Update CIS RHEL8 Benchmark for v2.0.0 #9154

marcusburghardt · 2022-07-15T08:51:02Z

Description:

The current version of CIS RHEL8 Benchmark is v2.0.0.
However, the version used in the project was still v1.0.1. This commit updated all requirements in alignment to v2.0.0. Some requirements were removed, others included and many of them just have their IDs updated.

Although some pending requirements were updated to automated status where it was noticed a new rule was already available, this commit is not intended to update the profile coverage but simply update the requirements in alignment to v2.0.0. Profile coverage is out of scope in this PR.

Rationale:

Once the controlfile is in alignment to the current Benchmark version, we can more efficiently work on coverage.
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2058203
Fixes #9090

Review Hints:

The review process shouldn't be hard, but may be time-consuming. I tried to mitigate a little bit by splitting the updates by Chapters. So, my recommendation is to review the PR commit by commit, sequentially.

Reviewed the first chapter from RHEL8 CIS v2.0.0 and updated the relevant rules.

Reviewed the second chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Reviewed the third chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Reviewed the fourth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

…on rules Reviewed the fifth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Reviewed the sixth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

The current version of CIS RHEL8 Benchmark is v2.0.0. However, the version used in the project was still v1.0.1. This commit updated all requirements in alignment to v2.0.0. Some requirements were removed, others included and many of them just have their IDs updated. Although some pending requirements were updated to automated status where it was noticed a new rule was already available, this commit is not intended to update the profile coverage but simply update the requirements in alignment to v2.0.0. Profile coverage is out of scope in this commit.

github-actions · 2022-07-15T08:54:15Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

ggbecker · 2022-07-15T11:33:08Z

Looking at test results, there are two problems:

Missing CIS references:

*** rules of 'cis' profile missing CIS Refs: 295 of 297 have them [0% missing]
   package_nfs-utils_removed                       service_iptables_enabled

Missing CCE in RHEL8 and RHEL9

         Start 193: missing-cces-rhel8
192/258 Test #193: missing-cces-rhel8 .......................................................***Failed    1.63 sec
The following rules in ssg-rhel8-ds.xml are missing CCEs:
xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow
xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
xccdf_org.ssgproject.content_rule_service_iptables_enabled
xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule
xccdf_org.ssgproject.content_rule_set_iptables_default_rule
xccdf_org.ssgproject.content_rule_package_httpd_removed
xccdf_org.ssgproject.content_rule_package_dovecot_removed
xccdf_org.ssgproject.content_rule_package_samba_removed
xccdf_org.ssgproject.content_rule_package_net-snmp_removed

 207/258 Test #208: missing-cces-rhel9 .......................................................***Failed    1.42 sec
The following rules in ssg-rhel9-ds.xml are missing CCEs:
xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
xccdf_org.ssgproject.content_rule_service_iptables_enabled
xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule
xccdf_org.ssgproject.content_rule_set_iptables_default_rule
xccdf_org.ssgproject.content_rule_package_httpd_removed
xccdf_org.ssgproject.content_rule_package_dovecot_removed
xccdf_org.ssgproject.content_rule_package_samba_removed
xccdf_org.ssgproject.content_rule_package_net-snmp_removed

marcusburghardt · 2022-07-15T12:02:47Z

Looking at test results, there are two problems:

Missing CIS references:

*** rules of 'cis' profile missing CIS Refs: 295 of 297 have them [0% missing]
   package_nfs-utils_removed                       service_iptables_enabled

Missing CCE in RHEL8 and RHEL9

         Start 193: missing-cces-rhel8
192/258 Test #193: missing-cces-rhel8 .......................................................***Failed    1.63 sec
The following rules in ssg-rhel8-ds.xml are missing CCEs:
xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow
xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
xccdf_org.ssgproject.content_rule_service_iptables_enabled
xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule
xccdf_org.ssgproject.content_rule_set_iptables_default_rule
xccdf_org.ssgproject.content_rule_package_httpd_removed
xccdf_org.ssgproject.content_rule_package_dovecot_removed
xccdf_org.ssgproject.content_rule_package_samba_removed
xccdf_org.ssgproject.content_rule_package_net-snmp_removed

 207/258 Test #208: missing-cces-rhel9 .......................................................***Failed    1.42 sec
The following rules in ssg-rhel9-ds.xml are missing CCEs:
xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
xccdf_org.ssgproject.content_rule_service_iptables_enabled
xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule
xccdf_org.ssgproject.content_rule_set_iptables_default_rule
xccdf_org.ssgproject.content_rule_package_httpd_removed
xccdf_org.ssgproject.content_rule_package_dovecot_removed
xccdf_org.ssgproject.content_rule_package_samba_removed
xccdf_org.ssgproject.content_rule_package_net-snmp_removed

Right, I just saw them and will fix now.

github-actions · 2022-07-15T12:35:54Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow' differs:
--- old datastream
+++ new datastream
@@ -4,6 +4,7 @@
 register: users_nopasswd
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
+ - CCE-85953-8
 - NIST-800-53-CM-6(b)
 - NIST-800-53-CM-6.1(iv)
 - high_severity
@@ -21,6 +22,7 @@
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - users_nopasswd.stdout_lines | length > 0
 tags:
+ - CCE-85953-8
 - NIST-800-53-CM-6(b)
 - NIST-800-53-CM-6.1(iv)
 - high_severity

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_ip6tables_enabled' differs:
--- old datastream
+++ new datastream
@@ -15,6 +15,7 @@
 - '"iptables-ipv6" in ansible_facts.packages'
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
+ - CCE-85955-3
 - NIST-800-53-AC-4
 - NIST-800-53-CA-3(5)
 - NIST-800-53-CM-6(a)

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_iptables_enabled' differs:
--- old datastream
+++ new datastream
@@ -15,6 +15,7 @@
 - '"iptables" in ansible_facts.packages'
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
+ - CCE-85961-1
 - NIST-800-53-AC-4
 - NIST-800-53-CA-3(5)
 - NIST-800-53-CM-6(a)

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_package_httpd_removed' differs:
--- old datastream
+++ new datastream
@@ -3,6 +3,7 @@
 name: httpd
 state: absent
 tags:
+ - CCE-85970-2
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_package_dovecot_removed' differs:
--- old datastream
+++ new datastream
@@ -3,6 +3,7 @@
 name: dovecot
 state: absent
 tags:
+ - CCE-85976-9
 - disable_strategy
 - low_complexity
 - low_disruption

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_package_samba_removed' differs:
--- old datastream
+++ new datastream
@@ -3,6 +3,7 @@
 name: samba
 state: absent
 tags:
+ - CCE-85978-5
 - disable_strategy
 - low_complexity
 - low_disruption

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_package_net-snmp_removed' differs:
--- old datastream
+++ new datastream
@@ -3,6 +3,7 @@
 name: net-snmp
 state: absent
 tags:
+ - CCE-85980-1
 - disable_strategy
 - low_complexity
 - low_disruption

marcusburghardt · 2022-07-15T13:54:10Z

The service_iptables_enabled rule is failing in some CI jobs, but it was already removed from the controlfile. Probably, it is being triggered because it was included CCEs on it.

During the review of the CIS RHEL8 v2.0.0 some existing rules were liked to requirements. The CI tests identified rules without CCE or CIS reference for RHEL8. This commit fix the missing CCEs and references.

The service_iptables_enabled and service_ip6tables_enabled rules were initially included during the v2.0.0 review but during the tests they returned errors bacause the respective services are not present. These requirements will be reviewed separately.

codeclimate · 2022-07-15T14:51:48Z

Code Climate has analyzed commit b82df92 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 42.7% (0.0% change).

View more on Code Climate.

openshift-ci · 2022-07-15T16:06:08Z

@marcusburghardt: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-e8	`b82df92`	link	true	`/test e2e-aws-rhcos4-e8`
ci/prow/e2e-aws-rhcos4-high	`b82df92`	link	true	`/test e2e-aws-rhcos4-high`
ci/prow/e2e-aws-rhcos4-moderate	`b82df92`	link	true	`/test e2e-aws-rhcos4-moderate`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

mildas

Tested with CIS Server Level 2 kickstart test, results are fine. AutoMatus failing test is expected, because service_iptables_enabled can't be tested in properly tested in container.
I have found only misalignment in 5.3.5 requirement's title, but that can be updated in another PR.

ggbecker

Most of the changes here are related to references and those type of changes have really low risk in breaking something in the automated content. New rules selected into the controls file are easily testable and no changes to the automated content are being performed.

I find this a very low risk to be merged as it is.

mildas · 2022-07-15T16:35:33Z

controls/cis_rhel8.yml

    status: automated
    rules:
-      - journald_forward_to_syslog
+      - service_systemd-journald_enabled


systemd-journald rule is needed, because service_systemd-journald_enabled fails on package systemd-journald is installed now.

The systemd-journald service unit is part of systemd package. If the packagename is not informed to the template, the servicename is used as packagename by default. I will update the rule in another PR.

Mab879

These minor changes can be improved in later PRs.

Mab879 · 2022-07-15T14:43:43Z

controls/cis_rhel8.yml

-    status: automated
-    rules:
+    status: pending
+    related_rules:
      - service_iptables_enabled


These services can be obtained from the iptables-services packages.

Mab879 · 2022-07-15T16:14:04Z

controls/cis_rhel8.yml

      - service_avahi-daemon_disabled

+  # NEEDS RULE
+  - id: 2.2.4
+    title: Ensure CUPS is not enabled (Automated)


Suggested change

title: Ensure CUPS is not enabled (Automated)

title: Ensure CUPS is not installed (Automated)

Mab879 · 2022-07-15T16:32:45Z

controls/cis_rhel8.yml

+      - l1_workstation
+    status: automated
+    rules:
+      - package_iptables_installed


Add rule for iptables-services

Mab879 · 2022-07-15T16:40:17Z

controls/cis_rhel8.yml

+      - sudo_require_authentication
+
+  - id: 5.3.5
+    title: Ensure users must provide password for escalation (Automated)


Suggested change

title: Ensure users must provide password for escalation (Automated)

title: Ensure re-authentication for privilege escalation is not disabled globally (Automated)

marcusburghardt added 9 commits July 14, 2022 12:57

Update description in RHEL8 CIS profiles and controlfile for v2.0.0

7ea2024

Update RHEL8 CIS refereces for initial setup rules

da0715c

Reviewed the first chapter from RHEL8 CIS v2.0.0 and updated the relevant rules.

Update RHEL8 CIS refereces for services rules

850ead5

Reviewed the second chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Update RHEL8 CIS refereces for network configuration rules

9babd56

Reviewed the third chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Update RHEL8 CIS refereces for logging and auditing rules

95cfa85

Reviewed the fourth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Update RHEL8 CIS refereces for access, authentication and authorizati…

6d1e04c

…on rules Reviewed the fifth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Update RHEL8 CIS refereces for system maintainance rules

7f6d15d

Reviewed the sixth chapter from RHEL8 CIS v2.0.0 and updated the relevant rules

Remove CIS RHEL8 reference for rules not present on v2.0.0

0c66113

marcusburghardt requested a review from a team as a code owner July 15, 2022 08:51

marcusburghardt added RHEL8 Red Hat Enterprise Linux 8 product related. CIS CIS Benchmark related. labels Jul 15, 2022

marcusburghardt added this to the 0.1.63 milestone Jul 15, 2022

marcusburghardt mentioned this pull request Jul 15, 2022

RHEL 8 CIS 3.4.4.1.5 Ensure iptables is enabled and active (Automated) #7190

Closed

marcusburghardt added 2 commits July 15, 2022 16:00

Fix missing identifiers and references in rules

804906c

During the review of the CIS RHEL8 v2.0.0 some existing rules were liked to requirements. The CI tests identified rules without CCE or CIS reference for RHEL8. This commit fix the missing CCEs and references.

marcusburghardt force-pushed the rhel8-cis-200 branch from c4c5fdd to b82df92 Compare July 15, 2022 14:03

Mab879 self-assigned this Jul 15, 2022

mildas self-assigned this Jul 15, 2022

mildas approved these changes Jul 15, 2022

View reviewed changes

ggbecker approved these changes Jul 15, 2022

View reviewed changes

mildas reviewed Jul 15, 2022

View reviewed changes

Mab879 approved these changes Jul 15, 2022

View reviewed changes

Mab879 merged commit c77e866 into ComplianceAsCode:master Jul 15, 2022

marcusburghardt deleted the rhel8-cis-200 branch July 18, 2022 10:16

marcusburghardt mentioned this pull request Jul 18, 2022

CIS RHEL8 v2.0.0 small fixes #9165

Merged

yuumasato added the Highlight This PR/Issue should make it to the featured changelog. label Jul 29, 2022

marcusburghardt mentioned this pull request Oct 24, 2022

Include review hints section in PR template #9723

Merged

	title: Ensure CUPS is not enabled (Automated)
	title: Ensure CUPS is not installed (Automated)

	title: Ensure users must provide password for escalation (Automated)
	title: Ensure re-authentication for privilege escalation is not disabled globally (Automated)

Update CIS RHEL8 Benchmark for v2.0.0 #9154

Update CIS RHEL8 Benchmark for v2.0.0 #9154

Uh oh!

Conversation

marcusburghardt commented Jul 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

github-actions bot commented Jul 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ggbecker commented Jul 15, 2022

Uh oh!

marcusburghardt commented Jul 15, 2022

Uh oh!

github-actions bot commented Jul 15, 2022

Uh oh!

marcusburghardt commented Jul 15, 2022

Uh oh!

codeclimate bot commented Jul 15, 2022

Uh oh!

openshift-ci bot commented Jul 15, 2022

Uh oh!

mildas left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ggbecker left a comment

Choose a reason for hiding this comment

Uh oh!

mildas Jul 15, 2022

Choose a reason for hiding this comment

Uh oh!

marcusburghardt Jul 18, 2022

Choose a reason for hiding this comment

Uh oh!

Mab879 left a comment

Choose a reason for hiding this comment

Uh oh!

Mab879 Jul 15, 2022

Choose a reason for hiding this comment

Uh oh!

Mab879 Jul 15, 2022

Choose a reason for hiding this comment

Uh oh!

Mab879 Jul 15, 2022

Choose a reason for hiding this comment

Uh oh!

Mab879 Jul 15, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

marcusburghardt commented Jul 15, 2022 •

edited

Loading

github-actions bot commented Jul 15, 2022 •

edited

Loading

mildas left a comment •

edited

Loading