diff --git a/controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml b/controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml index 01db90c330a1..5c0a86270d3d 100644 --- a/controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml +++ b/controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml @@ -77,4 +77,5 @@ controls: - grub2_audit_argument - service_auditd_enabled - package_audit_installed + - audit_rules_privileged_commands_useradd status: automated diff --git a/controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml b/controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml index 9cfca1b33bb8..4560debb0cd2 100644 --- a/controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml +++ b/controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml @@ -70,4 +70,5 @@ controls: - audit_rules_usergroup_modification_passwd - audit_rules_usergroup_modification_shadow - grub2_audit_argument + - audit_rules_privileged_commands_useradd status: automated diff --git a/controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml b/controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml index a4cdb8c3e41c..8e133977b6a3 100644 --- a/controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml +++ b/controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml @@ -75,4 +75,5 @@ controls: - grub2_audit_argument - package_audit_installed - service_auditd_enabled + - audit_rules_privileged_commands_useradd status: automated diff --git a/controls/srg_gpos/SRG-OS-000250-GPOS-00093.yml b/controls/srg_gpos/SRG-OS-000250-GPOS-00093.yml index 0bfb4940b07c..256e38dadff6 100644 --- a/controls/srg_gpos/SRG-OS-000250-GPOS-00093.yml +++ b/controls/srg_gpos/SRG-OS-000250-GPOS-00093.yml @@ -11,6 +11,7 @@ controls: - harden_sshd_ciphers_opensshserver_conf_crypto_policy - harden_sshd_macs_openssh_conf_crypto_policy - harden_sshd_macs_opensshserver_conf_crypto_policy + - configure_openssl_crypto_policy - sshd_approved_ciphers=stig_rhel9 - sshd_approved_macs=stig_rhel9 status: automated diff --git a/controls/srg_gpos/SRG-OS-000392-GPOS-00172.yml b/controls/srg_gpos/SRG-OS-000392-GPOS-00172.yml index c11515b50abb..1bf942a827f4 100644 --- a/controls/srg_gpos/SRG-OS-000392-GPOS-00172.yml +++ b/controls/srg_gpos/SRG-OS-000392-GPOS-00172.yml @@ -81,4 +81,5 @@ controls: - grub2_audit_argument - service_auditd_enabled - package_audit_installed + - audit_rules_privileged_commands_useradd status: automated diff --git a/controls/srg_gpos/SRG-OS-000462-GPOS-00206.yml b/controls/srg_gpos/SRG-OS-000462-GPOS-00206.yml index e820ba8462b2..764b0484a8d1 100644 --- a/controls/srg_gpos/SRG-OS-000462-GPOS-00206.yml +++ b/controls/srg_gpos/SRG-OS-000462-GPOS-00206.yml @@ -71,4 +71,5 @@ controls: - audit_rules_usergroup_modification_passwd - audit_rules_usergroup_modification_shadow - grub2_audit_argument + - audit_rules_privileged_commands_useradd status: automated diff --git a/controls/srg_gpos/SRG-OS-000466-GPOS-00210.yml b/controls/srg_gpos/SRG-OS-000466-GPOS-00210.yml index 1b6941784e34..b3bc28c8db7b 100644 --- a/controls/srg_gpos/SRG-OS-000466-GPOS-00210.yml +++ b/controls/srg_gpos/SRG-OS-000466-GPOS-00210.yml @@ -32,4 +32,5 @@ controls: - audit_rules_usergroup_modification_gshadow - audit_rules_usergroup_modification_passwd - audit_rules_usergroup_modification_shadow + - audit_rules_privileged_commands_useradd status: automated diff --git a/controls/srg_gpos/SRG-OS-000471-GPOS-00215.yml b/controls/srg_gpos/SRG-OS-000471-GPOS-00215.yml index eeded1ba694e..97024b73afc1 100644 --- a/controls/srg_gpos/SRG-OS-000471-GPOS-00215.yml +++ b/controls/srg_gpos/SRG-OS-000471-GPOS-00215.yml @@ -73,4 +73,5 @@ controls: - audit_rules_usergroup_modification_passwd - audit_rules_usergroup_modification_shadow - grub2_audit_argument + - audit_rules_privileged_commands_useradd status: automated diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/policy/stig/rhel10.yml index e96f68bc542e..1e9a9fe54fd0 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/policy/stig/rhel10.yml @@ -2,21 +2,24 @@ srg_requirement: |- {{{ full_name }}} must generate audit records for successful and unsuccessful uses of the "gpasswd" command. fixtext: |- - Configure {{{ full_name }}} to generate audit records upon successful and unsuccessful attempts to use the "gpasswd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": + Configure {{{ full_name }}} to generate audit records upon successful and unsuccessful attempts to use the "gpasswd" command by adding or updating the following rules in "/etc/audit/rules.d/audit.rules": - -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-gpasswd + -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd + -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd - Restart the audit daemon with the following command for the changes to take effect: + To load the rules to the kernel immediately, use the following command: - $ sudo service auditd restart + $ sudo augenrules --load checktext: |- - Verify {{{ full_name }}} is configured to audit the execution of the "gpasswd" command with the following command: + Verify {{{ full_name }}} generates audit records for the execution of the "gpasswd" command with the following command: - $ sudo auditctl -l | grep gpasswd - -a always,exit -S all -F path=/usr/bin/gpasswd -F perm=x -F auid>={{{ uid_min }}} -F auid!=-1 -F key=privileged-gpasswd + $ sudo auditctl -l | grep '/usr/bin/gpasswd' - If the command does not return a line, or the line is commented out, this is a finding. + -a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -F key=privileged-gpasswd + -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -F key=privileged-gpasswd + + If the command does not return these lines, or the lines are commented out, this is a finding. vuldiscussion: |- Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml index adb9d3efced6..7348e708379d 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml @@ -51,3 +51,5 @@ template: name: audit_rules_privileged_commands vars: path: /usr/bin/gpasswd + key@rhel10: privileged-gpasswd + rhel10_stig_arch_mode@rhel10: 'true' diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/tests/rhel10_auditctl_with_execve.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/tests/rhel10_auditctl_with_execve.fail.sh new file mode 100644 index 000000000000..bb366f41e1a3 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/tests/rhel10_auditctl_with_execve.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = audit +# Writes the rules with the '-S execve' filter, the shape the RHEL 9 STIG prescribes; the RHEL 10 required rules have no syscall filter, so the scan must fail and the remediation must rewrite them into the plain form (the RHEL 9 to RHEL 10 upgrade case). + +{{{ setup_auditctl_environment() }}} + +echo "-a always,exit -F arch=b32 -S execve -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd" >> /etc/audit/audit.rules +echo "-a always,exit -F arch=b64 -S execve -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd" >> /etc/audit/audit.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/tests/rhel10_augenrules_with_execve.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/tests/rhel10_augenrules_with_execve.fail.sh new file mode 100644 index 000000000000..697b264a902f --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/tests/rhel10_augenrules_with_execve.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = audit +# Writes the rules with the '-S execve' filter, the shape the RHEL 9 STIG prescribes; the RHEL 10 required rules have no syscall filter, so the scan must fail and the remediation must rewrite them into the plain form (the RHEL 9 to RHEL 10 upgrade case). + +rm -f /etc/audit/rules.d/*.rules +truncate -s 0 /etc/audit/audit.rules + +echo "-a always,exit -F arch=b32 -S execve -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd" >> /etc/audit/rules.d/privileged-gpasswd.rules +echo "-a always,exit -F arch=b64 -S execve -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd" >> /etc/audit/rules.d/privileged-gpasswd.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/policy/stig/rhel10.yml index 62fb1646673a..59a0b7f687d8 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/policy/stig/rhel10.yml @@ -2,21 +2,24 @@ srg_requirement: |- {{{ full_name }}} must generate audit records for successful and unsuccessful uses of the "passwd" command. fixtext: |- - Configure {{{ full_name }}} to generate audit records upon successful and unsuccessful attempts to use the "passwd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": + Configure {{{ full_name }}} to generate audit records upon successful and unsuccessful attempts to use the "passwd" command by adding or updating the following rules in "/etc/audit/rules.d/audit.rules": - -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-passwd + -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -k privileged-passwd + -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -k privileged-passwd - Restart the audit daemon with the following command for the changes to take effect: + To load the rules to the kernel immediately, use the following command: - $ sudo service auditd restart + $ sudo augenrules --load checktext: |- - Verify {{{ full_name }}} generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command: + Verify {{{ full_name }}} generates audit records for successful and unsuccessful uses of the "passwd" command with the following command: - $ sudo auditctl -l | egrep '(/usr/bin/passwd)' - -a always,exit -S all -F path=/usr/bin/passwd -F perm=x -F auid>={{{ uid_min }}} -F auid!=-1 -F key=privileged-passwd + $ sudo auditctl -l | grep '/usr/bin/passwd' - If the command does not return a line, or the line is commented out, this is a finding. + -a always,exit -F arch=b32 -F path=/usr/bin/passwd -F perm=x -F key=privileged-passwd + -a always,exit -F arch=b64 -F path=/usr/bin/passwd -F perm=x -F key=privileged-passwd + + If the command does not return these lines, or the lines are commented out, this is a finding. vuldiscussion: |- Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml index bd4f6ead1328..b01284029d39 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml @@ -51,3 +51,5 @@ template: name: audit_rules_privileged_commands vars: path: /usr/bin/passwd + key@rhel10: privileged-passwd + rhel10_stig_arch_mode@rhel10: 'true' diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/tests/rhel10_auditctl_with_execve.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/tests/rhel10_auditctl_with_execve.fail.sh new file mode 100644 index 000000000000..ef2eea78fd6c --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/tests/rhel10_auditctl_with_execve.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = audit +# Writes the rules with the '-S execve' filter, the shape the RHEL 9 STIG prescribes; the RHEL 10 required rules have no syscall filter, so the scan must fail and the remediation must rewrite them into the plain form (the RHEL 9 to RHEL 10 upgrade case). + +{{{ setup_auditctl_environment() }}} + +echo "-a always,exit -F arch=b32 -S execve -F path=/usr/bin/passwd -F perm=x -k privileged-passwd" >> /etc/audit/audit.rules +echo "-a always,exit -F arch=b64 -S execve -F path=/usr/bin/passwd -F perm=x -k privileged-passwd" >> /etc/audit/audit.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/tests/rhel10_augenrules_with_execve.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/tests/rhel10_augenrules_with_execve.fail.sh new file mode 100644 index 000000000000..21d296de81c6 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/tests/rhel10_augenrules_with_execve.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = audit +# Writes the rules with the '-S execve' filter, the shape the RHEL 9 STIG prescribes; the RHEL 10 required rules have no syscall filter, so the scan must fail and the remediation must rewrite them into the plain form (the RHEL 9 to RHEL 10 upgrade case). + +rm -f /etc/audit/rules.d/*.rules +truncate -s 0 /etc/audit/audit.rules + +echo "-a always,exit -F arch=b32 -S execve -F path=/usr/bin/passwd -F perm=x -k privileged-passwd" >> /etc/audit/rules.d/privileged-passwd.rules +echo "-a always,exit -F arch=b64 -S execve -F path=/usr/bin/passwd -F perm=x -k privileged-passwd" >> /etc/audit/rules.d/privileged-passwd.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/policy/stig/rhel10.yml new file mode 100644 index 000000000000..7998ef79682e --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/policy/stig/rhel10.yml @@ -0,0 +1,28 @@ +srg_requirement: |- + {{{ full_name }}} must generate audit records for successful and unsuccessful uses of the "useradd" command. + +fixtext: |- + Configure {{{ full_name }}} to generate audit records upon successful and unsuccessful attempts to use the "useradd" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": + + -a always,exit -F path=/usr/sbin/useradd -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-useradd + + Restart the audit daemon with the following command for the changes to take effect: + + $ sudo service auditd restart + +checktext: |- + Verify {{{ full_name }}} is configured to audit the execution of the "useradd" command with the following command: + + $ sudo auditctl -l | grep useradd + -a always,exit -S all -F path=/usr/sbin/useradd -F perm=x -F auid>={{{ uid_min }}} -F auid!=-1 -F key=privileged-useradd + + If the command does not return a line, or the line is commented out, this is a finding. + +vuldiscussion: |- + Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + + Audit records can be generated from various components within the information system (e.g., module or policy filter). + + When a user logs on, the auid is set to the uid of the account being authenticated. Daemons are not user sessions and have the loginuid set to -1. The auid representation is an unsigned 32-bit integer, which equals 4294967295. The audit system interprets -1, 4294967295, and "unset" in the same way. + + The system call rules are loaded into a matching engine that intercepts each system call made by all programs on the system. Therefore, it is very important to use system call rules only when absolutely necessary because these affect performance. More rules lead to poorer performance. The performance can be helped, however, by combining system calls into one rule whenever possible. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/rule.yml index 10a5aa39cb5a..51555b3f353b 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_useradd/rule.yml @@ -20,6 +20,7 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-86501-4 cce@sle15: CCE-92614-7 cce@slmicro5: CCE-93661-7 @@ -32,3 +33,5 @@ template: name: audit_rules_privileged_commands vars: path: /usr/sbin/useradd + key@rhel10: privileged-useradd + rhel10_stig_single_rule@rhel10: 'true' diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/policy/stig/rhel10.yml index 3b56ee858bcf..64fb5efd8eba 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/policy/stig/rhel10.yml @@ -4,8 +4,8 @@ srg_requirement: |- fixtext: |- Configure {{{ full_name }}} to generate audit records upon successful and unsuccessful attempts to use the "mount" command by adding or updating the following rule in "/etc/audit/rules.d/audit.rules": - -a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export - -a always,exit -F arch=b64 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export + -a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-mount + -a always,exit -F arch=b64 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-mount Restart the audit daemon with the following command for the changes to take effect: @@ -15,8 +15,8 @@ checktext: |- Verify {{{ full_name }}} is configured to audit the execution of the "mount" command with the following command: $ sudo auditctl -l | grep mount - -a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export - -a always,exit -F arch=b64 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export + -a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-mount + -a always,exit -F arch=b64 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k privileged-mount If the command does not return a line, or the line is commented out, this is a finding. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml index 0ef47e42cb98..a5ed4d4e3cfc 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml @@ -10,13 +10,13 @@ description: |- the directory /etc/audit/rules.d, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: - 
-a always,exit -F arch=ARCH -S mount -F auid>={{{ auid }}} -F auid!=unset -F key=export
+ 
-a always,exit -F arch=ARCH -S mount -F auid>={{{ auid }}} -F auid!=unset -F key={{{ "privileged-mount" if product == "rhel10" else "export" }}}
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following line to /etc/audit/audit.rules file, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: - 
-a always,exit -F arch=ARCH -S mount -F auid>={{{ auid }}} -F auid!=unset -F key=export
+ 
-a always,exit -F arch=ARCH -S mount -F auid>={{{ auid }}} -F auid!=unset -F key={{{ "privileged-mount" if product == "rhel10" else "export" }}}
rationale: |- The unauthorized exportation of data to external media could result in an information leak @@ -58,7 +58,7 @@ references: {{{ complete_ocil_entry_audit_syscall(syscall="mount") }}} fixtext: |- - {{{ fixtext_audit_rules("mount", "export", None) | indent(4) }}} + {{{ fixtext_audit_rules("mount", "privileged-mount" if product == "rhel10" else "export", None) | indent(4) }}} srg_requirement: '{{{ srg_requirement_audit_syscall("mount") }}}' @@ -67,3 +67,4 @@ template: vars: attr: mount key: export + key@rhel10: privileged-mount diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/tests/correct_rules.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/tests/correct_rules.pass.sh index 5400f87b870b..e8c1a67de989 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/tests/correct_rules.pass.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_media_export/tests/correct_rules.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash # packages = audit -echo "-a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export" >> /etc/audit/rules.d/export.rules -echo "-a always,exit -F arch=b64 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export" >> /etc/audit/rules.d/export.rules +echo "-a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k {{{ "privileged-mount" if product == "rhel10" else "export" }}}" >> /etc/audit/rules.d/export.rules +echo "-a always,exit -F arch=b64 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k {{{ "privileged-mount" if product == "rhel10" else "export" }}}" >> /etc/audit/rules.d/export.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/policy/stig/rhel10.yml index a958e475294e..94751db7ffa6 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/policy/stig/rhel10.yml @@ -6,19 +6,19 @@ fixtext: |- Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": - -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=logins - -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=logins + -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=identity + -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: - $ sudo service auditd restart + $ sudo augenrules --load checktext: |- Verify {{{ full_name }}} generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" with the following command: $ sudo auditctl -l | grep '/etc/sudoers[^.]' - -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=logins - -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=logins + -a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=identity + -a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=identity If the command does not return a line, or the line is commented out, this is a finding. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml index aa5f534ed6bc..8c0d186da794 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml @@ -6,7 +6,7 @@ title: 'Ensure auditd Collects System Administrator Actions - /etc/sudoers' description: |- At a minimum, the audit system should collect administrator actions for all users and root. - {{{ describe_audit_rules_watch("/etc/sudoers", "actions") }}} + {{{ describe_audit_rules_watch("/etc/sudoers", "identity" if product == "rhel10" else "actions") }}} rationale: |- The actions taken by system administrators should be audited to keep a record @@ -30,9 +30,9 @@ references: ocil_clause: 'the command does not return a line, or the line is commented out' ocil: |- - {{{ ocil_audit_rules_watch("/etc/sudoers", "actions") }}} + {{{ ocil_audit_rules_watch("/etc/sudoers", "identity" if product == "rhel10" else "actions") }}} -fixtext: '{{{ fixtext_audit_file_watch_rule("/etc/sudoers", "actions", "/etc/audit/rules.d/audit.rules") }}}' +fixtext: '{{{ fixtext_audit_file_watch_rule("/etc/sudoers", "identity" if product == "rhel10" else "actions", "/etc/audit/rules.d/audit.rules") }}}' srg_requirement: '{{{ srg_requirement_audit_file_watch_rule("/etc/sudoers") }}}' @@ -41,3 +41,4 @@ template: vars: path: /etc/sudoers key: actions + key@rhel10: identity diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/policy/stig/rhel10.yml index 7f33a9b2b0e5..7f254d308394 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/policy/stig/rhel10.yml @@ -6,8 +6,8 @@ fixtext: |- Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": - -a always,exit -F arch=b32 -F path=/etc/sudoers.d/ -F perm=wa -F key=identity - -a always,exit -F arch=b64 -F path=/etc/sudoers.d/ -F perm=wa -F key=identity + -a always,exit -F arch=b32 -F path=/etc/sudoers.d -F perm=wa -F key=identity + -a always,exit -F arch=b64 -F path=/etc/sudoers.d -F perm=wa -F key=identity Restart the audit daemon with the following command for the changes to take effect: @@ -17,8 +17,8 @@ checktext: |- Verify {{{ full_name }}} generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" with the following command: $ sudo auditctl -l | grep /etc/sudoers.d - -a always,exit -F arch=b32 -F path=/etc/sudoers.d/ -F perm=wa -F key=identity - -a always,exit -F arch=b64 -F path=/etc/sudoers.d/ -F perm=wa -F key=identity + -a always,exit -F arch=b32 -F path=/etc/sudoers.d -F perm=wa -F key=identity + -a always,exit -F arch=b64 -F path=/etc/sudoers.d -F perm=wa -F key=identity If the command does not return a line, or the line is commented out, this is a finding. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml index 5a91e876a445..9400a4cdfd8c 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml @@ -6,7 +6,7 @@ title: 'Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/' description: |- At a minimum, the audit system should collect administrator actions for all users and root. - {{{ describe_audit_rules_watch("/etc/sudoers.d/", "actions") }}} + {{{ describe_audit_rules_watch("/etc/sudoers.d" if product == "rhel10" else "/etc/sudoers.d/", "identity" if product == "rhel10" else "actions") }}} rationale: |- The actions taken by system administrators should be audited to keep a record @@ -30,9 +30,9 @@ references: ocil_clause: 'the command does not return a line, or the line is commented out' ocil: |- - {{{ ocil_audit_rules_watch("/etc/sudoers.d/", "actions") }}} + {{{ ocil_audit_rules_watch("/etc/sudoers.d" if product == "rhel10" else "/etc/sudoers.d/", "identity" if product == "rhel10" else "actions") }}} -fixtext: '{{{ fixtext_audit_file_watch_rule("/etc/sudoers.d/", "identity", "/etc/audit/rules.d/audit.rules") }}}' +fixtext: '{{{ fixtext_audit_file_watch_rule("/etc/sudoers.d" if product == "rhel10" else "/etc/sudoers.d/", "identity", "/etc/audit/rules.d/audit.rules") }}}' srg_requirement: '{{{ srg_requirement_audit_file_watch_rule("/etc/sudoers.d/") }}}' @@ -41,3 +41,5 @@ template: vars: path: /etc/sudoers.d/ key: actions + path@rhel10: /etc/sudoers.d + key@rhel10: identity diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/tests/trailing_slash_path.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/tests/trailing_slash_path.fail.sh new file mode 100644 index 000000000000..1612deae1d33 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sudoers_d/tests/trailing_slash_path.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = audit + +rm -f /etc/audit/rules.d/*.rules +truncate -s 0 /etc/audit/audit.rules + +# The RHEL 10 rules must watch /etc/sudoers.d without the trailing slash. +echo "-a always,exit -F arch=b32 -F path=/etc/sudoers.d/ -F perm=wa -F key=identity" >> /etc/audit/rules.d/login.rules +echo "-a always,exit -F arch=b64 -F path=/etc/sudoers.d/ -F perm=wa -F key=identity" >> /etc/audit/rules.d/login.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/ansible/shared.yml index 95a1b69654fe..58a39e5e1be8 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/ansible/shared.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/ansible/shared.yml @@ -4,18 +4,21 @@ # complexity = low # disruption = low +{{% set watch_key = "identity" if product == "rhel10" else "actions" %}} {{% if audit_watches_style == "modern" %}} -{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers', permissions='wa', key='actions', style='modern', arch='b32', filter_type='path', rule_title=rule_title) }}} -{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers', permissions='wa', key='actions', style='modern', arch='b64', filter_type='path', rule_title=rule_title) }}} -{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers', permissions='wa', key='actions', style='modern', arch='b32', filter_type='path', rule_title=rule_title) }}} -{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers', permissions='wa', key='actions', style='modern', arch='b64', filter_type='path', rule_title=rule_title) }}} -{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key='actions', style='modern', arch='b32', filter_type='dir', rule_title=rule_title) }}} -{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key='actions', style='modern', arch='b64', filter_type='dir', rule_title=rule_title) }}} -{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key='actions', style='modern', arch='b32', filter_type='dir', rule_title=rule_title) }}} -{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key='actions', style='modern', arch='b64', filter_type='dir', rule_title=rule_title) }}} +{{% set sudoers_d_path = "/etc/sudoers.d" if product == "rhel10" else "/etc/sudoers.d/" %}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers', permissions='wa', key=watch_key, style='modern', arch='b32', filter_type='path', rule_title=rule_title) }}} +{{% set sudoers_d_filter = "path" if product == "rhel10" else "dir" %}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers', permissions='wa', key=watch_key, style='modern', arch='b64', filter_type='path', rule_title=rule_title) }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers', permissions='wa', key=watch_key, style='modern', arch='b32', filter_type='path', rule_title=rule_title) }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers', permissions='wa', key=watch_key, style='modern', arch='b64', filter_type='path', rule_title=rule_title) }}} +{{{ ansible_audit_augenrules_add_watch_rule(path=sudoers_d_path, permissions='wa', key=watch_key, style='modern', arch='b32', filter_type=sudoers_d_filter, rule_title=rule_title) }}} +{{{ ansible_audit_augenrules_add_watch_rule(path=sudoers_d_path, permissions='wa', key=watch_key, style='modern', arch='b64', filter_type=sudoers_d_filter, rule_title=rule_title) }}} +{{{ ansible_audit_auditctl_add_watch_rule(path=sudoers_d_path, permissions='wa', key=watch_key, style='modern', arch='b32', filter_type=sudoers_d_filter, rule_title=rule_title) }}} +{{{ ansible_audit_auditctl_add_watch_rule(path=sudoers_d_path, permissions='wa', key=watch_key, style='modern', arch='b64', filter_type=sudoers_d_filter, rule_title=rule_title) }}} {{% else %}} -{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers', permissions='wa', key='actions', rule_title=rule_title) }}} -{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers', permissions='wa', key='actions', rule_title=rule_title) }}} -{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key='actions', rule_title=rule_title) }}} -{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key='actions', rule_title=rule_title) }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers', permissions='wa', key=watch_key, rule_title=rule_title) }}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers', permissions='wa', key=watch_key, rule_title=rule_title) }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key=watch_key, rule_title=rule_title) }}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sudoers.d/', permissions='wa', key=watch_key, rule_title=rule_title) }}} {{% endif %}} diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh index f5095bd237a7..1942f163e35c 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh @@ -2,18 +2,21 @@ # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' +{{% set watch_key = "identity" if product == "rhel10" else "actions" %}} {{% if audit_watches_style == "modern" %}} -{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers", "wa", "actions", "modern", "b32", "path") }}} -{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers", "wa", "actions", "modern", "b64", "path") }}} -{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers", "wa", "actions", "modern", "b32", "path") }}} -{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers", "wa", "actions", "modern", "b64", "path") }}} -{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers.d/", "wa", "actions", "modern", "b32", "dir") }}} -{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers.d/", "wa", "actions", "modern", "b64", "dir") }}} -{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers.d/", "wa", "actions", "modern", "b32", "dir") }}} -{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers.d/", "wa", "actions", "modern", "b64", "dir") }}} +{{% set sudoers_d_path = "/etc/sudoers.d" if product == "rhel10" else "/etc/sudoers.d/" %}} +{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers", "wa", watch_key, "modern", "b32", "path") }}} +{{% set sudoers_d_filter = "path" if product == "rhel10" else "dir" %}} +{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers", "wa", watch_key, "modern", "b64", "path") }}} +{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers", "wa", watch_key, "modern", "b32", "path") }}} +{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers", "wa", watch_key, "modern", "b64", "path") }}} +{{{ bash_fix_audit_watch_rule("auditctl", sudoers_d_path, "wa", watch_key, "modern", "b32", sudoers_d_filter) }}} +{{{ bash_fix_audit_watch_rule("auditctl", sudoers_d_path, "wa", watch_key, "modern", "b64", sudoers_d_filter) }}} +{{{ bash_fix_audit_watch_rule("augenrules", sudoers_d_path, "wa", watch_key, "modern", "b32", sudoers_d_filter) }}} +{{{ bash_fix_audit_watch_rule("augenrules", sudoers_d_path, "wa", watch_key, "modern", "b64", sudoers_d_filter) }}} {{% else %}} -{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers", "wa", "actions") }}} -{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers", "wa", "actions") }}} -{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers.d/", "wa", "actions") }}} -{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers.d/", "wa", "actions") }}} +{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers", "wa", watch_key) }}} +{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers", "wa", watch_key) }}} +{{{ bash_fix_audit_watch_rule("auditctl", "/etc/sudoers.d/", "wa", watch_key) }}} +{{{ bash_fix_audit_watch_rule("augenrules", "/etc/sudoers.d/", "wa", watch_key) }}} {{% endif %}} diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct.pass.sh index fc58f3fb8846..1f0570a090d2 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct.pass.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct.pass.sh @@ -2,10 +2,12 @@ # packages = audit {{% if audit_watches_style == "modern" %}} -echo "-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key=actions" >> /etc/audit/rules.d/actions.rules -echo "-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key=actions" >> /etc/audit/rules.d/actions.rules -echo "-a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa -F key=actions" >> /etc/audit/rules.d/actions.rules -echo "-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa -F key=actions" >> /etc/audit/rules.d/actions.rules +{{% set watch_key = "identity" if product == "rhel10" else "actions" %}} +{{% set sudoers_d_spec = "-F path=/etc/sudoers.d" if product == "rhel10" else "-F dir=/etc/sudoers.d/" %}} +echo "-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa -F key={{{ watch_key }}}" >> /etc/audit/rules.d/actions.rules +echo "-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa -F key={{{ watch_key }}}" >> /etc/audit/rules.d/actions.rules +echo "-a always,exit -F arch=b32 {{{ sudoers_d_spec }}} -F perm=wa -F key={{{ watch_key }}}" >> /etc/audit/rules.d/actions.rules +echo "-a always,exit -F arch=b64 {{{ sudoers_d_spec }}} -F perm=wa -F key={{{ watch_key }}}" >> /etc/audit/rules.d/actions.rules {{% else %}} echo "-w /etc/sudoers -p wa -k actions" >> /etc/audit/rules.d/actions.rules echo "-w /etc/sudoers.d/ -p wa -k actions" >> /etc/audit/rules.d/actions.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct_without_key.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct_without_key.pass.sh index ddae4495abc6..3a0928b2d008 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct_without_key.pass.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/tests/correct_without_key.pass.sh @@ -2,10 +2,12 @@ # packages = audit {{% if audit_watches_style == "modern" %}} -echo "-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa" >> /etc/audit/rules.d/actions.rules -echo "-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa" >> /etc/audit/rules.d/actions.rules -echo "-a always,exit -F arch=b32 -F dir=/etc/sudoers.d/ -F perm=wa" >> /etc/audit/rules.d/actions.rules -echo "-a always,exit -F arch=b64 -F dir=/etc/sudoers.d/ -F perm=wa" >> /etc/audit/rules.d/actions.rules +{{% set watch_key = "identity" if product == "rhel10" else "actions" %}} +{{% set sudoers_d_spec = "-F path=/etc/sudoers.d" if product == "rhel10" else "-F dir=/etc/sudoers.d/" %}} +echo "-a always,exit -F arch=b32 -F path=/etc/sudoers -F perm=wa{{% if product == "rhel10" %}} -F key={{{ watch_key }}}" >>{{% else %}}" >>{{% endif %}} /etc/audit/rules.d/actions.rules +echo "-a always,exit -F arch=b64 -F path=/etc/sudoers -F perm=wa{{% if product == "rhel10" %}} -F key={{{ watch_key }}}" >>{{% else %}}" >>{{% endif %}} /etc/audit/rules.d/actions.rules +echo "-a always,exit -F arch=b32 {{{ sudoers_d_spec }}} -F perm=wa{{% if product == "rhel10" %}} -F key={{{ watch_key }}}" >>{{% else %}}" >>{{% endif %}} /etc/audit/rules.d/actions.rules +echo "-a always,exit -F arch=b64 {{{ sudoers_d_spec }}} -F perm=wa{{% if product == "rhel10" %}} -F key={{{ watch_key }}}" >>{{% else %}}" >>{{% endif %}} /etc/audit/rules.d/actions.rules {{% else %}} echo "-w /etc/sudoers -p wa" >> /etc/audit/rules.d/actions.rules echo "-w /etc/sudoers.d/ -p wa" >> /etc/audit/rules.d/actions.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/rhel10.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/rhel10.yml index 64cd7d73820e..16ffc1bf15d3 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/rhel10.yml @@ -1,26 +1,25 @@ srg_requirement: |- - {{{ full_name }}} must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/opasswd". + {{{ full_name }}} must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". fixtext: |- - Configure {{{ full_name }}} to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd". + Configure {{{ full_name }}} to generate audit records for all modifications to "/etc/security/opasswd" by adding or updating the following rules in "/etc/audit/rules.d/identity.rules": - Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": + -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -k identity + -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -k identity - -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=identity - -a always,exit -F arch=b64 -F path=(/etc/security/opasswd -F perm=wa -F key=identity - - Restart the audit daemon with the following command for the changes to take effect: + To load the rules to the kernel immediately, use the following command: - $ sudo service auditd restart + $ sudo augenrules --load checktext: |- - Verify {{{ full_name }}} generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command: + Verify {{{ full_name }}} generates audit records for modifications to "/etc/security/opasswd" with the following command: + + $ sudo auditctl -l | grep '/etc/security/opasswd' - $ sudo auditctl -l | egrep '(/etc/security/opasswd)' -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=identity -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -F key=identity - If the command does not return a line, or the line is commented out, this is a finding. + If the command does not return these lines, or the lines are commented out, this is a finding. vuldiscussion: |- In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/shared.yml index 4c7836910a80..ddfcad2d745c 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/shared.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/policy/stig/shared.yml @@ -10,7 +10,7 @@ checktext: |- $ sudo auditctl -l | egrep '(/etc/security/opasswd)' -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=identity - -a always,exit -F arch=b64 -F path=(/etc/security/opasswd -F perm=wa -F key=identity + -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -F key=identity If the command does not return a line, or the line is commented out, this is a finding. @@ -20,6 +20,6 @@ fixtext: |- Add or update the following file system rule to "/etc/audit/rules.d/audit.rules": -a always,exit -F arch=b32 -F path=/etc/security/opasswd -F perm=wa -F key=identity - -a always,exit -F arch=b64 -F path=(/etc/security/opasswd -F perm=wa -F key=identity + -a always,exit -F arch=b64 -F path=/etc/security/opasswd -F perm=wa -F key=identity The audit daemon must be restarted for the changes to take effect. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml index 6b0a2e4e1c66..d96c1083934e 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml @@ -58,3 +58,4 @@ template: vars: path: /etc/security/opasswd key: audit_rules_usergroup_modification + key@rhel10: identity diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_percentage/policy/stig/rhel10.yml b/linux_os/guide/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_percentage/policy/stig/rhel10.yml index 67f996650342..30f791c57c32 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_percentage/policy/stig/rhel10.yml +++ b/linux_os/guide/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_percentage/policy/stig/rhel10.yml @@ -18,7 +18,7 @@ checktext: |- If the value of the "admin_space_left" keyword is not set to 5 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator to indicate how the system is taking action if the allocated storage is about to reach capacity. - If the "space_left" value is not configured to the correct value, this is a finding. + If the "admin_space_left" value is not configured to the correct value, this is a finding. vuldiscussion: |- If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity. diff --git a/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/policy/stig/rhel10.yml b/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/policy/stig/rhel10.yml index 778ca94fe052..0d7dc2cc5254 100644 --- a/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/policy/stig/rhel10.yml +++ b/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/policy/stig/rhel10.yml @@ -2,17 +2,17 @@ srg_requirement: |- {{{ full_name }}} must not have a File Transfer Protocol (FTP) server package installed. fixtext: |- - Configure {{{ full_name }}} to not have the FTP package installed with the following command (using "vsftpd" as an example): + Configure {{{ full_name }}} to not have the FTP package installed with the following command: $ sudo dnf -y remove vsftpd checktext: |- Verify {{{ full_name }}} does not have an FTP server package installed with the following command: - $ sudo dnf list --installed vsftp + $ sudo dnf list --installed vsftpd Error: No matching Packages to list - If the "vsftp" package is installed, this is a finding. + If the "vsftpd" package is installed, this is a finding. vuldiscussion: |- The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log in using this service, the privileged user password could be compromised. Secure Shell (SSH) or other encrypted file transfer methods must be used in place of this service. diff --git a/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/policy/stig/rhel10.yml b/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/policy/stig/rhel10.yml deleted file mode 100644 index 1e3a497426af..000000000000 --- a/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/policy/stig/rhel10.yml +++ /dev/null @@ -1,51 +0,0 @@ -srg_requirement: |- - {{{ full_name }}} must not have a Trivial File Transfer Protocol (TFTP) server package installed unless it is required by the mission, and if required, the TFTP daemon must be configured to operate in secure mode. - -fixtext: |- - Configure {{{ full_name }}} so that TFTP operates in secure mode if installed. - - If TFTP server is not required, remove it with the following command: - - $ sudo dnf -y remove tftp-server - - Configure the TFTP daemon to operate in secure mode with the following command: - - $ sudo systemctl edit tftp.service - - In the editor, enter: - - [Service] - ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot - - After making changes, reload the systemd daemon and restart the TFTP service as follows: - - $ sudo systemctl daemon-reload - $ sudo systemctl restart tftp.service - -checktext: |- - Note: If TFTP is not required, it must not be installed. If TFTP is not installed, this rule is not applicable. - - Verify {{{ full_name }}} is configured so that TFTP operates in secure mode if installed. - - Determine if TFTP server is installed with the following command: - - $ sudo dnf list --installed | grep tftp-server - tftp-server.x86_64 5.2-48.el10 @rhel-10-for-x86_64-appstream-rpms - - If the TFTP server package is installed and is not required, or if it is not documented with the ISSM, this is a finding. - - Verify the TFTP daemon, if tftp.server is installed, is configured to operate in secure mode with the following command: - - $ grep -i execstart /usr/lib/systemd/system/tftp.service - ExecStart=/usr/sbin/in.tftpd -s /var/lib/tftpboot - - Note: The "-s" option ensures the TFTP server only serves files from the specified directory, which is a security measure to prevent unauthorized access to other parts of the file system. - - If the "-s" option is not present in the "ExecStart" line, or if the line is missing, this is a finding. - -vuldiscussion: |- - Removing the "tftp-server" package decreases the risk of the accidental (or intentional) activation of TFTP services. - - If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the information systems security manager (ISSM), restricted to only authorized personnel, and have access control rules established. - - Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files. diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/oval/shared.xml index c1f4f6b8d59e..8145f76038fa 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/oval/shared.xml @@ -16,7 +16,11 @@ /etc/libuser.conf +{{% if product == "rhel10" %}} + ^[\s]*\[defaults\][\s]*\n(?:[^[]*\n)*?[\s]*crypt_style[\s]*=[\s]*(\w*)[\s]*$ +{{% else %}} ^[\s]*crypt_style[\s]*=[\s]*(\w*)[\s]*$ +{{% endif %}} 1 diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml index d6f8442c0b6d..02fee58f0f5a 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/policy/stig/rhel10.yml @@ -5,15 +5,17 @@ vuldiscussion: |- This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult. checktext: |- + Note: If the libuser package is not installed, this requirement is not applicable. + Verify {{{ full_name }}} user and group account administration utilities are configured to store only encrypted representations of passwords with the following command: - $ sudo grep crypt /etc/libuser.conf + $ sudo grep -i "^crypt_style" /etc/libuser.conf crypt_style = sha512 If the "crypt_style" variable is not set to "sha512", is not in the defaults section, is commented out, or does not exist, this is a finding. fixtext: |- Configure {{{ full_name }}} to use the SHA-512 algorithm for password hashing. - Add or change the following line in the "[default]" section of the "/etc/libuser.conf" file: + Add or change the following line in the "[defaults]" section of the "/etc/libuser.conf" file: crypt_style = sha512 diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/tests/rhel10_anchored_section_match.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/tests/rhel10_anchored_section_match.pass.sh new file mode 100644 index 000000000000..4542d693b154 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/tests/rhel10_anchored_section_match.pass.sh @@ -0,0 +1,16 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# variables = var_password_hashing_algorithm_pam=sha512 +# packages = libuser + +# A crypt_style in an earlier section must not shadow the [defaults] value. +cat > /etc/libuser.conf < /etc/libuser.conf < /etc/libuser.conf < /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf +[Manager] +CtrlAltDelBurstAction=none +EOF +systemctl daemon-reload +{{% else %}} {{{ bash_replace_or_append('/etc/systemd/system.conf', '^CtrlAltDelBurstAction=', 'none', '%s=%s', cce_identifiers=cce_identifiers) }}} +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/oval/shared.xml index 82be7cd74fac..b7633e86a225 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/oval/shared.xml @@ -1,14 +1,39 @@ - + {{{ oval_metadata("Configure the CtrlAltDelBurstAction setting in /etc/systemd/system.conf or /etc/systemd/system.conf.d/* to none to prevent a reboot if Ctrl-Alt-Delete is pressed more than 7 times in 2 seconds.", rule_title=rule_title) }}} +{{% if "rhel" in families %}} + + + +{{% else %}} +{{% endif %}} +{{% if "rhel" in families %}} + + + + + + + ^/etc/systemd/system\.conf(?:\.d/[^/]+\.conf)?$ + ^\s*\[Manager\]\s*\n(?:[^[]*\n)* + 1 + + + + (?:^|\n)\s*CtrlAltDelBurstAction\s*=\s*none\s*(?:#.*)?(?:\n|$) + +{{% else %}} @@ -20,5 +45,6 @@ ^[\s]*CtrlAltDelBurstAction[\s]*=[\s]*none$ 1 +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/policy/stig/rhel10.yml index a7a048968e91..b76dfa50d0f0 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/policy/stig/rhel10.yml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/policy/stig/rhel10.yml @@ -2,12 +2,15 @@ srg_requirement: |- {{{ full_name }}} must disable the systemd Ctrl-Alt-Delete burst key sequence. fixtext: |- - Configure {{{ full_name }}} to disable the "CtrlAltDelBurstAction". + Configure {{{ full_name }}} to disable the CtrlAltDelBurstAction by adding it to a drop-in file in a "/etc/systemd/system.conf.d/" configuration file: - Update the "/etc/systemd/system.conf" configuration file as follows: + If no drop-in file exists, create one with the following command: - $ sudo vi /etc/systemd/system.conf + $ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf + Edit the file to contain the setting by adding the following text: + + [Manager] CtrlAltDelBurstAction=none Reload the daemon for this change to take effect: @@ -17,8 +20,8 @@ fixtext: |- checktext: |- Verify {{{ full_name }}} is configured to not reboot the system when Ctrl-Alt-Delete is pressed seven times within two seconds with the following command: - $ grep -iR CtrlAltDelBurstAction /etc/systemd/ - /etc/systemd/system.conf:CtrlAltDelBurstAction=none + $ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system* + /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf:CtrlAltDelBurstAction=none If the "CtrlAltDelBurstAction" is not set to "none", is commented out, or is missing, this is a finding. diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml index 49bdcf3d86b1..d32f862ec300 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml @@ -8,7 +8,12 @@ description: |- key sequence is pressed Ctrl-Alt-Delete more than 7 times in 2 seconds.

To configure the system to ignore the CtrlAltDelBurstAction - {{% if product != "rhcos4" %}} + {{% if "rhel" in families %}} + setting, create the /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf + file with the following content: + 
[Manager]
+    CtrlAltDelBurstAction=none
+ {{% elif product != "rhcos4" %}} setting, add or modify the following to /etc/systemd/system.conf: 
CtrlAltDelBurstAction=none
{{% else %}} @@ -74,16 +79,40 @@ references: ocil_clause: 'the system is configured to reboot when Ctrl-Alt-Del is pressed more than 7 times in 2 seconds.' ocil: |- + {{% if product == "rhel10" %}} + To ensure the system is configured to ignore the Ctrl-Alt-Del setting, enter the following command: + 
$ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system*
+ The output should return: + 
/etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf:CtrlAltDelBurstAction=none
+ {{% else %}} To ensure the system is configured to ignore the Ctrl-Alt-Del setting, enter the following command: 
$ sudo grep -i ctrlaltdelburstaction /etc/systemd/system.conf
The output should return: 
CtrlAltDelBurstAction=none
+ {{% endif %}} fixtext: |- + {{% if product == "rhel10" %}} + Configure {{{ full_name }}} to disable the "CtrlAltDelBurstAction" by adding it to a drop-in file in the "/etc/systemd/system.conf.d/" directory: + + If no drop-in file exists, create one with the following command: + + 
$ sudo mkdir -p /etc/systemd/system.conf.d && sudo vi /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+ + Edit the file to contain the following text: + + 
[Manager]
+    CtrlAltDelBurstAction=none
+ + Reload the daemon for this change to take effect: + + 
$ sudo systemctl daemon-reload
+ {{% else %}} Edit "/etc/systemd/system.conf" and add or edit the following line: CtrlAltDelBurstAction=none + {{% endif %}} srg_requirement: 'The systemd Ctrl-Alt-Delete burst key sequence in {{{ full_name }}} must be disabled.' diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/correct_value.pass.sh index e5fa270d06be..21008ceb8ff3 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/correct_value.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/correct_value.pass.sh @@ -1,5 +1,12 @@ #!/bin/bash +{{% if "rhel" in families %}} +mkdir -p /etc/systemd/system.conf.d +cat << EOF > /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf +[Manager] +CtrlAltDelBurstAction=none +EOF +{{% else %}} touch /etc/systemd/system.conf if grep -q "^CtrlAltDelBurstAction=" /etc/systemd/system.conf; then @@ -7,3 +14,4 @@ if grep -q "^CtrlAltDelBurstAction=" /etc/systemd/system.conf; then else echo "CtrlAltDelBurstAction=none" >> /etc/systemd/system.conf fi +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/line_not_there.fail.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/line_not_there.fail.sh index 4925c50f545d..1f78d5fdec2c 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/line_not_there.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/line_not_there.fail.sh @@ -1,7 +1,15 @@ #!/bin/bash +{{% if "rhel" in families %}} +mkdir -p /etc/systemd/system.conf.d +cat << EOF > /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf +[Manager] +OtherSetting=value +EOF +{{% else %}} # make sure the file exist touch /etc/systemd/system.conf sed -i "/^CtrlAltDelBurstAction.*/d" /etc/systemd/system.conf +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel10_file_missing.fail.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel10_file_missing.fail.sh new file mode 100644 index 000000000000..42eb2fbe4953 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel10_file_missing.fail.sh @@ -0,0 +1,4 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 + +rm -f /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel10_wrong_section.fail.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel10_wrong_section.fail.sh new file mode 100644 index 000000000000..29c18e258658 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel10_wrong_section.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 + +mkdir -p /etc/systemd/system.conf.d +cat << EOF > /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf +[Sleep] +CtrlAltDelBurstAction=none +[Manager] +LogLevel=info +EOF diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/wrong_value.fail.sh index 91aac0dc8df2..011cc99035e7 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/wrong_value.fail.sh @@ -1,5 +1,12 @@ #!/bin/bash +{{% if "rhel" in families %}} +mkdir -p /etc/systemd/system.conf.d +cat << EOF > /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf +[Manager] +CtrlAltDelBurstAction=poweroff-immediate +EOF +{{% else %}} # make sure the file exist touch /etc/systemd/system.conf @@ -8,3 +15,4 @@ if grep -q "^CtrlAltDelBurstAction=" /etc/systemd/system.conf; then else echo "CtrlAltDelBurstAction=poweroff-immediate" >> /etc/systemd/system.conf fi +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/oval/shared.xml index e851db954e46..875e5719c9ad 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/oval/shared.xml @@ -6,6 +6,8 @@ {{% set smartcard_packages = ['pam_pkcs11'] %}} {{% elif 'ubuntu' in product %}} {{% set smartcard_packages = ['libpam-pkcs11'] %}} +{{% elif product in ['rhel10', 'ol10'] %}} +{{% set smartcard_packages = ['pkcs11-provider'] %}} {{% else %}} {{% set smartcard_packages = ['openssl-pkcs11'] %}} {{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/policy/stig/rhel10.yml index 422ef3922f69..7fca6c84e967 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/policy/stig/rhel10.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/policy/stig/rhel10.yml @@ -2,26 +2,20 @@ srg_requirement: |- {{{ full_name }}} must have the "pkcs11-provider" package installed. vuldiscussion: |- - Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD common access card (CAC) with DOD-approved PKI is an example of multifactor authentication. - - + Without the use of multifactor authentication (MFA), the ease of access to privileged functions is greatly increased. MFA requires using two or more factors to achieve authentication. A privileged account is defined as an information system account with authorizations of a privileged user. The DOD common access card (CAC) with DOD-approved PKI is an example of MFA. checktext: |- Note: If the system administrator demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable. - Verify {{{ full_name }}} has the "openssl-pkcs11" package installed with the following command: + Verify {{{ full_name }}} has the "pkcs11-provider" package installed with the following command: $ sudo dnf list --installed pkcs11-provider Installed Packages pkcs11-provider.x86_64 1.0-3.el10_0 @rhel-10-for-x86_64-baseos-rpms - If the "openssl-pkcs11" package is not installed, this is a finding. + If the "pkcs11-provider" package is not installed, this is a finding. fixtext: |- - Configure {{{ full_name }}} to have the "openssl-pkcs11" package installed with the following command: + Configure {{{ full_name }}} to have the "pkcs11-provider" package installed with the following command: $ sudo dnf -y install pkcs11-provider - - - - diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_pkcs11_provider_installed.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_pkcs11_provider_installed.pass.sh new file mode 100644 index 000000000000..33acc74bc384 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_pkcs11_provider_installed.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = pkcs11-provider + +true diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_pkcs11_provider_missing.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_pkcs11_provider_missing.fail.sh new file mode 100644 index 000000000000..36038a9d68d1 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_pkcs11_provider_missing.fail.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 + +# The required package is absent. +dnf remove -y --noautoremove pkcs11-provider diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_wrong_package.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_wrong_package.fail.sh new file mode 100644 index 000000000000..664149c75e9a --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/tests/rhel10_wrong_package.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = Red Hat Enterprise Linux 10 +# packages = opensc + +# Another smart card package does not satisfy the pkcs11-provider requirement. +dnf remove -y --noautoremove pkcs11-provider diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/policy/stig/rhel10.yml index 97bddd8d9e0f..50566ab58ae6 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/policy/stig/rhel10.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/policy/stig/rhel10.yml @@ -1,22 +1,22 @@ srg_requirement: |- - {{{ full_name }}} must, for new users or password changes, have a 60-day maximum password lifetime restriction for user account passwords in "/etc/login.defs". + {{{ full_name }}} must, for new users or password changes, have a 180-day maximum password lifetime restriction for user account passwords in "/etc/login.defs". fixtext: |- - Configure {{{ full_name }}} to enforce a 60-day maximum password lifetime. + Configure {{{ full_name }}} to enforce a 180-day maximum password lifetime. Add or modify the following line in the "/etc/login.defs" file: - PASS_MAX_DAYS 60 + PASS_MAX_DAYS 180 checktext: |- - Verify {{{ full_name }}} enforces a 60-day maximum password lifetime for new user accounts by running the following command: + Verify {{{ full_name }}} enforces a 180-day maximum password lifetime for new user accounts by running the following command: $ sudo grep -i pass_max_days /etc/login.defs - PASS_MAX_DAYS 60 + PASS_MAX_DAYS 180 - If the "PASS_MAX_DAYS" parameter value is greater than "60" or is commented out, this is a finding. + If the "PASS_MAX_DAYS" parameter value is greater than "180" or is commented out, this is a finding. vuldiscussion: |- - Any password, no matter how complex, can eventually be cracked; therefore, passwords must be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. + Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig.fail.sh index e29882f6f6bd..406c7513eda7 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig.fail.sh +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig.fail.sh @@ -8,4 +8,4 @@ rm -f {{{ login_defs_path }}} -echo "PASS_MAX_DAYS 120" > {{{ login_defs_path }}} +echo "PASS_MAX_DAYS 240" > {{{ login_defs_path }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig_double.fail.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig_double.fail.sh index f1589e49bfbf..75fd39442098 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig_double.fail.sh +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/tests/incorrect_stig_double.fail.sh @@ -9,4 +9,4 @@ rm -f {{{ login_defs_path }}} echo "PASS_MAX_DAYS 60" > {{{ login_defs_path }}} -echo "PASS_MAX_DAYS 120" >> {{{ login_defs_path }}} +echo "PASS_MAX_DAYS 240" >> {{{ login_defs_path }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/policy/stig/rhel10.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/policy/stig/rhel10.yml index 2d3507068e50..9db66520a9f5 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/policy/stig/rhel10.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/policy/stig/rhel10.yml @@ -1,21 +1,21 @@ srg_requirement: |- - {{{ full_name }}} must, for user account passwords, have a 60-day maximum password lifetime restriction. + {{{ full_name }}} must, for user account passwords, have a 180-day maximum password lifetime restriction. fixtext: |- - Configure {{{ full_name }}} to enforce a 60-day maximum password lifetime restriction on user account passwords. + Configure {{{ full_name }}} to enforce a 180-day maximum password lifetime restriction on user account passwords. - Set the 60-day maximum password lifetime restriction with the following command: + Set the 180-day maximum password lifetime restriction with the following command: - $ sudo passwd -x 60 [user] + $ sudo passwd -x 180 [user] checktext: |- - Verify {{{ full_name }}} enforces a 60-day maximum time period for existing user account passwords with the following commands: + Verify {{{ full_name }}} enforces a 180-day maximum time period for existing user account passwords with the following commands: - $ sudo awk -F: '$5 > 60 {print $1 "" "" $5}' /etc/shadow + $ sudo awk -F: '$5 > 180 {print $1 "" "" $5}' /etc/shadow $ sudo awk -F: '$5 <= 0 {print $1 "" "" $5}' /etc/shadow If any results are returned that are not associated with a system account, this is a finding. vuldiscussion: |- - Any password, no matter how complex, can eventually be cracked. Therefore, passwords must be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. + Any password, no matter how complex, can eventually be cracked; therefore, passwords need to be changed periodically. If RHEL 10 does not limit the lifetime of passwords and force users to change their passwords, there is the risk that RHEL 10 passwords could be compromised. diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/ansible/shared.yml index 4a057da6ec45..b4f6f3f1d55a 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/ansible/shared.yml @@ -19,9 +19,19 @@ - name: {{{ rule_title }}} - Disable Login Shell for System Accounts ansible.builtin.user: name: '{{ item.key }}' - shell: /sbin/nologin + shell: '{{{ "/usr/sbin/nologin" if product == "rhel10" else "/sbin/nologin" }}}' loop: '{{ local_users }}' when: +{{% if product == "rhel10" %}} + - item.key not in ['root', 'halt', 'sync', 'shutdown'] +{{% else %}} - item.key not in ['root'] +{{% endif %}} +{{% if product == "rhel10" %}} + - item.value[1]|int > 0 + - item.value[1]|int < 1000 + - "item.value[5] is not match('.*(nologin|false)$')" +{{% else %}} - item.value[1]|int < {{{ uid_min }}} - item.value[5] not in ['/sbin/shutdown', '/sbin/halt', '/bin/sync'] +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/bash/shared.sh index f5db4eaf1d75..fc3f9b4cd8ea 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/bash/shared.sh @@ -4,10 +4,21 @@ # complexity = low # disruption = medium +{{% if product == "rhel10" %}} +readarray -t systemaccounts < <(awk -F: '($3 > 0 && $3 < 1000 && \ + $1 !~ /^(root|halt|sync|shutdown)$/ && \ + $7 !~ /(nologin|false)$/) \ + { print $1 }' /etc/passwd) +{{% else %}} readarray -t systemaccounts < <(awk -F: '($3 < {{{ uid_min }}} && $1 != "root" \ && $7 != "\/sbin\/shutdown" && $7 != "\/sbin\/halt" && $7 != "\/bin\/sync") \ { print $1 }' /etc/passwd) +{{% endif %}} for systemaccount in "${systemaccounts[@]}"; do +{{% if product == "rhel10" %}} + usermod -s /usr/sbin/nologin "$systemaccount" +{{% else %}} usermod -s /sbin/nologin "$systemaccount" +{{% endif %}} done diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/oval/shared.xml index cebd2a1ce193..d4374eabb335 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/oval/shared.xml @@ -1,7 +1,13 @@ - + {{{ oval_metadata("The root account is the only system account that should have a login shell.", rule_title=rule_title) }}} +{{% if product == "rhel10" %}} + + + +{{% else %}} @@ -130,7 +137,9 @@ /etc/passwd -{{% if "ubuntu" in product or "sle" in product or "slmicro" in product %}} +{{% if product == "rhel10" %}} + ^(?!(?:root|halt|sync|shutdown):).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?![^:]*?(?:nologin|false)$).*$ +{{% elif "ubuntu" in product or "sle" in product or "slmicro" in product %}} ^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$ {{% else %}} ^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$ @@ -138,6 +147,24 @@ 1 +{{% if product == "rhel10" %}} + + + + + + + + + 0 + + + 1000 + +{{% endif %}} + -{{% if product in ["fedora", "rhel10", "ol10"] %}} +{{% if product in ["fedora", "rhel10", "ol10"] and not RHEL10_STIG_SINGLE_RULE %}} @@ -43,13 +44,17 @@ {{{ filepath }}} - ^[\s]*-a[\s]+always,exit[\s]+{{{ arch_regex }}}-F[\s]+path={{{ PATH }}}{{{ perm_x }}}[\s]+-F[\s]+auid>={{{ auid }}}[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ +{{% if product == "rhel10" and RHEL10_STIG_ARCH_MODE %}} + ^[\s]*-a[\s]+always,exit[\s]+{{{ arch_regex }}}-F[\s]+path={{{ PATH }}}{{{ perm_x }}}[\s]+{{{ key_pattern }}} +{{% else %}} + ^[\s]*-a[\s]+always,exit[\s]+{{{ arch_regex }}}-F[\s]+path={{{ PATH }}}{{{ perm_x }}}[\s]+-F[\s]+auid>={{{ auid }}}[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+{{{ key_pattern }}} +{{% endif %}} 1 {{% endmacro %}} {{% for audit_tool in ["augenrules", "auditctl"] %}} -{{% if product in ["fedora", "rhel10", "ol10"] %}} +{{% if product in ["fedora", "rhel10", "ol10"] and not RHEL10_STIG_SINGLE_RULE %}} {{{ arpc_tftst(audit_tool, "32") }}} {{{ arpc_tftst(audit_tool, "64") }}} {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/template.py b/shared/templates/audit_rules_privileged_commands/template.py index 0cf6cba79cc3..80a3d15e6945 100644 --- a/shared/templates/audit_rules_privileged_commands/template.py +++ b/shared/templates/audit_rules_privileged_commands/template.py @@ -1,11 +1,19 @@ -import ssg.utils import os +import ssg.utils +from ssg.utils import parse_template_boolean_value + def preprocess(data, lang): path = data["path"] name = ssg.utils.escape_id(os.path.basename(path)) data["name"] = name + if "key" not in data: + data["key"] = "privileged" + data["rhel10_stig_single_rule"] = parse_template_boolean_value( + data, parameter="rhel10_stig_single_rule", default_value=False) + data["rhel10_stig_arch_mode"] = parse_template_boolean_value( + data, parameter="rhel10_stig_arch_mode", default_value=False) if lang == "oval": data["id"] = data["_rule_id"] data["title"] = "Record Any Attempts to Run " + name diff --git a/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh b/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh index 29f3b5f99487..2f26817270de 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh @@ -1,10 +1,14 @@ #!/bin/bash # packages = audit +# Writes the exact audit rules the check requires; the scan must pass. source common.sh {{{ setup_auditctl_environment() }}} -{{% if product in ["fedora", "rhel10", "ol10"] %}} +{{% if product == "rhel10" and RHEL10_STIG_ARCH_MODE %}} +echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -k {{{ KEY }}}" >> /etc/audit/audit.rules +echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -k {{{ KEY }}}" >> /etc/audit/audit.rules +{{% elif product in ["fedora", "rhel10", "ol10"] and not RHEL10_STIG_SINGLE_RULE %}} echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh b/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh index 132d62ca61ff..e52642309e13 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh @@ -1,10 +1,14 @@ #!/bin/bash +# Writes the exact audit rules the check requires; the scan must pass. source common.sh {{{ setup_augenrules_environment() }}} -{{% if product in ["fedora", "rhel10", "ol10"] %}} +{{% if product == "rhel10" and RHEL10_STIG_ARCH_MODE %}} +echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -k {{{ KEY }}}" >> /etc/audit/rules.d/{{{ KEY }}}.rules +echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -k {{{ KEY }}}" >> /etc/audit/rules.d/{{{ KEY }}}.rules +{{% elif product in ["fedora", "rhel10", "ol10"] and not RHEL10_STIG_SINGLE_RULE %}} echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/common.sh b/shared/templates/audit_rules_privileged_commands/tests/common.sh index a2aa1f057885..7c9137f74bb2 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/common.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/common.sh @@ -3,6 +3,10 @@ perm_x="-F perm=x" {{%- endif %}} +# Reset the audit rules and set the default augenrules environment. +# Scenarios that test the auditctl case override this with +# 'setup_auditctl_environment' after sourcing this file. +{{{ setup_augenrules_environment() }}} rm -f /etc/audit/rules.d/*.rules truncate -s 0 /etc/audit/audit.rules diff --git a/tests/data/profile_stability/rhel10/stig.profile b/tests/data/profile_stability/rhel10/stig.profile index 4004ef60828a..e8aa9626e7ac 100644 --- a/tests/data/profile_stability/rhel10/stig.profile +++ b/tests/data/profile_stability/rhel10/stig.profile @@ -109,6 +109,7 @@ audit_rules_privileged_commands_sudoedit audit_rules_privileged_commands_umount audit_rules_privileged_commands_unix_chkpwd audit_rules_privileged_commands_unix_update +audit_rules_privileged_commands_useradd audit_rules_privileged_commands_userhelper audit_rules_privileged_commands_usermod audit_rules_sudoers @@ -151,6 +152,7 @@ configure_crypto_policy configure_firewalld_ports configure_libreswan_crypto_policy configure_opensc_card_drivers +configure_openssl_crypto_policy configure_usbguard_auditbackend configured_firewalld_default_deny coredump_disable_backtraces @@ -361,7 +363,6 @@ package_sequoia-sq_installed package_subscription-manager_installed package_sudo_installed package_telnet-server_removed -package_tftp-server_removed package_tftp_removed package_tuned_removed package_unbound_removed @@ -481,7 +482,7 @@ var_account_disable_post_pw_expiration=35 var_accounts_authorized_local_users_regex=rhel10 var_accounts_fail_delay=4 var_accounts_max_concurrent_login_sessions=10 -var_accounts_maximum_age_login_defs=60 +var_accounts_maximum_age_login_defs=180 var_accounts_minimum_age_login_defs=1 var_accounts_passwords_pam_faillock_deny=3 var_accounts_passwords_pam_faillock_fail_interval=900 diff --git a/tests/data/profile_stability/rhel10/stig_gui.profile b/tests/data/profile_stability/rhel10/stig_gui.profile index 2f8501d76a33..1557a4d59454 100644 --- a/tests/data/profile_stability/rhel10/stig_gui.profile +++ b/tests/data/profile_stability/rhel10/stig_gui.profile @@ -109,6 +109,7 @@ audit_rules_privileged_commands_sudoedit audit_rules_privileged_commands_umount audit_rules_privileged_commands_unix_chkpwd audit_rules_privileged_commands_unix_update +audit_rules_privileged_commands_useradd audit_rules_privileged_commands_userhelper audit_rules_privileged_commands_usermod audit_rules_sudoers @@ -151,6 +152,7 @@ configure_crypto_policy configure_firewalld_ports configure_libreswan_crypto_policy configure_opensc_card_drivers +configure_openssl_crypto_policy configure_usbguard_auditbackend configured_firewalld_default_deny coredump_disable_backtraces @@ -359,7 +361,6 @@ package_sequoia-sq_installed package_subscription-manager_installed package_sudo_installed package_telnet-server_removed -package_tftp-server_removed package_tftp_removed package_tuned_removed package_unbound_removed @@ -479,7 +480,7 @@ var_account_disable_post_pw_expiration=35 var_accounts_authorized_local_users_regex=rhel10 var_accounts_fail_delay=4 var_accounts_max_concurrent_login_sessions=10 -var_accounts_maximum_age_login_defs=60 +var_accounts_maximum_age_login_defs=180 var_accounts_minimum_age_login_defs=1 var_accounts_passwords_pam_faillock_deny=3 var_accounts_passwords_pam_faillock_fail_interval=900