Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rebase local branch #20

Closed
wants to merge 11 commits into from
Closed

rebase local branch #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
cf588c2
"RHEL6" => "RHEL 6" naming scheme
shawndwells May 13, 2014
5b568ff
Removing whitespace in primary README
shawndwells May 13, 2014
6819ee9
Updated README to reflect move to GitHub
shawndwells May 13, 2014
1cab5db
Created OVAL for aide_periodic_cron_checking
shawndwells Aug 8, 2014
4d7603b
Added bash remediation for aide_periodic_cron_checking
shawndwells Aug 8, 2014
d5df728
Updating README
shawndwells Aug 8, 2014
981809f
Merge pull request #1 from OpenSCAP/master
shawndwells Aug 8, 2014
a524ef8
Merge branch 'master' into crontab_oval
shawndwells Aug 8, 2014
4dc0469
Merge pull request #13 from shawndwells/aide_periodic_cron_checking
shawndwells Aug 8, 2014
54356dc
Merge pull request #14 from shawndwells/master
shawndwells Aug 8, 2014
434fa04
Merge pull request #2 from OpenSCAP/master
shawndwells Aug 8, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions RHEL/6/input/checks/aide_periodic_cron_checking.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../../shared/oval/aide_periodic_cron_checking.xml
1 change: 1 addition & 0 deletions RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../../../shared/fixes/bash/aide_periodic_cron_checking.sh
1 change: 1 addition & 0 deletions RHEL/6/input/system/software/integrity.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,7 @@ To determine that periodic AIDE execution has been scheduled, run the following
By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
</rationale>
<oval id="aide_periodic_cron_checking" />
<ident cce="27222-9" />
<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/>
</Rule>
Expand Down
1 change: 1 addition & 0 deletions RHEL/7/input/checks/aide_periodic_cron_checking.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../../shared/oval/aide_periodic_cron_checking.xml
1 change: 1 addition & 0 deletions RHEL/7/input/fixes/bash/aide_periodic_cron_checking.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../../../shared/fixes/bash/aide_periodic_cron_checking.sh
4 changes: 2 additions & 2 deletions docs/User_Guide/en-US/ch002-Downloading.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@
<title>EPEL (yum) Repositories</title>
<itemizedlist mark='bullet'>
<listitem>
<formalpara><title>Red Hat Enterprise Linux 6 (RHEL6)</title>
<para>If you are running RHEL6, you will need to enable the Extra Packages for Enterprise Linux
<formalpara><title>Red Hat Enterprise Linux 6 (RHEL 6)</title>
<para>If you are running RHEL 6, you will need to enable the Extra Packages for Enterprise Linux
(EPEL) repository. EPEL can be enabled by installing the epel-release RPM,
which contains the repository GPG key as well as configuration for yum. The
EPEL repository RPMs can be found at <ulink
Expand Down
1 change: 1 addition & 0 deletions shared/fixes/bash/aide_periodic_cron_checking.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
40 changes: 40 additions & 0 deletions shared/oval/aide_periodic_cron_checking.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
<def-group>
<definition class="compliance" id="aide_periodic_cron_checking" version="1">
<metadata>
<title>Configure Periodic Execution of AIDE</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
<platform>Red Hat Enterprise Linux 7</platform>
</affected>
<description>By default, AIDE does not install itself for periodic
execution. Periodically running AIDE is necessary to reveal
unexpected changes in installed files.
</description>
<reference source="galford" ref_id="20140808" ref_url="test_attestation" />
</metadata>
<criteria operator="OR">
<extend_definition comment="Aide is installed" negate="true" definition_ref="package_aide_installed" />
<criterion comment="run aide daily with cron" test_ref="test_aide_periodic_cron_checking" />
<criterion comment="run aide daily with cron" test_ref="test_aide_crond_checking" />
</criteria>
</definition>

<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="test_aide_periodic_cron_checking" version="1">
<ind:object object_ref="object_test_aide_periodic_cron_checking" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object comment="run aide daily with cron" id="object_test_aide_periodic_cron_checking" version="1">
<ind:filepath>/etc/crontab</ind:filepath>
<ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="test_aide_crond_checking" version="1">
<ind:object object_ref="object_test_aide_crond_checking" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object comment="run aide daily with cron" id="object_test_aide_crond_checking" version="1">
<ind:path>/etc/cron.d</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>