[WIP] Add scap lockdown #120

carbonin · 2015-07-27T20:57:59Z

Exposes access to various SCAP settings through linux admin. A full list of items can be found on Trello (https://trello.com/c/Zh1TAxfm/50-8-7-1-phase-2-config-scap-stig-security)

Added a class to interface with the sshd_config file and a method that will apply the SCAP settings. https://bugzilla.redhat.com/show_bug.cgi?id=1219227 https://bugzilla.redhat.com/show_bug.cgi?id=1219228 https://bugzilla.redhat.com/show_bug.cgi?id=1219229 https://bugzilla.redhat.com/show_bug.cgi?id=1219230 https://bugzilla.redhat.com/show_bug.cgi?id=1219231

Currently disables the atd and autofs services. https://bugzilla.redhat.com/show_bug.cgi?id=1219224 https://bugzilla.redhat.com/show_bug.cgi?id=1219226

…mits.conf file This class will apply the fixes for two SCAP issues - no core dumps and limiting the number of simultaneous non-root logins to 10. https://bugzilla.redhat.com/show_bug.cgi?id=1219246 https://bugzilla.redhat.com/show_bug.cgi?id=1219247

The Securetty.remove_vcs method will remove all virtual console entries from the /etc/securetty file. https://bugzilla.redhat.com/show_bug.cgi?id=1219248

The key value syntax used with this method will be the same for many files we are editing.

Currently the class will set the minimum password age to one day. https://bugzilla.redhat.com/show_bug.cgi?id=1219250

Currently sets INACTIVE to 35 days for SCAP requirements https://bugzilla.redhat.com/show_bug.cgi?id=1219252

…t for the other classes

This file dictates that specific files or actions on the system should be watched by auditd. https://bugzilla.redhat.com/show_bug.cgi?id=1219256

…ectory This class will disable loading a specified module into the kernel by setting the module install to stub to /bin/true in a file in the /etc/modprobe.d directory. https://bugzilla.redhat.com/show_bug.cgi?id=1219257 https://bugzilla.redhat.com/show_bug.cgi?id=1219258 https://bugzilla.redhat.com/show_bug.cgi?id=1219259 https://bugzilla.redhat.com/show_bug.cgi?id=1219260

Fryguy · 2015-07-30T21:06:19Z

Are these OS specific? That is, do the file paths only apply to a particular OS? If so, we might have to put this in a subclass and call it via Distros or something.

carbonin · 2015-07-30T21:09:27Z

Most I would assume are not, I can check a sampling of distros though. What would be good coverage for that?

Fryguy · 2015-07-30T21:09:36Z

lib/linux_admin/security/limits_conf.rb

This pattern simplifies to just File.write(filename, new_text) If you need the extra new_line from the puts at the end you can append it to new_text manually above

Fryguy · 2015-07-30T21:21:53Z

What would be good coverage for that?

¯\_(ツ)_/¯

BTW, this is really nice...was this extracted from some other code or a script, or did you have to research this all yourself.

Fryguy · 2015-07-30T21:25:27Z

lib/linux_admin/security.rb

Should this method be named apply_scap_settings? Same question for AuditRules.

If they are all named the same, this could be written as:

[SshdConfig, Service, SysctlConf, LimitsConf, Securetty, LoginDefs, Useradd, AuditRules, AuditRules, Modprobe].each do |klass| klass.public_send(:apply_scap_settings) end

or you can multiline the class array if you prefer.

Yeah, I thought about that, but removing access to the vcs didn't seem really SCAP specific. I could make the method more generic then create an apply_scap_settings method or just have one that calls remove_vcs with the intention of creating other methods to edit this file in the future.

…ig files

carbonin · 2015-08-03T12:22:11Z

@Fryguy What should I do around the gem version for this PR?

Fryguy · 2015-08-03T13:49:26Z

Nothing. When we release we'll decide on the version number
On Aug 3, 2015 8:22 AM, "Nick Carboni" notifications@github.com wrote:

@Fryguy https://github.com/Fryguy What should I do around the gem
version for this PR?

—
Reply to this email directly or view it on GitHub
#120 (comment).

carbonin · 2015-08-03T17:43:01Z

Looks like everything is where we expect it to be in RHEL 7.1

Fryguy · 2015-08-03T18:50:58Z

lib/linux_admin/security/sshd_config.rb

I feel like this logic belongs right inside service.restart. That way the caller just calls service.restart, and the Service class takes care of it all. What do you think? Doesn't have to be in this PR.

Just did a quick test and it looks like restart will succeed even if the service is stopped. So I can just take the method out and call to LinuxAdmin::Service directly.

Requires ManageIQ/linux_admin#120

bdunne · 2015-08-03T19:17:26Z

lib/linux_admin/security/audit_rules.rb

Sorry, this seems strange to me. I'd prefer to see the [ ] syntax instead of the %w here.

I have no preference, I did it this was to appease RuboCop.

bdunne · 2015-08-03T19:37:29Z

spec/security/modprobe_spec.rb

You can use FileUtils.rm or rm_f to avoid the existence check

miq-bot · 2015-08-03T20:18:42Z

Checked commits carbonin@36ea797 .. carbonin@4d5b5f2 with rubocop 0.32.1 and haml-lint 0.13.0
21 files checked, 0 offenses detected
Everything looks good. 🍪

Fryguy · 2015-08-03T20:51:07Z

@carbonin Let's investigate OpenSCAP and see if we should proceed with this PR.

Fryguy · 2015-08-11T20:02:41Z

Closing in favor of #121

carbonin added 19 commits July 27, 2015 16:38

Added security file to linux_admin.rb requires

d53d735

Added SCAP security class for disabling service daemons

2829aca

Currently disables the atd and autofs services. https://bugzilla.redhat.com/show_bug.cgi?id=1219224 https://bugzilla.redhat.com/show_bug.cgi?id=1219226

Changed spec data directory from sshd_config to security

34e6e1d

Added SysctlConf to Security scap lockdown method

f51d5b4

Fixed hash alignment rubocop issue

7a87983

Added Securetty class for modifying the /etc/securetty file

d5b4aa2

The Securetty.remove_vcs method will remove all virtual console entries from the /etc/securetty file. https://bugzilla.redhat.com/show_bug.cgi?id=1219248

Moved common set_value method into Security::Common module

e15cd10

The key value syntax used with this method will be the same for many files we are editing.

Add new sshd spec to test for SCAP after moving set value to common spec

18e6fdc

Added SCAP settings test to limits_conf spec and cleaned up other tests

407ce0b

Added class to handle edits to the login.defs file

bad9946

Currently the class will set the minimum password age to one day. https://bugzilla.redhat.com/show_bug.cgi?id=1219250

Added Useradd class to manage the /etc/default/useradd file

b9f5b59

Currently sets INACTIVE to 35 days for SCAP requirements https://bugzilla.redhat.com/show_bug.cgi?id=1219252

Fully qualify Common module in Secuirty classes.

296cfd1

Add explicit require of security common module to ensure it is presen…

64f62b0

…t for the other classes

Added class to handle editing of the audit.rules file

142ce15

This file dictates that specific files or actions on the system should be watched by auditd. https://bugzilla.redhat.com/show_bug.cgi?id=1219256

Handle Modprobe cases where the target file doesn't exist

21af188

Fryguy reviewed Jul 30, 2015
View reviewed changes

Added new line character to regex to avoid adding empty lines in conf…

d641a04

…ig files

Make helper method in Security::Service private

4361161

carbonin added 5 commits August 3, 2015 11:08

Add apply_scap_settings for Securetty class

1b6f4b4

Change Security classes to use instance rather than class methods

bd55a38

Restart sshd service after changing config file

622d6b2

Change Security class method to instance method

203712e

Changed spec method convention from class to instance (using #)

b1d597a

carbonin changed the title ~~[WIP] Add scap lockdown~~ Add scap lockdown Aug 3, 2015

Align items in AuditRules constant

153d82f

Fryguy reviewed Aug 3, 2015
View reviewed changes

carbonin added a commit to carbonin/manageiq that referenced this pull request Aug 3, 2015

Added appliance console menu item for applying SCAP configuration

aba7c55

Requires ManageIQ/linux_admin#120

carbonin mentioned this pull request Aug 3, 2015

[WIP] Added appliance console menu item for applying SCAP configuration ManageIQ/manageiq#3699

Closed

bdunne reviewed Aug 3, 2015
View reviewed changes

Remove unnecessary restart_service method in SshdConfig class

a8948be

bdunne reviewed Aug 3, 2015
View reviewed changes

spec/security/modprobe_spec.rb Outdated

Copy link

Member

bdunne Aug 3, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use FileUtils.rm or rm_f to avoid the existence check

carbonin added 2 commits August 3, 2015 16:04

Cleaned up Security::Common.replace_config_line

c17840d

Changed file existance check and delete to FileUtils.rm_f

4d5b5f2

Fryguy changed the title ~~Add scap lockdown~~ [WIP] Add scap lockdown Aug 4, 2015

Fryguy closed this Aug 11, 2015

carbonin deleted the add_scap_lockdown branch February 12, 2016 18:12

[WIP] Add scap lockdown #120

[WIP] Add scap lockdown #120

Uh oh!

Conversation

carbonin commented Jul 27, 2015

Uh oh!

Fryguy commented Jul 30, 2015

Uh oh!

carbonin commented Jul 30, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Fryguy commented Jul 30, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

carbonin commented Aug 3, 2015

Uh oh!

Fryguy commented Aug 3, 2015

Uh oh!

carbonin commented Aug 3, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

miq-bot commented Aug 3, 2015

Uh oh!

Fryguy commented Aug 3, 2015

Uh oh!

Fryguy commented Aug 11, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants