New rule for SLE 15 unnecessary_firewalld_services_ports_disabled #10090
Conversation
|
Hi @rumch-se. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Start a new ephemeral environment with changes proposed in this pull request: sle15 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
CCE code correction
|
|
||
| rationale: |- | ||
| To reduce the attack surface of a system, all services and ports should be blocked unless | ||
| required |
There was a problem hiding this comment.
| required | |
| required. |
| description: |- | ||
| Services and ports can be accepted or explicitly rejected or dropped by a zone. | ||
| For every zone, you can set a default behavior that handles incoming traffic that is not | ||
| further specified. Such behavior is defined by setting the target of the zone. There are three |
There was a problem hiding this comment.
| further specified. Such behavior is defined by setting the target of the zone. There are three | |
| further specified. Such behavior is defined by setting the target of the zone. There are three: |
| For every zone, you can set a default behavior that handles incoming traffic that is not | ||
| further specified. Such behavior is defined by setting the target of the zone. There are three | ||
| options - default, ACCEPT, REJECT, and DROP. | ||
| - <tt>ACCEPT</tt> - you accept all incoming packets except those disabled by a specific rule. |
There was a problem hiding this comment.
| - <tt>ACCEPT</tt> - you accept all incoming packets except those disabled by a specific rule. | |
| - <tt>ACCEPT</tt> - accept all incoming packets except those disabled by a specific rule. |
| further specified. Such behavior is defined by setting the target of the zone. There are three | ||
| options - default, ACCEPT, REJECT, and DROP. | ||
| - <tt>ACCEPT</tt> - you accept all incoming packets except those disabled by a specific rule. | ||
| - <tt>REJECT</tt> - you disable all incoming packets except those that you have allowed in |
There was a problem hiding this comment.
| - <tt>REJECT</tt> - you disable all incoming packets except those that you have allowed in | |
| - <tt>REJECT</tt> - disables all incoming packets except those that have been allowed in by |
| - <tt>ACCEPT</tt> - you accept all incoming packets except those disabled by a specific rule. | ||
| - <tt>REJECT</tt> - you disable all incoming packets except those that you have allowed in | ||
| specific rules and the source machine is informed about the rejection. | ||
| - <tt>DROP</tt> - you disable all incoming packets except those that you have allowed in |
There was a problem hiding this comment.
| - <tt>DROP</tt> - you disable all incoming packets except those that you have allowed in | |
| - <tt>DROP</tt> - disables all incoming packets except those that been have allowed in by |
| references: | ||
| cis@sle15: 3.5.1.6 | ||
|
|
||
| ocil_clause: 'Your system accepts all incoming packets for unnecessary services and ports' |
There was a problem hiding this comment.
| ocil_clause: 'Your system accepts all incoming packets for unnecessary services and ports' | |
| ocil_clause: 'the system accepts all incoming packets for unnecessary services and ports' |
| following command: | ||
| <pre>$ sudo firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do | ||
| firewall-cmd --list-all --zone=$ZN; done</pre> | ||
| If your have to remove an unnecessary service run the following command: |
There was a problem hiding this comment.
| If your have to remove an unnecessary service run the following command: | |
| To remove an unnecessary service, run the following command: |
| firewall-cmd --list-all --zone=$ZN; done</pre> | ||
| If your have to remove an unnecessary service run the following command: | ||
| <pre>$ sudo firewall-cmd --remove-service=<service></pre> | ||
| If you have to remove an unnecessary port run the following command: |
There was a problem hiding this comment.
| If you have to remove an unnecessary port run the following command: | |
| To remove an unnecessary port, run the following command: |
|
|
||
| prodtype: sle15 | ||
|
|
||
| title: 'Ensure unnecessary services and ports are not accepted' |
There was a problem hiding this comment.
| title: 'Ensure unnecessary services and ports are not accepted' | |
| title: 'Ensure Unnecessary Services and Ports Are Not Accepted' |
|
|
||
| description: |- | ||
| Services and ports can be accepted or explicitly rejected or dropped by a zone. | ||
| For every zone, you can set a default behavior that handles incoming traffic that is not |
There was a problem hiding this comment.
| For every zone, you can set a default behavior that handles incoming traffic that is not | |
| For every zone, a default behavior can be set that handles incoming traffic that is not |
|
Hello @Mab879 |
|
Code Climate has analyzed commit bff329e and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 49.5% (-0.2% change). View more on Code Climate. |
| references: | ||
| cis@sle15: 3.5.1.6 | ||
|
|
||
| ocil_clause: 'The system accepts all incoming packets for unnecessary services and ports' |
There was a problem hiding this comment.
| ocil_clause: 'The system accepts all incoming packets for unnecessary services and ports' | |
| ocil_clause: 'the system accepts incoming packets for unnecessary services and ports' |
|
Hello @Mab879 |
|
Failures in Automatus is expected due to prodtype. |
Description:
Rationale: