Fixes #227 : Add system_audit subsection in rootcheck #228

djmgit · 2020-03-09T15:29:39Z

The PR adds system_audit subsection configuration in rootcheck

djmgit · 2020-03-09T15:32:26Z

@rshad Please review.

rshad · 2020-03-10T10:20:08Z

Hi @djmgit !

Thank you again for contributing to Wazuh. Many interesting changes.

I'll be reviewing this PR as soon as possible.

Kr,

Rshad

…ry var.

rshad · 2020-03-18T18:02:43Z

Hi all!

Having set,

$ossec_rootcheck_system_audit = [
        "/var/ossec/etc/shared/system_audit_rcl.txt",
        "/var/ossec/etc/shared/system_audit_ssh.txt",
]

Puppet Output

root@agent-client-1:/var/ossec# puppet agent -t
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for agent-client-1
Info: Applying configuration version '1584552989'
Notice: /Stage[main]/Wazuh::Agent/Concat[ossec.conf]/File[/var/ossec/etc/ossec.conf]/content:
--- /var/ossec/etc/ossec.conf   2020-03-18 17:10:30.699103339 +0000
+++ /tmp/puppet-file20200318-19690-u64wlq       2020-03-18 17:36:36.223103339 +0000
@@ -37,6 +37,8 @@
     <frequency>43200</frequency>
     <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
     <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
+      <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
+      <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
     <skip_nfs>yes</skip_nfs>

 </rootcheck>

Info: Computing checksum on file /var/ossec/etc/ossec.conf
Info: FileBucket got a duplicate file {md5}c3c737c431b9a624f96675fa760d3bf1
Info: /Stage[main]/Wazuh::Agent/Concat[ossec.conf]/File[/var/ossec/etc/ossec.conf]: Filebucketed /var/ossec/etc/ossec.conf to puppet with sum c3c737c431b9a624f96675fa760d3bf1
Notice: /Stage[main]/Wazuh::Agent/Concat[ossec.conf]/File[/var/ossec/etc/ossec.conf]/content: content changed '{md5}c3c737c431b9a624f96675fa760d3bf1' to '{md5}aea8237268bd066a67c6cdca2f3208b2'
Info: Concat[ossec.conf]: Scheduling refresh of Service[wazuh-agent]
Notice: /Stage[main]/Wazuh::Agent/Service[wazuh-agent]: Triggered 'refresh' from 1 events
Notice: Applied catalog in 3.78 seconds

And when setting,

$ossec_rootcheck_system_audit = []

root@agent-client-1:/var/ossec# puppet agent -t
.
.
Notice: /Stage[main]/Wazuh::Agent/Concat[ossec.conf]/File[/var/ossec/etc/ossec.conf]/content:
--- /var/ossec/etc/ossec.conf   2020-03-18 17:48:45.503103339 +0000
+++ /tmp/puppet-file20200318-21987-16vvtjc      2020-03-18 17:51:06.439103339 +0000
@@ -37,8 +37,6 @@
     <frequency>43200</frequency>
     <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
     <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
-      <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
-      <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
     <skip_nfs>yes</skip_nfs>

 </rootcheck>
.
.
Notice: Applied catalog in 3.78 seconds

Added Changes

The defined paths are wrong. Getting the error:

2020/03/18 17:37:01 rootcheck: ERROR: No unixaudit file: './shared/system_audit_rcl.txt'
2020/03/18 17:37:01 rootcheck: ERROR: No unixaudit file: './shared/system_audit_ssh.txt'

So, when I tested the PR I replaced,

        "./shared/system_audit_rcl.txt",
        "./shared/system_audit_ssh.txt",

by

        "/var/ossec/etc/shared/system_audit_rcl.txt",
        "/var/ossec/etc/shared/system_audit_ssh.txt",

Removed the auxiliary variable default_rootcheck_system_audit.
Defined the variable for both Linux and Windows. Empty by default.
Added a condition to check if the files list is empty or not.

Kr,

Rshad

rshad

Added some changes in

96e2e89
624daa7
057f54e
f8614d0

rshad · 2020-03-18T18:03:52Z

manifests/agent.pp

@@ -81,6 +81,7 @@
  $ossec_rootcheck_frequency         = $wazuh::params_agent::ossec_rootcheck_frequency,
  $ossec_rootcheck_rootkit_files     = $wazuh::params_agent::ossec_rootcheck_rootkit_files,
  $ossec_rootcheck_rootkit_trojans   = $wazuh::params_agent::ossec_rootcheck_rootkit_trojans,
+  $ossec_rootcheck_system_audit      = $wazuh::params_agent::default_rootcheck_system_audit,


No need to use an auxiliary variable default_rootcheck_system_audit.

Changed in 624daa7 & 057f54e.

Thanks,

rshad · 2020-03-18T18:04:16Z

manifests/params_agent.pp

+      $default_rootcheck_system_audit = [
+        "./shared/system_audit_rcl.txt",
+        "./shared/system_audit_ssh.txt",
+      ]
+


No need to use an auxiliary variable default_rootcheck_system_audit.

Changed in 624daa7 & 057f54e.

Thanks,

rshad · 2020-03-18T18:05:03Z

templates/fragments/_rootcheck.erb

@@ -35,6 +35,11 @@
  <% if @ossec_rootcheck_rootkit_trojans-%>
  <rootkit_trojans><%= @ossec_rootcheck_rootkit_trojans %></rootkit_trojans>
  <%- end -%>
+  <%- if @ossec_rootcheck_system_audit -%>


I would check if the list is empty or not, rather than checking if it's defined.

Changed in 96e2e89

Thanks,

@rshad ah! my bad, thanks for pointing it out and fixing it :)

djmgit · 2020-03-18T18:32:00Z

@rshad Hi, great work :) Thanks for fixing and improving this PR.
I was wondering why you emptied out the audit list for Linux too? It worked with absolute path right?

rshad · 2020-03-18T19:22:03Z

@rshad Hi, great work :) Thanks for fixing and improving this PR.
I was wondering why you emptied out the audit list for Linux too? It worked with absolute path right?

Hi @djmgit !

With relative paths I got the following error:

2020/03/18 17:37:01 rootcheck: ERROR: No unixaudit file: './shared/system_audit_rcl.txt'
2020/03/18 17:37:01 rootcheck: ERROR: No unixaudit file: './shared/system_audit_ssh.txt'

With absolute paths it worked, but I removed them and set the list as empty because we set our wazuh-puppet configuration to generate an exact or most-similar configuration to the one given by default when installing wazuh from a package.

Kr,

Rshad

Fixes wazuh#227 : Add system_audit subsection in rootcheck

0b92465

The PR adds system_audit subsection configuration in rootcheck

rshad self-assigned this Mar 10, 2020

rshad self-requested a review March 18, 2020 16:15

rshad changed the base branch from master to devel March 18, 2020 16:16

rshad added 4 commits March 18, 2020 18:55

Fix condition to check if a list is empty

96e2e89

Defined sys. audit files for both linux and windows & removed auxilia…

624daa7

…ry var.

Change variable name

057f54e

Set system audit files array to empty by default

f8614d0

rshad approved these changes Mar 18, 2020

View reviewed changes

rshad added community enhancement labels Mar 18, 2020

rshad added this to the Sprint-108 milestone Mar 18, 2020

rshad merged commit 589aa38 into wazuh:devel Mar 18, 2020

rshad mentioned this pull request Mar 18, 2020

Rootcheck section is missing system audit subsection #227

Closed

rshad added this to To review in v3.12.0 via automation Mar 18, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #227 : Add system_audit subsection in rootcheck #228

Fixes #227 : Add system_audit subsection in rootcheck #228

djmgit commented Mar 9, 2020

djmgit commented Mar 9, 2020

rshad commented Mar 10, 2020

rshad commented Mar 18, 2020 •

edited

rshad left a comment

rshad Mar 18, 2020

rshad Mar 18, 2020

rshad Mar 18, 2020

djmgit Mar 18, 2020

djmgit commented Mar 18, 2020

rshad commented Mar 18, 2020

Fixes #227 : Add system_audit subsection in rootcheck #228

Fixes #227 : Add system_audit subsection in rootcheck #228

Conversation

djmgit commented Mar 9, 2020

djmgit commented Mar 9, 2020

rshad commented Mar 10, 2020

rshad commented Mar 18, 2020 • edited

rshad left a comment

Choose a reason for hiding this comment

rshad Mar 18, 2020

Choose a reason for hiding this comment

rshad Mar 18, 2020

Choose a reason for hiding this comment

rshad Mar 18, 2020

Choose a reason for hiding this comment

djmgit Mar 18, 2020

Choose a reason for hiding this comment

djmgit commented Mar 18, 2020

rshad commented Mar 18, 2020

rshad commented Mar 18, 2020 •

edited