Introduced rule to disable XDMCP in gdm #5997

matejak · 2020-08-11T16:49:51Z

Introduce a new rule to disable the insecure xdmcp.

TBD:

Ansible remediation
Make the Bash ini snippet a jinja macro.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1807173

matejak · 2020-08-11T17:12:33Z

The rule doesn't occur in any profile nor product.

@mildas That's wrong, it applies to all products. You are right that it doesn't belong to any profile.

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml

redhatrises · 2020-08-12T22:37:31Z

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml

+    to have those thin clients on a separate network that cannot be accessed by the outside world, and can only connect to the server.
+    The only point from which you need to access outside is the server. This type of set up should never use an unmanaged hub or other sniffable network.
+
+severity: medium


Since it is unencrypted, I believe that the severity is a high.

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml

redhatrises · 2020-08-12T22:55:07Z

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml

+    Check whether there is the xdmcp section in the gdm configuration - run <code>grep '^\s*\[xdmcp\]' /etc/gdm/custom.conf</code>
+    If no results are returned, the whole section is missing, in which case you can add it to the file
+    using printf - <code>printf '%\n' "" "[xdmcp]" "Enable=false" >> /etc/gdm/custom.conf</code>
+
+    If grep returned results, you have to open the custom.conf file in a text editor,
+    and make sure that there is only one assignment to Enable,
+    namely Enable=false between the beginning of the [xdmcp] section
+    and another section or the end of the file.


To ensure that XDMCP is disabled in /etc/gdm/custom.conf, run the following command:

grep -Pzo "\[xdmcp\]\nEnable=false" /etc/gdm/custom.conf

The output should return the following:

[xdmcp] Enable=false

redhatrises · 2020-08-12T23:00:59Z

shared/macros-bash.jinja

+elif grep -qs '[[:space:]]*\[{{{ section }}}]' '{{{ filename }}}'; then
+    sed -i '/[[:space:]]*\[{{{ section }}}]/a {{{ key }}}={{{ value }}}' '{{{ filename }}}'
+else
+    mkdir -p {{{ "/".join(filename.split("/")[:-1]) }}}


/etc/gdm and specifically /etc/gdm/custom.conf is owned by the gdm package. It would be better to check if gdm package exists or /etc/gdm/custom.conf exists rather than mkdir the directory and adding the file in the event that /etc/gdm/ doesn't exist.

The OVAL evaluates as not applicable if gdm is not installed, so this case is covered in case of oscap ... --remediate. Generally, that can be said about almost every config file that we remediate. Your point is legitimate, but if we decide to enforce this behavior, let it be a project-wide coordinated effort. The worst thing is a mix of approaches in similar remediations, which is inconsistent, and provides poor guidance to inexperienced content authors that learn by example.

oscap shouldn't remediate if not applicable and remediating something that isn't installed is pointless.

oscap won't execute this remediation if gdm is not installed.

Question: Why are we making directories? Seems like we shouldn't be doing this a part of remediations. Are there remediations that need to have a directory created that isn't provided by a rpm?

That's a good point, we can probably abort the remediation if the directory doesn't exist.

Done, non-applicability is assumed if the parent folder of the config file doesn't exist.

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml

matejak · 2020-08-17T13:44:31Z

@redhatrises I am happy to incorporate your suggestions, thanks for those!
The question of OCIL is not 100% clear to me, and neither is the way how we do remediations of config files. Could you please check those out?

JAORMX · 2020-08-31T09:28:48Z

/retest

jan-cerny · 2020-09-02T06:28:50Z

/retest

shared/macros-ansible.jinja

Co-authored-by: Gabe Alford <redhatrises@gmail.com>

If the parent folder of the config file to be remediated doesn't exist, don't do anything and just say that we think that remediation is not applicable.

Co-authored-by: Gabe Alford <redhatrises@gmail.com>

mildas · 2020-09-08T14:01:29Z

Changes identified:
Rule gnome_gdm_disable_xdmcp:
The rule doesn't occur in any profile nor product.
OVAL check is newly added.
Ansible remediation newly added.
Bash remediation is newly added.
Templatization usage changed.
Macro ansible_ini_file_set:
In Ansible remediation for gnome_gdm_disable_xdmcp.
Macro bash_ini_file_set:
In Bash remediation for gnome_gdm_disable_xdmcp.

openshift-ci-robot · 2020-09-08T14:10:08Z

@matejak: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-rhcos4-moderate	`0fd3aed`	link	`/test e2e-aws-rhcos4-moderate`
ci/prow/e2e-aws-ocp4-moderate	`0fd3aed`	link	`/test e2e-aws-ocp4-moderate`
ci/prow/e2e-aws-rhcos4-e8	`0fd3aed`	link	`/test e2e-aws-rhcos4-e8`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

redhatrises · 2020-09-08T22:35:11Z

I believe that everything has been addressed here. Merging. Any new issues can be fixed in follow up PRs.

matejak added this to the 0.1.52 milestone Aug 11, 2020

openshift-ci-robot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 11, 2020

matejak changed the title ~~[WIP] Introduced rule to disable XDMCP in gdm.~~ Introduced rule to disable XDMCP in gdm. Aug 12, 2020

openshift-ci-robot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 12, 2020

matejak force-pushed the xdmcp_disabled branch from ebe6c91 to 5c17687 Compare August 12, 2020 14:37

redhatrises reviewed Aug 12, 2020

View reviewed changes

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml Outdated Show resolved Hide resolved

redhatrises suggested changes Aug 13, 2020

View reviewed changes

matejak commented Aug 17, 2020

View reviewed changes

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml Outdated Show resolved Hide resolved

matejak commented Aug 17, 2020

View reviewed changes

linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_xdmcp/rule.yml Outdated Show resolved Hide resolved

jan-cerny changed the title ~~Introduced rule to disable XDMCP in gdm.~~ Introduced rule to disable XDMCP in gdm Aug 19, 2020

matejak mentioned this pull request Sep 4, 2020

Update sssd_ldap_start_tls OVAL, bash and ansible remediations. #6032

Merged

ggbecker reviewed Sep 7, 2020

View reviewed changes

shared/macros-ansible.jinja Show resolved Hide resolved

openshift-ci-robot added the needs-rebase Used by openshift-ci bot. label Sep 8, 2020

matejak force-pushed the xdmcp_disabled branch 2 times, most recently from c867e1f to 9af0340 Compare September 8, 2020 11:58

openshift-ci-robot removed the needs-rebase Used by openshift-ci bot. label Sep 8, 2020

matejak and others added 5 commits September 8, 2020 16:00

Introduced rule to disable XDMCP in gdm.

909d71a

Add Bash and Ansible remediations as Jinja macros.

b8a5bb0

Update rule description.

dbe1ffd

Co-authored-by: Gabe Alford <redhatrises@gmail.com>

Implement quasi-applicability check to the ini file bash remediation.

a7ff03d

If the parent folder of the config file to be remediated doesn't exist, don't do anything and just say that we think that remediation is not applicable.

Improved descriptions based on code review

0fd3aed

Co-authored-by: Gabe Alford <redhatrises@gmail.com>

matejak force-pushed the xdmcp_disabled branch from 9af0340 to 0fd3aed Compare September 8, 2020 14:01

redhatrises merged commit fbab84b into ComplianceAsCode:master Sep 8, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduced rule to disable XDMCP in gdm #5997

Introduced rule to disable XDMCP in gdm #5997

matejak commented Aug 11, 2020 •

edited

matejak commented Aug 11, 2020

redhatrises Aug 12, 2020

redhatrises Aug 12, 2020

redhatrises Aug 12, 2020

matejak Aug 17, 2020

redhatrises Aug 31, 2020

matejak Sep 2, 2020

redhatrises Sep 2, 2020

matejak Sep 3, 2020

matejak Sep 3, 2020

matejak commented Aug 17, 2020

JAORMX commented Aug 31, 2020

jan-cerny commented Sep 2, 2020

mildas commented Sep 8, 2020

openshift-ci-robot commented Sep 8, 2020

redhatrises commented Sep 8, 2020

Introduced rule to disable XDMCP in gdm #5997

Introduced rule to disable XDMCP in gdm #5997

Conversation

matejak commented Aug 11, 2020 • edited

matejak commented Aug 11, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

matejak commented Aug 17, 2020

JAORMX commented Aug 31, 2020

jan-cerny commented Sep 2, 2020

mildas commented Sep 8, 2020

openshift-ci-robot commented Sep 8, 2020

redhatrises commented Sep 8, 2020

matejak commented Aug 11, 2020 •

edited