From 023412217f4a73e47a7b5d8786b2b10974015615 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 19 Mar 2020 16:55:29 +0100 Subject: [PATCH 1/4] Make banner_etc_motd like banner_etc_issue Both rules source the banner from the same XCCDF variable. --- .../banner_etc_motd/bash/shared.sh | 18 +++++++++++++----- .../banner_etc_motd/oval/shared.xml | 8 +++++++- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh index ac04d93dd5..d731063b5a 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/bash/shared.sh @@ -2,12 +2,20 @@ . /usr/share/scap-security-guide/remediation_functions populate login_banner_text -# There was a regular-expression matching various banners, needs to be expanded -expanded=$(echo "$login_banner_text" | sed 's/(\\\\\x27)\*/\\\x27/g;s/(\\\x27)\*//g;s/(\^\(.*\)\$|.*$/\1/g;s/\[\\s\\n\][+*]/ /g;s/\\//g;s/[^-]- /\n\n-/g;s/(n)\**//g') -formatted=$(echo "$expanded" | fold -sw 80) +# Multiple regexes transform the banner regex into a usable banner +# 0 - Remove anchors around the banner text +{{{ bash_deregexify_banner_anchors("login_banner_text") }}} +# 1 - Keep only the first banners if there are multiple +# (dod_banners contains the long and short banner) +{{{ bash_deregexify_multiple_banners("login_banner_text") }}} +# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ") +{{{ bash_deregexify_banner_space("login_banner_text") }}} +# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n") +{{{ bash_deregexify_banner_newline("login_banner_text", "\\n") }}} +# 4 - Remove any leftover backslash. (From any parethesis in the banner, for example). +{{{ bash_deregexify_banner_backslash("login_banner_text") }}} +formatted=$(echo "$login_banner_text" | fold -sw 80) cat </etc/motd $formatted EOF - -printf "\n" >> /etc/motd diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml index dfd3bb69c0..9b20ee032a 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/oval/shared.xml @@ -18,14 +18,20 @@ + + /etc/motd - + ^(.*)$ 1 + + + + From 38e7680395d78371a12d3afd2561533d9f1860c3 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 19 Mar 2020 16:59:45 +0100 Subject: [PATCH 2/4] Add Ansible for banner_etc_motd --- .../banner_etc_motd/ansible/shared.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml new file mode 100644 index 0000000000..dfc1c519b7 --- /dev/null +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml @@ -0,0 +1,17 @@ +# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +# reboot = false +# strategy = unknown +# complexity = low +# disruption = medium +- (xccdf-var login_banner_text) + +- name: "{{{ rule_title }}} - remove incorrect banner" + file: + state: absent + path: /etc/motd + +- name: "{{{ rule_title }}} - add correct banner" + lineinfile: + dest: /etc/motd + line: '{{{ ansible_deregexify_banner_etc_issue("login_banner_text") }}}' + create: yes From c6ea356cef8678cdf248fc8363767d8615fb7423 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 19 Mar 2020 17:20:38 +0100 Subject: [PATCH 3/4] Use profile "all" to test banner_etc_motd When the profile doesn't do any selection, the default value is used. When the variable doesn't define a default value, the first value is considered the default. The test scenarios of banner_etcmotd are aligned with the first value of login_banner_text. --- .../tests/banner_etc_motd_disa_dod_default_banner.pass.sh | 2 -- .../tests/banner_etc_motd_disa_dod_short.pass.sh | 2 -- .../tests/banner_etc_motd_disa_double_banner.fail.sh | 2 -- .../tests/banner_etc_motd_disa_usgcb_banner.fail.sh | 2 -- .../tests/banner_etc_motd_ospp_usbcg_banner.fail.sh | 2 -- .../tests/banner_etc_motd_ospp_usbcg_banner.pass.sh | 2 -- 6 files changed, 12 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh index a926abd7dd..96e5e11e5b 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_default_banner.pass.sh @@ -1,6 +1,4 @@ #!/bin/bash -# -# profiles = xccdf_org.ssgproject.content_profile_stig # dod_default banner echo "You are accessing a U.S. Government (USG) Information System (IS) that is diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh index a2624e1066..ddf1efa43c 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_dod_short.pass.sh @@ -1,6 +1,4 @@ #!/bin/bash -# -# profiles = xccdf_org.ssgproject.content_profile_stig # dod_short banner echo "I've read & consent to terms in IS user agreem't." > /etc/motd diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh index 93c00cfde7..8cd0d30fa9 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_double_banner.fail.sh @@ -1,6 +1,4 @@ #!/bin/bash -# -# profiles = xccdf_org.ssgproject.content_profile_stig # dod_default|dod_short banner echo "You are accessing a U.S. Government (USG) Information System (IS) that is diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh index 3878983a19..5abacbb535 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_disa_usgcb_banner.fail.sh @@ -1,6 +1,4 @@ #!/bin/bash -# -# profiles = xccdf_org.ssgproject.content_profile_stig # usgcb_default banner echo "-- WARNING -- This system is for the use of authorized users only. Individuals diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh index c82a8e39b2..43b2e0a2e9 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.fail.sh @@ -1,5 +1,3 @@ #!/bin/bash -# -# profiles = xccdf_org.ssgproject.content_profile_ospp echo "This is not the expected banner" > /etc/motd diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh index 41894c998b..5abacbb535 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh @@ -1,6 +1,4 @@ #!/bin/bash -# -# profiles = xccdf_org.ssgproject.content_profile_ospp # usgcb_default banner echo "-- WARNING -- This system is for the use of authorized users only. Individuals From 4cb5b1f167a1ac3de94626d82eb6d3779a443475 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Thu, 19 Mar 2020 18:04:14 +0100 Subject: [PATCH 4/4] Remove test that doesn't make sense At the moment no profile selects this rules. The value of the variable will be the default (first) value of variable login_banner_text. Thus, second pass test doesn't make sense. --- .../tests/banner_etc_motd_ospp_usbcg_banner.pass.sh | 10 ---------- 1 file changed, 10 deletions(-) delete mode 100644 linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh deleted file mode 100644 index 5abacbb535..0000000000 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/tests/banner_etc_motd_ospp_usbcg_banner.pass.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -# usgcb_default banner -echo "-- WARNING -- This system is for the use of authorized users only. Individuals -using this computer system without authority or in excess of their authority -are subject to having all their activities on this system monitored and -recorded by system personnel. Anyone using this system expressly consents to -such monitoring and is advised that if such monitoring reveals possible -evidence of criminal activity system personal may provide the evidence of such -monitoring to law enforcement officials." > /etc/motd