[Debian12] Add support debian and change logic platform for host based firewall

[Blasci]

Description:

• Add debian platform in differents files and change logic to follow CIS Benchmark
• Add service ufw disable rule
• Separate package iptables and iptables-persistent
• Sometimes add also ubuntu2404 production because it's very similiar

Rationale:

To follow the logic of the CIS benchmark recommendations :
When ufw is chosen :

• 4.2.1 Ensure ufw is installed
• 4.2.2 Ensure iptables-persistent is not installed with ufw (don't check for nftables)
• 4.2.3 - 4.2.7 Add support Debian and check when package ufw is installed

When nftables is chosen :

• 4.3.1 Ensure nftables is installed
• 4.3.2 Ensure ufw is uninstalled or disabled with nftables (don't check for iptables(-persistent))
• 4.3.3 - 4.3.10 Add support Debian and check when package nftables is installed

When iptables is chosen :

• 4.4.1.1 Ensure iptables packages are installed
• 4.4.1.2 Ensure nftables is not in use with iptables (don't check if removed, just disabled)
• 4.4.1.3 Ensure ufw is not in use with iptables (don't check if removed, just disabled)
• 4.4.2.X - 4.4.3.X Add support Debian and check when package iptables(-persistent) is installed

I started discussions on the CIS benchmarks because, in my opinion, there are missing recommendations in the following sections :
4.2 Configure UncomplicatedFirewall
https://workbench.cisecurity.org/community/197/discussions/11668

4.3 Configure nftables
https://workbench.cisecurity.org/community/197/discussions/11669

4.4.1 Configure iptables software
https://workbench.cisecurity.org/community/197/discussions/11671
https://workbench.cisecurity.org/community/197/discussions/11670

Review Hints:

Based on CIS profile #13054
Include #13048
CIS 4.2.X, 4.3.X, 4.4.X

[openshift-ci]

Hi @Blasci. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_package_iptables_installed'
--- xccdf_org.ssgproject.content_rule_package_iptables_installed
+++ xccdf_org.ssgproject.content_rule_package_iptables_installed
@@ -1,4 +1,2 @@
 oval:ssg-installed_OS_is_rhcos4_rhel9:def:1
-oval:ssg-service_disabled_nftables:def:1
-oval:ssg-service_disabled_ufw:def:1
 oval:ssg-system_with_kernel:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_package_nftables_installed' differs.
--- xccdf_org.ssgproject.content_rule_package_nftables_installed
+++ xccdf_org.ssgproject.content_rule_package_nftables_installed
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if ( rpm --quiet -q kernel ); then
+if rpm --quiet -q kernel; then
 
 if ! rpm -q --quiet "nftables" ; then
     yum install -y "nftables"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_package_nftables_installed' differs.
--- xccdf_org.ssgproject.content_rule_package_nftables_installed
+++ xccdf_org.ssgproject.content_rule_package_nftables_installed
@@ -16,7 +16,7 @@
   package:
     name: nftables
     state: present
-  when: ( "kernel" in ansible_facts.packages )
+  when: '"kernel" in ansible_facts.packages'
   tags:
   - CCE-86376-1
   - PCI-DSSv4-1.2

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_package_nftables_installed'
--- xccdf_org.ssgproject.content_rule_package_nftables_installed
+++ xccdf_org.ssgproject.content_rule_package_nftables_installed
@@ -1,3 +1 @@
-oval:ssg-service_disabled_iptables:def:1
-oval:ssg-service_disabled_ufw:def:1
 oval:ssg-system_with_kernel:def:1

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_nftables_enabled'
--- xccdf_org.ssgproject.content_rule_service_nftables_enabled
+++ xccdf_org.ssgproject.content_rule_service_nftables_enabled
@@ -1,3 +1,2 @@
 oval:ssg-package_nftables:def:1
-oval:ssg-service_disabled_firewalld:def:1
 oval:ssg-system_with_kernel:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_nftables_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_nftables_disabled
+++ xccdf_org.ssgproject.content_rule_service_nftables_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if ( rpm --quiet -q firewalld && rpm --quiet -q nftables && rpm --quiet -q kernel ); then
+if rpm --quiet -q kernel; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_nftables_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_nftables_disabled
+++ xccdf_org.ssgproject.content_rule_service_nftables_disabled
@@ -19,8 +19,7 @@
   changed_when: false
   failed_when: service_exists.rc not in [0, 1]
   check_mode: false
-  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
-    and "kernel" in ansible_facts.packages )
+  when: '"kernel" in ansible_facts.packages'
   tags:
   - CCE-88428-8
   - PCI-DSSv4-1.2
@@ -39,8 +38,7 @@
     enabled: false
     masked: true
   when:
-  - ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
-    and "kernel" in ansible_facts.packages )
+  - '"kernel" in ansible_facts.packages'
   - service_exists.stdout_lines is search("nftables.service", multiline=True)
   tags:
   - CCE-88428-8
@@ -59,8 +57,7 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
-    and "kernel" in ansible_facts.packages )
+  when: '"kernel" in ansible_facts.packages'
   tags:
   - CCE-88428-8
   - PCI-DSSv4-1.2
@@ -79,8 +76,7 @@
     state: stopped
     masked: true
   when:
-  - ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
-    and "kernel" in ansible_facts.packages )
+  - '"kernel" in ansible_facts.packages'
   - socket_file_exists.stdout_lines is search("nftables.socket", multiline=True)
   tags:
   - CCE-88428-8

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_nftables_disabled'
--- xccdf_org.ssgproject.content_rule_service_nftables_disabled
+++ xccdf_org.ssgproject.content_rule_service_nftables_disabled
@@ -1,3 +1 @@
-oval:ssg-package_firewalld:def:1
-oval:ssg-package_nftables:def:1
 oval:ssg-system_with_kernel:def:1

[mpurg]

I think the fix might break SLE products. I suggest changing to:

value: firewalld|nftables
value@ubuntu2404: nftables
value@debian12: nftables

[mpurg]

Is package[iptables-persistent] needed here?

[mpurg]

This change might break thing for SLE. See #10812

[mpurg]

If package[nftables] applicability needed here?
This will prevent ufw from being removed when nftables is not installed.

[mpurg]

Please fix the file so it ends with a newline character. Same for most profile files.

[mpurg]

Are the applicability checks needed? The service_disabled_guard_var should take care of the logic of enabling the chosen firewall and disabling all others.

[openshift-merge-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.