Add RHCOS STIG content and enable for NIST #6046

redhatrises · 2020-09-03T21:40:12Z

Description:

Enable draft STIG for RHCOS
Enable rules for RHCOS4 that are in the draft STIG
Enable building of NIST Refs, CCE, and STIG tables

mildas · 2020-09-03T21:40:35Z

Changes identified:
Profile ospp on rhcos4:
Newly added profile.
Profile stig on rhcos4:
STIG profile extends changed OSPP profile.
Newly added profile.

Recommended tests to execute:
build_product rhcos4
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhcos4-ds.xml stig
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhcos4-ds.xml ospp

redhatrises · 2020-09-29T22:08:47Z

Moving this out of draft mode as the content builds correctly.

JAORMX · 2020-09-30T05:50:00Z

rhcos4/profiles/stig.profile

@@ -0,0 +1,23 @@
+documentation_complete: true


if this is a draft, why not set documentation_complete: false?

@JAORMX Need it to build so that updated transmission to DISA can happen.

JAORMX · 2020-09-30T05:51:32Z

rhcos4/profiles/ospp.profile

+    - var_ssh_client_rekey_limit_size=1G
+    - var_ssh_client_rekey_limit_time=1hour
+
+    # zIPl specific rules


@evgenyz is working on an alternative for kernel parameters: #6100 perhaps those names could be added here but commented out in the meantime?

Need the rules enabled so that updated transmission to DISA can easily happen without having to enable/disable rules. Can they be enabled and updated later when completed?

JAORMX · 2020-09-30T05:52:27Z

rhcos4/profiles/ospp.profile

+    - configure_crypto_policy
+    - configure_ssh_crypto_policy
+    - configure_openssl_crypto_policy
+    - configure_libreswan_crypto_policy


Let's comment this out for now since libreswan is not available in RHCOS

Currently, no. But it was submitted as part of the draft STIG. Need the rules enabled so that updated transmission to DISA can easily happen without having to enable/disable rules.

JAORMX · 2020-09-30T05:53:10Z

rhcos4/profiles/ospp.profile

+    - grub2_vsyscall_argument
+    - grub2_vsyscall_argument.role=unscored
+    - grub2_vsyscall_argument.severity=info
+    - grub2_pti_argument


@evgenyz is working on an alternative for kernel parameters: #6100 perhaps those names could be added here but commented out in the meantime?

Need the rules enabled so that updated transmission to DISA can easily happen without having to enable/disable rules. Can they be enabled and updated later when completed?

jhrozek · 2020-09-30T09:00:00Z

rhcos4/profiles/ospp.profile

+    - selinux_policytype
+
+    ### Application Whitelisting (RHEL 8)
+    - package_fapolicyd_installed


Are these rules relevant since fapolicyd is not part of RHCOS?

It is a requirement for STIG, yes.

jhrozek · 2020-09-30T09:00:12Z

rhcos4/profiles/ospp.profile

+    ### Configure USBGuard
+    - service_usbguard_enabled
+    - configure_usbguard_auditbackend
+    - usbguard_allow_hid_and_hub


Are these rules relevant since usbguard is not part of RHCOS?

We gotta research the extension mechanism in RHCOS [1], we could install usbguard nowadays with that.

[1] openshift/enhancements#317

jhrozek · 2020-09-30T09:00:55Z

rhcos4/profiles/ospp.profile

+    ## Disable Unauthenticated Login (such as Guest Accounts)
+    ## FIA_UAU.1
+    - require_singleuser_auth
+    - grub2_disable_interactive_boot


Do we know if these rules work with the RHCOS bootloader?

That's a good question. Something we gotta research.

jhrozek · 2020-09-30T09:02:54Z

rhcos4/profiles/stig.profile

+    - accounts_tmout
+    - sudo_remove_no_authenticate
+    - sudo_remove_nopasswd
+    - sudo_require_authentication


By default the core user is a member of the sudo group which has %sudo ALL=(ALL) NOPASSWD: ALL set in sudoers, this likely clash with the sudo rules above. Just saying.

Right, however it is a problem to just sudo without password. Also, I believe that the recommended guidance that we are going to also give is to remove the core user.

jhrozek · 2020-09-30T16:27:13Z

On Wed, Sep 30, 2020 at 09:15:50AM -0700, Gabe Alford wrote: @redhatrises commented on this pull request. > + - accounts_umask_etc_bashrc + - accounts_umask_etc_csh_cshrc + + ### Software update + - ensure_redhat_gpgkey_installed + + ### Kernel Config + ## Boot prompt + - grub2_audit_argument + - grub2_audit_backlog_limit_argument + - grub2_slub_debug_argument + - grub2_page_poison_argument + - grub2_vsyscall_argument + - grub2_vsyscall_argument.role=unscored + - grub2_vsyscall_argument.severity=info + - grub2_pti_argument Need the rules enabled so that updated transmission to DISA can easily happen without having to enable/disable rules. Can they be enabled and updated later when completed?

I guess? I haven't tested the rules, but I guess at worst the grub config file wouldn't be there and the result wouldn't be compliant.

redhatrises · 2020-09-30T22:00:38Z

On Wed, Sep 30, 2020 at 09:15:50AM -0700, Gabe Alford wrote: @redhatrises commented on this pull request. > + - accounts_umask_etc_bashrc + - accounts_umask_etc_csh_cshrc + + ### Software update + - ensure_redhat_gpgkey_installed + + ### Kernel Config + ## Boot prompt + - grub2_audit_argument + - grub2_audit_backlog_limit_argument + - grub2_slub_debug_argument + - grub2_page_poison_argument + - grub2_vsyscall_argument + - grub2_vsyscall_argument.role=unscored + - grub2_vsyscall_argument.severity=info + - grub2_pti_argument Need the rules enabled so that updated transmission to DISA can easily happen without having to enable/disable rules. Can they be enabled and updated later when completed?
I guess? I haven't tested the rules, but I guess at worst the grub config file wouldn't be there and the result wouldn't be compliant.

True. Equally, we aren't testing it yet either in CI/CD, but since this is draft and under review, which not only are there bound to be errors, but it the draft could change as well too.

openshift-ci-robot · 2020-10-12T13:03:35Z

@redhatrises: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-ocp4-cis	`202807a`	link	`/test e2e-aws-ocp4-cis`
ci/prow/e2e-aws-ocp4-cis-node	`202807a`	link	`/test e2e-aws-ocp4-cis-node`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

redhatrises · 2020-11-03T15:24:39Z

/retest

redhatrises · 2020-11-03T16:45:09Z

@openscap-ci test this please

openscap-ci · 2020-11-03T16:45:27Z

Changes identified:
Profiles:
ospp on rhcos4
stig on rhcos4

Show details

Profile ospp on rhcos4:
Newly added profile.
Profile stig on rhcos4:
Newly added profile.
STIG profile extends changed OSPP profile.

Recommended tests to execute:
build_product rhcos4
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhcos4-ds.xml ospp
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhcos4-ds.xml stig

JAORMX · 2020-11-03T16:47:04Z

Might wanna rebase this

redhatrises · 2020-11-03T16:53:07Z

Might wanna rebase this

Yeah... I was just wanting fresh tests.

redhatrises marked this pull request as draft September 3, 2020 21:40

openshift-ci-robot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 3, 2020

openshift-ci-robot added the needs-rebase Used by openshift-ci bot. label Sep 29, 2020

redhatrises force-pushed the enable_rhcos branch from b95a649 to 6c5c3aa Compare September 29, 2020 19:10

openshift-ci-robot removed the needs-rebase Used by openshift-ci bot. label Sep 29, 2020

redhatrises marked this pull request as ready for review September 29, 2020 22:06

openshift-ci-robot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 29, 2020

JAORMX suggested changes Sep 30, 2020

View reviewed changes

jhrozek reviewed Sep 30, 2020

View reviewed changes

redhatrises force-pushed the enable_rhcos branch 2 times, most recently from 32fab46 to 4bd1be1 Compare November 4, 2020 22:32

redhatrises added 4 commits November 25, 2020 16:11

Add RHCOS STIG content and enable for NIST

4f431df

Add SRG overlay

415191b

Enable rules and fix zipl template for RHCOS

9d8cc46

Remove standard profile for RHCOS

ec1c354

redhatrises force-pushed the enable_rhcos branch from 4bd1be1 to ec1c354 Compare November 25, 2020 23:17

carlosmmatos merged commit cedc4f6 into ComplianceAsCode:master Dec 2, 2020

redhatrises deleted the enable_rhcos branch December 2, 2020 21:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add RHCOS STIG content and enable for NIST #6046

Add RHCOS STIG content and enable for NIST #6046

redhatrises commented Sep 3, 2020 •

edited

Loading

mildas commented Sep 3, 2020

redhatrises commented Sep 29, 2020

JAORMX Sep 30, 2020

redhatrises Sep 30, 2020

JAORMX Sep 30, 2020

redhatrises Sep 30, 2020

JAORMX Sep 30, 2020

redhatrises Sep 30, 2020

JAORMX Sep 30, 2020

redhatrises Sep 30, 2020

jhrozek Sep 30, 2020

redhatrises Sep 30, 2020

jhrozek Sep 30, 2020

JAORMX Sep 30, 2020

jhrozek Sep 30, 2020

JAORMX Sep 30, 2020

jhrozek Sep 30, 2020

redhatrises Sep 30, 2020

jhrozek commented Sep 30, 2020 via email

redhatrises commented Sep 30, 2020

openshift-ci-robot commented Oct 12, 2020

redhatrises commented Nov 3, 2020

redhatrises commented Nov 3, 2020

openscap-ci commented Nov 3, 2020 •

edited

Loading

JAORMX commented Nov 3, 2020

redhatrises commented Nov 3, 2020

Add RHCOS STIG content and enable for NIST #6046

Add RHCOS STIG content and enable for NIST #6046

Conversation

redhatrises commented Sep 3, 2020 • edited Loading

Description:

mildas commented Sep 3, 2020

redhatrises commented Sep 29, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jhrozek commented Sep 30, 2020 via email

redhatrises commented Sep 30, 2020

openshift-ci-robot commented Oct 12, 2020

redhatrises commented Nov 3, 2020

redhatrises commented Nov 3, 2020

openscap-ci commented Nov 3, 2020 • edited Loading

JAORMX commented Nov 3, 2020

redhatrises commented Nov 3, 2020

redhatrises commented Sep 3, 2020 •

edited

Loading

openscap-ci commented Nov 3, 2020 •

edited

Loading