 @@
115189
title 'Check for SUID/ SGID blacklist'
116190
desc 'Find blacklisted SUID and SGID files to ensure that no rogue SUID and SGID files have been introduced into the system'
117191

118-
blacklist = [
119-
# blacklist as provided by NSA
120-
'/usr/bin/rcp', '/usr/bin/rlogin', '/usr/bin/rsh',
121-
# sshd must not use host-based authentication (see ssh cookbook)
122-
'/usr/libexec/openssh/ssh-keysign',
123-
'/usr/lib/openssh/ssh-keysign',
124-
# misc others
125-
'/sbin/netreport', # not normally required for user
126-
'/usr/sbin/usernetctl', # modify interfaces via functional accounts
127-
# connecting to ...
128-
'/usr/sbin/userisdnctl', # no isdn...
129-
'/usr/sbin/pppd', # no ppp / dsl ...
130-
# lockfile
131-
'/usr/bin/lockfile',
132-
'/usr/bin/mail-lock',
133-
'/usr/bin/mail-unlock',
134-
'/usr/bin/mail-touchlock',
135-
'/usr/bin/dotlockfile',
136-
# need more investigation, blacklist for now
137-
'/usr/bin/arping',
138-
'/usr/sbin/arping',
139-
'/usr/sbin/uuidd',
140-
'/usr/bin/mtr', # investigate current state...
141-
'/usr/lib/evolution/camel-lock-helper-1.2', # investigate current state...
142-
'/usr/lib/pt_chown', # pseudo-tty, needed?
143-
'/usr/lib/eject/dmcrypt-get-device',
144-
'/usr/lib/mc/cons.saver' # midnight commander screensaver
145-
]
146-
147-
output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' -print 2>/dev/null | grep -v \'^find:\'')
192+
output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' ! -path \'/var/lib/lxd/containers/*\' -print 2>/dev/null | grep -v \'^find:\'')
148193
diff = output.stdout.split(/\r?\n/) & blacklist
149194
describe diff do
150195
it { should be_empty }
@@ -162,3 +207,24 @@
162207
its('gids') { should_not contain_duplicates }
163208
end
164209
end
210+
211+
control 'os-08' do
212+
impact 1.0
213+
title 'Entropy'
214+
desc 'Check system has enough entropy - greater than 1000'
215+
describe file('/proc/sys/kernel/random/entropy_avail').content.to_i do
216+
it { should >= 1000 }
217+
end
218+
end
219+
220+
control 'os-09' do
221+
impact 1.0
222+
title 'Check for .rhosts and .netrc file'
223+
desc 'Find .rhosts and .netrc files - CIS Benchmark 9.2.9-10'
224+
225+
output = command('find / \( -iname .rhosts -o -iname .netrc \) -print 2>/dev/null | grep -v \'^find:\'')
226+
out = output.stdout.split(/\r?\n/)
227+
describe out do
228+
it { should be_empty }
229+
end
230+
end

‎controls/package_spec.rb‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# encoding: utf-8
21
#
32
# Copyright 2015, Patrick Muench
43
#
@@ -18,6 +17,8 @@
1817
# author: Dominik Richter
1918
# author: Patrick Muench
2019

20+
val_syslog_pkg = attribute('syslog_pkg', default: 'rsyslog', description: 'syslog package to ensure present (default: rsyslog, alternative: syslog-ng...')
21+
2122
control 'package-01' do
2223
impact 1.0
2324
title 'Do not run deprecated inetd or xinetd'
@@ -65,3 +66,37 @@
6566
it { should_not be_installed }
6667
end
6768
end
69+
70+
control 'package-07' do
71+
impact 1.0
72+
title 'Install syslog server package'
73+
desc 'Syslog server is required to receive system and applications logs'
74+
describe package(val_syslog_pkg) do
75+
it { should be_installed }
76+
end
77+
end
78+
79+
control 'package-08' do
80+
impact 1.0
81+
title 'Install auditd'
82+
desc 'auditd provides extended logging capacities on recent distribution'
83+
describe package('auditd') do
84+
it { should be_installed }
85+
end
86+
describe auditd_conf do
87+
its('log_file') { should cmp '/var/log/audit/audit.log' }
88+
its('log_format') { should cmp 'raw' }
89+
its('flush') { should cmp 'INCREMENTAL' }
90+
its('freq') { should cmp 20 }
91+
its('num_logs') { should cmp 5 }
92+
its('max_log_file') { should cmp 6 }
93+
its('max_log_file_action') { should cmp 'ROTATE' }
94+
its('space_left') { should cmp 75 }
95+
its('action_mail_acct') { should cmp 'root' }
96+
its('space_left_action') { should cmp 'SYSLOG' }
97+
its('admin_space_left') { should cmp 50 }
98+
its('admin_space_left_action') { should cmp 'SUSPEND' }
99+
its('disk_full_action') { should cmp 'SUSPEND' }
100+
its('disk_error_action') { should cmp 'SUSPEND' }
101+
end
102+
end

‎controls/sysctl_spec.rb‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# encoding: utf-8
21
#
32
# Copyright 2015, Patrick Muench
43
#
@@ -18,6 +17,8 @@
1817
# author: Dominik Richter
1918
# author: Patrick Muench
2019

20+
sysctl_forwarding = attribute('sysctl_forwarding', default: false, description: 'Is network forwarding needed?')
21+
2122
control 'sysctl-01' do
2223
impact 1.0
2324
title 'IPv4 Forwarding'
@@ -28,6 +29,7 @@
2829
describe kernel_parameter('net.ipv4.conf.all.forwarding') do
2930
its(:value) { should eq 0 }
3031
end
32+
only_if { sysctl_forwarding == false }
3133
end
3234

3335
control 'sysctl-02' do
@@ -317,11 +319,24 @@
317319

318320
control 'sysctl-31' do
319321
impact 1.0
320-
title 'Disable Core Dumps'
321-
desc 'Ensure that core dumps can never be made by setuid programs'
322+
title 'Secure Core Dumps'
323+
desc 'Ensure that core dumps can never be made by setuid programs or with fully qualified path'
324+
322325
describe kernel_parameter('fs.suid_dumpable') do
323-
its(:value) { should eq 0 }
326+
## those are not valid. how to?
327+
# its(:value) { should eq 0 or should eq 2 }
328+
# its(:value) { should match /[02]/ }
329+
# its(:value) { should match /0|2/ }
330+
its(:value) { should eq 2 }
331+
end
332+
# unless kernel_parameter('fs.suid_dumpable') == 2
333+
# describe kernel_parameter('fs.suid_dumpable') do
334+
# its(:value) { should eq 2 }
335+
# end
336+
describe kernel_parameter('kernel.core_pattern') do
337+
its(:value) { should match %r{^/.*} }
324338
end
339+
# end
325340
end
326341

327342
control 'sysctl-32' do

0 commit comments

Comments
 (0)