Amazon Linux 2023 Department of War (Previously Department of Defense) STIG #13885
Replies: 12 comments 8 replies
|
Comparison of Similarity in the Fix Text Field of the Checklists....
|
|
Posted similarity analysis above between RHEL 9 and Amazon Linux 2023, as a lot of the STIGs are the same, just written slightly differently. I think it is all Fedora based, would be nice if all the common ones were 100% similarity, but not the case when things are hand jammed. |
|
If you wanted to do the same analysis. Replace "rhel9" and "amazonlinux" with DISA STIG checklists converted to CSV. |
|
I took that same approach to generate this.... I might be able to help more if guided in the right direction.... But, i copied in the highest similarity to RHEL 9 and created placeholders with "pending" status for where similarities do not exist. |
|
I got the profile to build. I think I just need to go through each item to verify it is 100% correct. If this is not something desired here, I can create a fork, or just make a playbook for my own use. Just let me know how to proceed. @Mab879 |
|
Thanks for for the work. Please feel free open PR to get some better feedback. Here few points I found based on a quick look:
|
|
Hi @bordencastle , are you still working on a PR for this? I am happy to attempt it. |
|
Good morning, has this received any progress? |
|
@Mab879 @nessadc @ngearhart I started a PR here The profile runs, down to 12 rules coming back as N/A - still need to go through each check and make sure its doing the right thing |
|
@Mab879 @nessadc @ngearhart @bordencastle I had to make a new PR since it was failing for having a merge request in commit... anyways I could use a hand in reviewing the rules, to test this is somewhat difficult, since AL2023 doesn't have the latest oscap, it needs to be built from source on the remote machine, and then use oscap-ssh to scan/remediate. i was able to get it to ~80%ish green 
Steps to reproducePre-req
On the remote AL2023 VM
On local fedora box
|
|
rsyslog is not installed, authselect is not installed, /boot/efi is vfat which there is a filter in the rule to exclude vfat from applying nosuid, so that one will never work. I did something to fix the authselect install, and rsyslog, but my code doesn't look great yet. Some rules try to apply, but the rules are missing platform filters for al2023. The common theme I see is that things like rsyslog and authselect might just be assumed to exist, when they should verify the rpms are installed prior to attempting to create configs for them, and certainly the platform labels need to be updated to include al2023. --- Starting Remediation ---
Title Build and Test AIDE Database
Rule xccdf_org.ssgproject.content_rule_aide_build_database
Result error
Title Enable Dracut FIPS Module
Rule xccdf_org.ssgproject.content_rule_enable_dracut_fips_module
Result fail
Title Enable FIPS Mode
Rule xccdf_org.ssgproject.content_rule_enable_fips_mode
Result error
Title Set kernel parameter 'crypto.fips_enabled' to 1
Rule xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled
Result fail
Title Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config
Rule xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
Result fail
Title The Installed Operating System Is Vendor Supported
Rule xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported
Result fail
Title Ensure /var/log/audit Located On Separate Partition
Rule xccdf_org.ssgproject.content_rule_partition_for_var_log_audit
Result fail
Title Ensure authselect is Installed
Rule xccdf_org.ssgproject.content_rule_package_authselect_installed
Ident CCE-89733-0
Result fixed
Title Enable authselect
Rule xccdf_org.ssgproject.content_rule_enable_authselect
Result error
Title Ensure remote access methods are monitored in Rsyslog
Rule xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring
Result error
Title Add nosuid Option to /boot/efi
Rule xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid
Result error
Title Enable Auditing for Processes Which Start Prior to the Audit Daemon
Rule xccdf_org.ssgproject.content_rule_grub2_audit_argument
Result error
Title Extend Audit Backlog Limit for the Audit Daemon
Rule xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument
Result error
Title Record Any Attempts to Run chcon
Rule xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon
Result error
Title Record Any Attempts to Run semanage
Rule xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage
Result error
Title Ensure auditd Collects Information on the Use of Privileged Commands - init
Rule xccdf_org.ssgproject.content_rule_audit_privileged_commands_init
Result error
Title Ensure auditd Collects Information on the Use of Privileged Commands - reboot
Rule xccdf_org.ssgproject.content_rule_audit_privileged_commands_reboot
Result error
Title Ensure auditd Collects Information on the Use of Privileged Commands - shutdown
Rule xccdf_org.ssgproject.content_rule_audit_privileged_commands_shutdown
Result error
Title Ensure auditd Collects Information on the Use of Privileged Commands - chage
Rule xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage
Result error
Title Ensure auditd Collects Information on the Use of Privileged Commands - kmod
Rule xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod
Result error
Title Ensure auditd Collects Information on the Use of Privileged Commands - sudo
Rule xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo
Result error |
|
It appears these parts need to be redone after you enable FIPS on the server you are running remediations on as well.... Build oscap from source |
|
@Eric-Domeier Eric-Domeier#2 |
|
Rename the extension back to .cklb to see in STIG viewer. As a systems administrator, I would be redoing the audit rules if not exact, as they would get flagged by scanning tools, but I'm not sure what the overall theory is with openscap and using the shared rules/templates. The remaining things are around those audit rules not being exact, some rsyslog config, authselect/pam settings. I added in some of the comments "key: line-duplicated", where it is not necessarily a finding, but it would be better if the addition of the setting uncommented and used the existing line instead of creating a duplicate line. As far as audit rules in general, I know for RHEL 9 that part of the ansible playbook ran for 45 minutes. I think it would be more ideal to have OS specific applications for the rules where it's not doing all this querying of shared audit rules. If you did that the playbooks could run in 2-3 minutes to configure audit rules, or you could have something like 1 jinja template to do them all, or 1 per OS where it isn't going through 100's of ansible tasks to provision a few files on any given OS. |
|
@bordencastle I worked on this a bit before I realized you had put a PR in, I attempted to merge ours together here Something may have gone wrong while merging ours together as the number of rules that are applicable went down slightly. With my latest changes merged into the current PR its looking pretty good with 158 not a finding, 16 NR's and 7 Opens. I believe my changes have fixed the issues you were running into with the audit rules not being applied. As for how long it takes to run the ansible version of the fixes, I use the bash typically it is only taking ~5 minutes for a scan+remediate, will keep working when i get a chance |
|
Looking a bit better now. 167 rules successfully remediate/scan Here are the current errors/fails
|
|
@Eric-Domeier Nice work, and thanks for spending your weekend working hard on this. I added some comments for the stuff I previously fixed to your merge request. |
|
This is great work! It looks like the PR is basically ready to merge with some minor formatting changes. Is there anything you need help with? |
Uh oh!
There was an error while loading. Please reload this page.
Share the context
DISA Released Version 1 Release 1 of the Amazon Linux 2023 DoD STIG yesterday 09/04/2025
Description of problem:
It would be good to integrate this into complianceascode content.
Proposed change:
Add Amazon Linux 2023 DISA STIG to complianceascode content.
References:
All reactions