Update sssd_enable_smartcards & sssd_offline_cred_expiration

[Xeicker]

Description:

• Add /etc/sssd/conf.d/*.conf files as a possibility to find the configurations. Update affects:
  • OVAL
  • Ansible
  • Bash
  • Tests

Rationale:

• These configurations can be place there as noted in latest OL8 STIG V1R9

Review Hints:

• New tests should cover new addition

[openshift-ci]

Hi @Xeicker. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_smartcards' differs.
--- xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
+++ xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
@@ -9,7 +9,7 @@
 found=false
 
 # set value in all files if they contain section or key
-for f in $(echo -n "/etc/sssd/sssd.conf"); do
+for f in $(echo -n "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
     if [ ! -e "$f" ]; then
         continue
     fi
@@ -28,7 +28,7 @@
 
 # if section not in any file, append section with key = value to FIRST file in files parameter
 if ! $found ; then
-    file=$(echo "/etc/sssd/sssd.conf" | cut -f1 -d ' ')
+    file=$(echo "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d ' ')
     mkdir -p "$(dirname "$file")"
     echo -e "[pam]\npam_cert_auth = True" >> "$file"
 fi

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_smartcards' differs.
--- xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
+++ xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
@@ -89,6 +89,47 @@
   - no_reboot_needed
   - sssd_enable_smartcards
 
+- name: Find all the conf files inside /etc/sssd/conf.d/
+  find:
+    paths: /etc/sssd/conf.d/
+    patterns: '*.conf'
+  register: sssd_conf_d_files
+  when:
+  - '"sssd-common" in ansible_facts.packages'
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-80909-5
+  - DISA-STIG-RHEL-08-020250
+  - PCI-DSS-Req-8.3
+  - PCI-DSSv4-8.4
+  - configure_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - no_reboot_needed
+  - sssd_enable_smartcards
+
+- name: Fix pam_cert_auth configuration in /etc/sssd/conf.d/
+  ansible.builtin.replace:
+    path: '{{ item.path }}'
+    regexp: '[^#]*pam_cert_auth.*'
+    replace: pam_cert_auth = True
+  with_items: '{{ sssd_conf_d_files.files }}'
+  when:
+  - '"sssd-common" in ansible_facts.packages'
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-80909-5
+  - DISA-STIG-RHEL-08-020250
+  - PCI-DSS-Req-8.3
+  - PCI-DSSv4-8.4
+  - configure_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - no_reboot_needed
+  - sssd_enable_smartcards
+
 - name: Enable Smartcards in SSSD - Check if system relies on authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect

OCIL for rule 'xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration' differs.
--- ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1
+++ ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1
@@ -7,7 +7,7 @@
 If "cache_credentials" is set to "false" or is missing no further checks are required.
 
 To verify that SSSD expires offline credentials, run the following command:
-$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf
+$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf
 If configured properly, output should be
 offline_credentials_expiration = 1
       Is it the case that it does not exist or is not configured properly?

bash remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration' differs.
--- xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
+++ xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
@@ -9,7 +9,7 @@
 found=false
 
 # set value in all files if they contain section or key
-for f in $(echo -n "/etc/sssd/sssd.conf"); do
+for f in $(echo -n "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf"); do
     if [ ! -e "$f" ]; then
         continue
     fi
@@ -28,7 +28,7 @@
 
 # if section not in any file, append section with key = value to FIRST file in files parameter
 if ! $found ; then
-    file=$(echo "/etc/sssd/sssd.conf" | cut -f1 -d ' ')
+    file=$(echo "/etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf" | cut -f1 -d ' ')
     mkdir -p "$(dirname "$file")"
     echo -e "[pam]\noffline_credentials_expiration = 1" >> "$file"
 fi

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration' differs.
--- xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
+++ xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
@@ -88,3 +88,44 @@
   - medium_severity
   - no_reboot_needed
   - sssd_offline_cred_expiration
+
+- name: Find all the conf files inside /etc/sssd/conf.d/
+  find:
+    paths: /etc/sssd/conf.d/
+    patterns: '*.conf'
+  register: sssd_conf_d_files
+  when:
+  - '"sssd-common" in ansible_facts.packages'
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-82460-7
+  - DISA-STIG-RHEL-08-020290
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-IA-5(13)
+  - configure_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - no_reboot_needed
+  - sssd_offline_cred_expiration
+
+- name: Fix offline_credentials_expiration configuration in /etc/sssd/conf.d/
+  ansible.builtin.replace:
+    path: '{{ item.path }}'
+    regexp: '[^#]*offline_credentials_expiration.*'
+    replace: offline_credentials_expiration = 1
+  with_items: '{{ sssd_conf_d_files.files }}'
+  when:
+  - '"sssd-common" in ansible_facts.packages'
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-82460-7
+  - DISA-STIG-RHEL-08-020290
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-IA-5(13)
+  - configure_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - no_reboot_needed
+  - sssd_offline_cred_expiration

[jan-cerny]

The regular expression in the corresponding pattern element doesn't contain any capturing group which means there isn't any subexpression to be compared with. The 1 is literally a part of the regex. You would have to replace the 1 by a group (\d+) for this to work. Currently, this causes fails of the test scenarios.

[codeclimate]

Code Climate has analyzed commit 028b553 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.4% (0.1% change).

View more on Code Climate.

[jan-cerny]

OTOH On RHEL8 the output is sane:

jcerny@fedora:~/work/git/scap-security-guide (pr/11473)$  python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 sssd_enable_smartcards sssd_offline_cred_expiration
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-02-13-0922/test_suite.log
WARNING - Script sssd_parameter_false.fail.sh is not applicable on given platform
WARNING - Script sssd_parameter_missing.fail.sh is not applicable on given platform
WARNING - Script sssd_parameter_missing_file.fail.sh is not applicable on given platform
WARNING - Script sssd_parameter_true.pass.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_disabled.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled.pass.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled_lower.pass.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_false.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_missing.fail.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_missing_file.fail.sh using profile (all) OK
INFO - Script authselect_smartcard_enabled_conf_d.pass.sh using profile (all) OK
INFO - Script authselect_sssd_parameter_false_conf_d.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
INFO - Script cache_credentials_false.pass.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_section.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_value_dropin.pass.sh using profile (all) OK
INFO - Script correct_value_conf_d.pass.sh using profile (all) OK
INFO - Script wrong_value_conf_d.fail.sh using profile (all) OK