Update SRG-OS-000096-GPOS-00050 for RHEL 9 STIG #8497

jan-cerny · 2022-04-06T08:56:54Z

Description:

add missing fix texts, missing Ansible, improve OCIL

Rationale:

RHEL 9 STIG

github-actions · 2022-04-06T09:05:55Z

Start a new ephemeral environment with changes proposed in this pull request:

controls/stig_rhel9/SRG-OS-000096-GPOS-00050.yml

github-actions · 2022-04-06T09:10:11Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New datastream is missing OVAL for rule 'xccdf_org.ssgproject.content_rule_configure_firewalld_ports'.
New datastream is missing bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_firewalld_ports'.
OCIL for rule 'xccdf_org.ssgproject.content_rule_chronyd_client_only' differs:
--- old datastream
+++ new datastream
@@ -2,5 +2,5 @@
 $ grep '\bport\b' /etc/chrony.conf
 The output should return
 port 0
- Is it the case that it does not exist or port is set to non-zero value?
+ Is it the case that port is not set or port is set to non-zero value?
 
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_client_only'.
OCIL for rule 'xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network' differs:
--- old datastream
+++ new datastream
@@ -2,5 +2,5 @@
 $ grep '\bcmdport\b' /etc/chrony.conf
 The output should return
 cmdport 0
- Is it the case that it does not exist or port is set to non-zero value?
+ Is it the case that cmdport is not set or cmdport is set to non-zero value?
 
New datastream adds ansible remediation for rule 'xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network'.
OCIL for rule 'xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled' differs:
--- old datastream
+++ new datastream
@@ -17,5 +17,5 @@
 If it is a port:
 22/tcp
 
- Is it the case that ?
+ Is it the case that sshd service is disabled by firewall?
 
New datastream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled'.

Mab879 · 2022-04-12T12:31:55Z

/retest

…enabled During our work on SRG-OS-000096-GPOS-00050 we have discovered the following: - The requirement "The firewall should be configured sanely" isn't possible to be automated by SCAP because services and ports differ on different systems. - At the same time there is rule "configure_firewalld_ports" that tries to implement it. - The rule "configure_firewalld_ports" is internally inconsistent - its rationale and description are about generic firewall configuration, but OVAL and bash check and configure that sshd service is enabled in firewall. - But we also have rule firewalld_sshd_port_enabled which checks that sshd service is enabled in firewall. - Our STIG workflow recommends us that OCIL and fix should be aligned with bash and OVAL which means if we create OCIL and fix for rule configure_firewalld_ports according to this rule's existing bash and OVAL the rule would be even more internally inconsistent - it would be basically a copy of firewalld_sshd_port_enabled with a misleading generic title. Therefore, in this commit, we make the rule configure_firewalld_ports generic, remove everything related to sshd from this rule, remove OVAL and bash because of non-automated character of this rule, and instead update rule firewalld_sshd_port_enabled with the remediation. See discussion in the pull request: ComplianceAsCode#8497

Mab879 · 2022-04-14T12:59:40Z

/retest

Mab879 · 2022-04-14T15:17:52Z

@jan-cerny looks like this PR needs a rebase. Not sure why the boot hasn't told you about that.

…enabled During our work on SRG-OS-000096-GPOS-00050 we have discovered the following: - The requirement "The firewall should be configured sanely" isn't possible to be automated by SCAP because services and ports differ on different systems. - At the same time there is rule "configure_firewalld_ports" that tries to implement it. - The rule "configure_firewalld_ports" is internally inconsistent - its rationale and description are about generic firewall configuration, but OVAL and bash check and configure that sshd service is enabled in firewall. - But we also have rule firewalld_sshd_port_enabled which checks that sshd service is enabled in firewall. - Our STIG workflow recommends us that OCIL and fix should be aligned with bash and OVAL which means if we create OCIL and fix for rule configure_firewalld_ports according to this rule's existing bash and OVAL the rule would be even more internally inconsistent - it would be basically a copy of firewalld_sshd_port_enabled with a misleading generic title. Therefore, in this commit, we make the rule configure_firewalld_ports generic, remove everything related to sshd from this rule, remove OVAL and bash because of non-automated character of this rule, and instead update rule firewalld_sshd_port_enabled with the remediation. See discussion in the pull request: ComplianceAsCode#8497

jan-cerny · 2022-04-19T09:11:36Z

I have rebased this pull request on the top of the current upstream master branch and I have changed fix to fixtext.

…enabled During our work on SRG-OS-000096-GPOS-00050 we have discovered the following: - The requirement "The firewall should be configured sanely" isn't possible to be automated by SCAP because services and ports differ on different systems. - At the same time there is rule "configure_firewalld_ports" that tries to implement it. - The rule "configure_firewalld_ports" is internally inconsistent - its rationale and description are about generic firewall configuration, but OVAL and bash check and configure that sshd service is enabled in firewall. - But we also have rule firewalld_sshd_port_enabled which checks that sshd service is enabled in firewall. - Our STIG workflow recommends us that OCIL and fix should be aligned with bash and OVAL which means if we create OCIL and fix for rule configure_firewalld_ports according to this rule's existing bash and OVAL the rule would be even more internally inconsistent - it would be basically a copy of firewalld_sshd_port_enabled with a misleading generic title. Therefore, in this commit, we make the rule configure_firewalld_ports generic, remove everything related to sshd from this rule, remove OVAL and bash because of non-automated character of this rule, and instead update rule firewalld_sshd_port_enabled with the remediation. See discussion in the pull request: ComplianceAsCode#8497

...de/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml

jan-cerny · 2022-04-20T07:19:45Z

I have add fixtext to configure_firewalld_ports

This will make the macro text aligned with the bash remediation in the template shared/templates/kernel_module_disabled/bash.template.

…enabled During our work on SRG-OS-000096-GPOS-00050 we have discovered the following: - The requirement "The firewall should be configured sanely" isn't possible to be automated by SCAP because services and ports differ on different systems. - At the same time there is rule "configure_firewalld_ports" that tries to implement it. - The rule "configure_firewalld_ports" is internally inconsistent - its rationale and description are about generic firewall configuration, but OVAL and bash check and configure that sshd service is enabled in firewall. - But we also have rule firewalld_sshd_port_enabled which checks that sshd service is enabled in firewall. - Our STIG workflow recommends us that OCIL and fix should be aligned with bash and OVAL which means if we create OCIL and fix for rule configure_firewalld_ports according to this rule's existing bash and OVAL the rule would be even more internally inconsistent - it would be basically a copy of firewalld_sshd_port_enabled with a misleading generic title. Therefore, in this commit, we make the rule configure_firewalld_ports generic, remove everything related to sshd from this rule, remove OVAL and bash because of non-automated character of this rule, and instead update rule firewalld_sshd_port_enabled with the remediation. See discussion in the pull request: ComplianceAsCode#8497

Originally, check and remediation for enabling sshd ports were a part of rule configure_firewalld_ports, but that rule was meant to be generic. We moved these checks and remediations to firewalld_sshd_port_enabled. So we add firewalld_sshd_port_enabled to this control to keep the original intent.

jan-cerny · 2022-04-22T07:54:05Z

/retest

...de/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml

jan-cerny · 2022-04-29T09:01:27Z

I have Fix firewalld command for adding services

openshift-ci · 2022-04-29T11:21:50Z

@jan-cerny: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ocp4-cis	`fcbc1ac`	link	true	`/test e2e-aws-ocp4-cis`
ci/prow/e2e-aws-rhcos4-moderate	`fcbc1ac`	link	true	`/test e2e-aws-rhcos4-moderate`
ci/prow/e2e-aws-rhcos4-high	`fcbc1ac`	link	true	`/test e2e-aws-rhcos4-high`
ci/prow/e2e-aws-ocp4-cis-node	`fcbc1ac`	link	true	`/test e2e-aws-ocp4-cis-node`
ci/prow/e2e-aws-ocp4-high-node	`fcbc1ac`	link	true	`/test e2e-aws-ocp4-high-node`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

marcusburghardt

LGTM

marcusburghardt · 2022-04-29T17:11:47Z

@Mab879 , I didn't merge so you also have opportunity to update your last review. Thanks

Mab879 · 2022-05-02T15:20:07Z

Tests pass locally.

…enabled During our work on SRG-OS-000096-GPOS-00050 we have discovered the following: - The requirement "The firewall should be configured sanely" isn't possible to be automated by SCAP because services and ports differ on different systems. - At the same time there is rule "configure_firewalld_ports" that tries to implement it. - The rule "configure_firewalld_ports" is internally inconsistent - its rationale and description are about generic firewall configuration, but OVAL and bash check and configure that sshd service is enabled in firewall. - But we also have rule firewalld_sshd_port_enabled which checks that sshd service is enabled in firewall. - Our STIG workflow recommends us that OCIL and fix should be aligned with bash and OVAL which means if we create OCIL and fix for rule configure_firewalld_ports according to this rule's existing bash and OVAL the rule would be even more internally inconsistent - it would be basically a copy of firewalld_sshd_port_enabled with a misleading generic title. Therefore, in this commit, we make the rule configure_firewalld_ports generic, remove everything related to sshd from this rule, remove OVAL and bash because of non-automated character of this rule, and instead update rule firewalld_sshd_port_enabled with the remediation. See discussion in the pull request: ComplianceAsCode#8497

jan-cerny added the RHEL9 Red Hat Enterprise Linux 9 product related. label Apr 6, 2022

jan-cerny commented Apr 6, 2022

View reviewed changes

controls/stig_rhel9/SRG-OS-000096-GPOS-00050.yml Show resolved Hide resolved

Mab879 self-assigned this Apr 6, 2022

openshift-ci bot added the needs-rebase Used by openshift-ci bot. label Apr 15, 2022

jan-cerny force-pushed the SRG-OS-000096-GPOS-00050 branch from 0d7fea8 to 0e27fe0 Compare April 19, 2022 09:10

openshift-ci bot removed the needs-rebase Used by openshift-ci bot. label Apr 19, 2022

jan-cerny force-pushed the SRG-OS-000096-GPOS-00050 branch from 0e27fe0 to e5af623 Compare April 19, 2022 13:44

Mab879 requested changes Apr 19, 2022

View reviewed changes

...de/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml Show resolved Hide resolved

jan-cerny added 11 commits April 21, 2022 09:39

Add fix and improve OCIL in chronyd_client_only

21f4e59

Add Ansible to chronyd_client_only

d5b0deb

Add fix and improve OCIL in chronyd_no_chronyc_network

8a4f2ff

Add Ansible to chronyd_no_chronyc_network

fe378c1

Improve describe_module_disable macro

7294fb0

This will make the macro text aligned with the bash remediation in the template shared/templates/kernel_module_disabled/bash.template.

Add fix for kernel_module_dccp_disabled

ada074c

Fix description

ae9f4b3

Add OCIL clause and fix to firewalld_sshd_port_enabled

230099b

Add fixtext to configure_firewalld_ports

44697ba

jan-cerny force-pushed the SRG-OS-000096-GPOS-00050 branch from 35388d2 to 44697ba Compare April 21, 2022 07:40

jan-cerny added the DISA RHEL9 STIG Alignment label Apr 22, 2022

jan-cerny added this to the 0.1.62 milestone Apr 28, 2022

jan-cerny mentioned this pull request Apr 28, 2022

Update SRG-OS-000297-GPOS-00115 for RHEL9 STIG #8651

Merged

marcusburghardt requested changes Apr 28, 2022

View reviewed changes

...de/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml Outdated Show resolved Hide resolved

...de/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml Show resolved Hide resolved

Fix firewalld command for adding services

fcbc1ac

marcusburghardt approved these changes Apr 29, 2022

View reviewed changes

ggbecker assigned marcusburghardt May 2, 2022

ggbecker requested a review from Mab879 May 2, 2022 10:19

Mab879 approved these changes May 2, 2022

View reviewed changes

Mab879 merged commit b0a0f8c into ComplianceAsCode:master May 2, 2022

marcusburghardt added the STIG STIG Benchmark related. label Jun 23, 2022

Update SRG-OS-000096-GPOS-00050 for RHEL 9 STIG #8497

Update SRG-OS-000096-GPOS-00050 for RHEL 9 STIG #8497

Uh oh!

Conversation

jan-cerny commented Apr 6, 2022

Description:

Rationale:

Uh oh!

github-actions bot commented Apr 6, 2022

Uh oh!

Uh oh!

github-actions bot commented Apr 6, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mab879 commented Apr 12, 2022

Uh oh!

Mab879 commented Apr 14, 2022

Uh oh!

Mab879 commented Apr 14, 2022

Uh oh!

jan-cerny commented Apr 19, 2022

Uh oh!

Uh oh!

jan-cerny commented Apr 20, 2022

Uh oh!

jan-cerny commented Apr 22, 2022

Uh oh!

Uh oh!

Uh oh!

jan-cerny commented Apr 29, 2022

Uh oh!

openshift-ci bot commented Apr 29, 2022

Uh oh!

marcusburghardt left a comment

Choose a reason for hiding this comment

Uh oh!

marcusburghardt commented Apr 29, 2022

Uh oh!

Mab879 commented May 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Apr 6, 2022 •

edited

Loading