From ac5a43653e418d52ecba4f1469388615620cd731 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 29 Apr 2020 11:54:04 +0200 Subject: [PATCH 1/3] add ansible remediation --- .../ansible/shared.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml new file mode 100644 index 0000000000..3708226e66 --- /dev/null +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml @@ -0,0 +1,18 @@ +# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +# reboot = true +# strategy = restrict +# complexity = low +# disruption = low +# remediate syscalls +{{{ ansible_audit_augenrules_add_syscall_rule(syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification") }}} +{{{ ansible_audit_auditctl_add_syscall_rule(syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification") }}} + +# remediate watches +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/issue', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/issue', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/issue.net', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/issue.net', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/hosts', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/hosts', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_augenrules_add_watch_rule(path='/etc/sysconfig/network', permissions='wa', key='audit_rules_networkconfig_modification') }}} +{{{ ansible_audit_auditctl_add_watch_rule(path='/etc/sysconfig/network', permissions='wa', key='audit_rules_networkconfig_modification') }}} From 8de44a2ec24813affd51377bcaa8472b53b67e86 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 29 Apr 2020 11:54:23 +0200 Subject: [PATCH 2/3] improve tests --- .../tests/auditctl_correct_rules.pass.sh | 17 +++++++++++++++++ ...ules.pass.sh => augen_correct_rules.pass.sh} | 0 .../tests/partial_rules.fail.sh | 10 ++++++++++ 3 files changed, 27 insertions(+) create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/auditctl_correct_rules.pass.sh rename linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/{correct_rules.pass.sh => augen_correct_rules.pass.sh} (100%) create mode 100644 linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/partial_rules.fail.sh diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/auditctl_correct_rules.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/auditctl_correct_rules.pass.sh new file mode 100644 index 0000000000..ac5059f31c --- /dev/null +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/auditctl_correct_rules.pass.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +# profiles = xccdf_org.ssgproject.content_profile_pci-dss + +# use auditctl +sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service + + +rm -rf /etc/audit/rules.d/* +rm /etc/audit/audit.rules + +echo "-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/correct_rules.pass.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/augen_correct_rules.pass.sh similarity index 100% rename from linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/correct_rules.pass.sh rename to linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/augen_correct_rules.pass.sh diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/partial_rules.fail.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/partial_rules.fail.sh new file mode 100644 index 0000000000..4991b02369 --- /dev/null +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/tests/partial_rules.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +# profiles = xccdf_org.ssgproject.content_profile_pci-dss + +echo "-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification" >> /etc/audit/rules.d/some.rules +echo "-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification" >> /etc/audit/rules.d/some.rules +echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules +echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" >> /etc/audit/audit.rules From f488ee2cef17f8c5764b53d551beabdb8cbf0e60 Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 29 Apr 2020 17:13:12 +0200 Subject: [PATCH 3/3] fix metadata and rewrite remediation to use newer macro --- .../ansible/shared.yml | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml index 3708226e66..fa07d5bf94 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml @@ -1,11 +1,26 @@ # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -# reboot = true +# reboot =false # strategy = restrict # complexity = low # disruption = low # remediate syscalls -{{{ ansible_audit_augenrules_add_syscall_rule(syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification") }}} -{{{ ansible_audit_auditctl_add_syscall_rule(syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification") }}} +# +# What architecture are we on? +# +- name: Set architecture for audit tasks + set_fact: + audit_arch: "b{{ ansible_architecture | regex_replace('.*(\\d\\d$)','\\1') }}" + +- name: Remediate audit rules for network configuration for x86 + block: + {{{ ansible_audit_augenrules_add_syscall_rule(arch="b32", syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification")|indent(4) }}} + {{{ ansible_audit_auditctl_add_syscall_rule(arch="b32", syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification")|indent(4) }}} + +- name: Remediate audit rules for network configuration for x86_64 + block: + {{{ ansible_audit_augenrules_add_syscall_rule(arch="b64", syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification")|indent(4) }}} + {{{ ansible_audit_auditctl_add_syscall_rule(arch="b64", syscalls=["sethostname", "setdomainname"], key="audit_rules_networkconfig_modification")|indent(4) }}} + when: audit_arch == "b64" # remediate watches {{{ ansible_audit_augenrules_add_watch_rule(path='/etc/issue', permissions='wa', key='audit_rules_networkconfig_modification') }}}