Added V-72317 #10

jburns12 · 2017-10-18T17:14:03Z

No description provided.

trevor-vaughan

Can you split these into two different PRs since they are unrelated and have different issues?

trevor-vaughan · 2017-10-18T19:53:55Z

controls/V-72253.rb

+  if !@macs.nil?
+    @macs.first.split(",").each do |mac|
+      describe mac do
+        it { should be_in ['hmac-sha2-256', 'hmac-sha2-512'] }


I'm not 100% sure that sha-512 works in FIPS mode (and I'm 80% sure that it doesn't in all versions of RHEL). This should be checked before it's pushed.

We're going to have to toggle some of these based on FIPS being enabled on the target system.

trevor-vaughan · 2017-10-18T19:55:19Z

controls/V-72317.rb

@@ -63,4 +72,14 @@
 finding."
  tag "fix": "Remove all unapproved tunnels from the system, or document them with
 the ISSO."
+
+    @conn_grep_results = inspec.command("grep -i issue /etc/audit/audit.rules").stdout.split("\n")


This doesn't seem right.

Openswan doesn't exist in EL7, only libreswan

Fixed that...sorry that was a really special testing mistake.

trevor-vaughan · 2017-10-18T19:58:09Z

controls/V-72317.rb

+
+    @conn_grep_results.each do |curr_line|
+        describe curr_line do
+          it { should be_in tunnels }


Checking for conn in the rules won't work because this is just "how it works".

Since this is an "unauthorized" finding, it has to always fail unless someone provides input as to what tunnels it's actually expecting.

We configure tunnels with Puppet in SIMP so I'm 100% sure that all other tunnels are purged. Otherwise, this is just a catch 22 check where you always have to ask if what is found is OK.

The audit rules thing was a mistake. I switched it to checking in the config files as the STIG mentions. The "tunnels" attribute will have to be populated with the expected tunnels so when an unexpected one is found it will fail.

jburns12 · 2017-10-18T20:19:39Z

I just moved V-72553 into its own PR and changed it back to the original here.

trevor-vaughan

May need changes, but willing to approve with an additional ticket.

trevor-vaughan · 2017-10-20T16:50:30Z

controls/V-72317.rb

@@ -63,4 +72,16 @@
 finding."
  tag "fix": "Remove all unapproved tunnels from the system, or document them with
 the ISSO."
+
+    @grep_ipsec_conf = inspec.command("grep -i conn /etc/ipsec.conf").stdout.split("\n")
+    @grep_ipsec_d = inspec.command("grep -i conn /etc/ipsec.d/*.conf").stdout.split("\n")


This needs to be changed to a full processor that will follow the include references in the main ipsec.conf file.

You can include things from literally anywhere and we're going to miss a lot of we don't follow the links.

A small modification of this will probably work just fine https://gist.github.com/trevor-vaughan/df6a3a0ca42a2c6f59b51d7375fe151a

@jburns12 If you want to move this to an additional ticket, we can push this through as it stands. I just don't want to lose the fact that it's not actually properly processing everything.

@trevor-vaughan That makes sense to me...I'll open another ticket in the next couple days. Since my time doing this work is limited at this point, this might end up getting picked up by another MITRE team member.

* * Reviewed all controls and fixed many issues * updated impact logic to account for Not Applicable cases * used the protected regex pattern `%r{ }` in place is // * fixed many false positives reported by end users * added TODOs to all controls that need to be enhanced * added a new attributes files for this branch for review * added logic so that all controls correctly report * removed most `only_if` statments and replaced with skips + impact 0.0 * removed all `severity` tags in lue of using `impact` Signed-off-by: Aaron Lippold <lippold@gmail.com> * * Added EXEMPT_HOME_USERS attribute attributes file * Removed extra attribute defn * Fixed typo in call to package resource * Updated attributes file Signed-off-by: Bradley Shelton <bsheltonihs@gmail.com> * small change to push file Signed-off-by: Aaron Lippold <lippold@gmail.com> * * updated V-71863 fix the banner compare * updated V-71961 to account for multiple users * added attrubutes to support each Signed-off-by: Bradley Shelton <bsheltonihs@gmail.com>

Jennifer Burns added 4 commits October 18, 2017 12:49

Added V-72317

44569d8

Updated V-72253 and V-72317

bf4e529

Fixed nil class error during inspec check

de8e6c5

Merge remote-tracking branch 'upstream/master' into todos

5bae723

jburns12 requested review from aaronlippold and trevor-vaughan October 18, 2017 17:15

Removed camelCase variables

f904cab

trevor-vaughan suggested changes Oct 18, 2017

View reviewed changes

Jennifer Burns added 2 commits October 18, 2017 16:06

Added correct inspec commands

ec7ffcb

Set V-72253 to original

fcdaf09

trevor-vaughan changed the title ~~Added V-72317 and updated V-72253~~ Added V-72317 Oct 18, 2017

trevor-vaughan reviewed Oct 20, 2017

View reviewed changes

trevor-vaughan mentioned this pull request Nov 9, 2017

Ensure that the entire 'ipsec' configuration is read for processing in V-72317 #12

Closed

trevor-vaughan approved these changes Nov 9, 2017

View reviewed changes

trevor-vaughan merged commit 8117fed into simp:master Nov 9, 2017

aaronlippold deleted the todos branch April 28, 2018 11:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added V-72317 #10

Added V-72317 #10

jburns12 commented Oct 18, 2017

trevor-vaughan left a comment

trevor-vaughan Oct 18, 2017

trevor-vaughan Oct 18, 2017

trevor-vaughan Oct 18, 2017

jburns12 Oct 18, 2017

trevor-vaughan Oct 18, 2017

jburns12 Oct 18, 2017

jburns12 commented Oct 18, 2017

trevor-vaughan left a comment

trevor-vaughan Oct 20, 2017

jburns12 Oct 20, 2017

Added V-72317 #10

Added V-72317 #10

Conversation

jburns12 commented Oct 18, 2017

trevor-vaughan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jburns12 commented Oct 18, 2017

trevor-vaughan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment