|
 |
76240a |
From 2f38b61e9b6b26dab05443a9bf03642971cbeeef Mon Sep 17 00:00:00 2001
|
|
|
76240a |
From: Matthew Burket <mburket@redhat.com>
|
|
|
76240a |
Date: Fri, 23 Jul 2021 16:32:15 -0500
|
|
|
76240a |
Subject: [PATCH] Add new rule for RHEL-08-030710
|
|
|
76240a |
|
|
|
76240a |
---
|
|
|
76240a |
.../ansible/shared.yml | 5 +++
|
|
|
76240a |
.../bash/shared.sh | 6 +++
|
|
|
76240a |
.../oval/shared.xml | 44 +++++++++++++++++++
|
|
|
76240a |
.../rule.yml | 38 ++++++++++++++++
|
|
|
76240a |
.../tests/default_no_pass.fail.sh | 7 +++
|
|
|
76240a |
.../tests/rsyslog.pass.sh | 4 ++
|
|
|
76240a |
.../tests/rsyslog_wrong_value.fail.sh | 4 ++
|
|
|
76240a |
.../tests/rsyslogd.pass.sh | 4 ++
|
|
|
76240a |
.../tests/rsyslogd_wrong_value.fail.sh | 4 ++
|
|
|
76240a |
.../tests/setup.sh | 9 ++++
|
|
|
76240a |
.../ansible/shared.yml | 5 +++
|
|
|
76240a |
.../bash/shared.sh | 5 +++
|
|
|
76240a |
.../oval/shared.xml | 44 +++++++++++++++++++
|
|
|
76240a |
.../rule.yml | 38 ++++++++++++++++
|
|
|
76240a |
.../tests/default_no_pass.fail.sh | 7 +++
|
|
|
76240a |
.../tests/rsyslog.pass.sh | 4 ++
|
|
|
76240a |
.../tests/rsyslog_wrong_value.fail.sh | 4 ++
|
|
|
76240a |
.../tests/rsyslogd.pass.sh | 4 ++
|
|
|
76240a |
.../tests/rsyslogd_wrong_value.fail.sh | 4 ++
|
|
|
76240a |
.../tests/setup.sh | 9 ++++
|
|
|
76240a |
products/rhel8/profiles/stig.profile | 2 +
|
|
|
76240a |
shared/references/cce-redhat-avail.txt | 2 -
|
|
|
76240a |
.../data/profile_stability/rhel8/stig.profile | 2 +
|
|
|
76240a |
.../profile_stability/rhel8/stig_gui.profile | 2 +
|
|
|
76240a |
24 files changed, 255 insertions(+), 2 deletions(-)
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
|
|
|
76240a |
create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
|
|
|
76240a |
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..2d6c5227a8
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
|
|
|
76240a |
@@ -0,0 +1,5 @@
|
|
|
76240a |
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
|
|
|
76240a |
+
|
|
|
76240a |
+{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
|
|
|
76240a |
+ parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
|
|
|
76240a |
+}}}
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..36853d1786
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh
|
|
|
76240a |
@@ -0,0 +1,6 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
|
|
|
76240a |
+
|
|
|
76240a |
+{{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf",
|
|
|
76240a |
+ parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
|
|
|
76240a |
+}}}
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..d21f8af1e4
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
|
|
|
76240a |
@@ -0,0 +1,44 @@
|
|
|
76240a |
+
|
|
|
76240a |
+<def-group>
|
|
|
76240a |
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
|
|
|
76240a |
+ {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
|
|
|
76240a |
+ <criteria operator="AND">
|
|
|
76240a |
+ <criteria operator="OR">
|
|
|
76240a |
+
|
|
|
76240a |
+ test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
|
|
|
76240a |
+
|
|
|
76240a |
+ test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
|
|
|
76240a |
+ </criteria>
|
|
|
76240a |
+ </criteria>
|
|
|
76240a |
+ </definition>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
|
|
|
76240a |
+ id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" version="1">
|
|
|
76240a |
+
|
|
|
76240a |
+ <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
|
|
|
76240a |
+ </ind:textfilecontent54_test>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
|
|
|
76240a |
+ version="1">
|
|
|
76240a |
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
|
|
|
76240a |
+ <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
|
|
|
76240a |
+ <ind:instance datatype="int">1</ind:instance>
|
|
|
76240a |
+ </ind:textfilecontent54_object>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
|
|
|
76240a |
+ id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" version="1">
|
|
|
76240a |
+ <ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
|
|
|
76240a |
+ </ind:textfilecontent54_test>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d"
|
|
|
76240a |
+ version="1">
|
|
|
76240a |
+ <ind:path>/etc/rsyslog.d</ind:path>
|
|
|
76240a |
+ <ind:filename operation="pattern match">^.*conf$</ind:filename>
|
|
|
76240a |
+ <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
|
|
|
76240a |
+ <ind:instance datatype="int">1</ind:instance>
|
|
|
76240a |
+ </ind:textfilecontent54_object>
|
|
|
76240a |
+</def-group>
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..1bcc33927b
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml
|
|
|
76240a |
@@ -0,0 +1,38 @@
|
|
|
76240a |
+documentation_complete: true
|
|
|
76240a |
+
|
|
|
76240a |
+title: Ensure Rsyslog Encrypts Off-Loaded Audit Records
|
|
|
76240a |
+
|
|
|
76240a |
+description: |-
|
|
|
76240a |
+ Rsyslogd is a system utility providing support for message logging. Support
|
|
|
76240a |
+ for both internet and UNIX domain sockets enables this utility to support both local
|
|
|
76240a |
+ and remote logging. Couple this utility with <tt>gnutls</tt> (which is a secure communications
|
|
|
76240a |
+ library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
|
|
|
76240a |
+ encrypt and off-load auditing.
|
|
|
76240a |
+
|
|
|
76240a |
+ When using <tt>rsyslogd</tt> to off-load logs off a encrpytion system must be used.
|
|
|
76240a |
+
|
|
|
76240a |
+rationale: |-
|
|
|
76240a |
+ The audit records generated by Rsyslog contain valuable information regarding system
|
|
|
76240a |
+ configuration, user authentication, and other such information. Audit records should be
|
|
|
76240a |
+ protected from unauthorized access.
|
|
|
76240a |
+
|
|
|
76240a |
+severity: medium
|
|
|
76240a |
+
|
|
|
76240a |
+identifiers:
|
|
|
76240a |
+ cce@rhel8: CCE-86098-1
|
|
|
76240a |
+
|
|
|
76240a |
+references:
|
|
|
76240a |
+ disa: CCI-001851
|
|
|
76240a |
+ nist: AU-4(1)
|
|
|
76240a |
+ srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
|
|
|
76240a |
+ stigid@rhel8: RHEL-08-030710
|
|
|
76240a |
+
|
|
|
76240a |
+ocil_clause: 'rsyslogd ActionSendStreamDriverMode not set to 1'
|
|
|
76240a |
+
|
|
|
76240a |
+ocil: |-
|
|
|
76240a |
+ Verify the operating system encrypts audit records off-loaded onto a different system
|
|
|
76240a |
+ or media from the system being audited with the following commands:
|
|
|
76240a |
+
|
|
|
76240a |
+ $ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
|
|
|
76240a |
+ The output should be
|
|
|
76240a |
+ /etc/rsyslog.conf:$ActionSendStreamDriverMode 1
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..3ee5384371
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/default_no_pass.fail.sh
|
|
|
76240a |
@@ -0,0 +1,7 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+if [[ -f encrypt.conf ]]; then
|
|
|
76240a |
+ sed -i i/\$ActionSendStreamDriverMod//g /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
+fi
|
|
|
76240a |
+ sed -i i/\$ActionSendStreamDriverMod//g /etc/rsyslog.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..34105aaa85
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog.pass.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$ActionSendStreamDriverMode 1" >> /etc/rsyslog.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..db87b2956c
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_wrong_value.fail.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$ActionSendStreamDriverMode 0" >> /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..25e7cdf783
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd.pass.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$ActionSendStreamDriverMode 1" >> /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..d37882acf3
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslogd_wrong_value.fail.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$ActionSendStreamDriverMode 0" >> /etc/rsyslog
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..9686f16bcc
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/setup.sh
|
|
|
76240a |
@@ -0,0 +1,9 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+# Use this script to ensure the rsyslog directory structure and rsyslog conf file
|
|
|
76240a |
+# exist in the test env.
|
|
|
76240a |
+config_file=/etc/rsyslog.conf
|
|
|
76240a |
+
|
|
|
76240a |
+# Ensure directory structure exists (useful for container based testing)
|
|
|
76240a |
+test -f $config_file || touch $config_file
|
|
|
76240a |
+
|
|
|
76240a |
+test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..2ddbfb871f
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
|
|
|
76240a |
@@ -0,0 +1,5 @@
|
|
|
76240a |
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
|
|
|
76240a |
+
|
|
|
76240a |
+{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
|
|
|
76240a |
+ parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
|
|
|
76240a |
+}}}
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..3955346cd3
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh
|
|
|
76240a |
@@ -0,0 +1,5 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+# platform = Red Hat Enterprise Linux 8,multi_platform_fedora
|
|
|
76240a |
+{{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf",
|
|
|
76240a |
+ parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
|
|
|
76240a |
+}}}
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..71d39c179d
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
|
|
|
76240a |
@@ -0,0 +1,44 @@
|
|
|
76240a |
+
|
|
|
76240a |
+<def-group>
|
|
|
76240a |
+ <definition class="compliance" id="{{{ rule_id }}}" version="1">
|
|
|
76240a |
+ {{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
|
|
|
76240a |
+ <criteria operator="AND">
|
|
|
76240a |
+ <criteria operator="OR">
|
|
|
76240a |
+
|
|
|
76240a |
+ test_ref="test_{{{rule_id}}}_default_netstream_rsyslog" />
|
|
|
76240a |
+
|
|
|
76240a |
+ test_ref="test_{{{rule_id}}}_default_netstream_rsyslog_dir" />
|
|
|
76240a |
+ </criteria>
|
|
|
76240a |
+ </criteria>
|
|
|
76240a |
+ </definition>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
|
|
|
76240a |
+ id="test_{{{rule_id}}}_default_netstream_rsyslog" version="1">
|
|
|
76240a |
+
|
|
|
76240a |
+ <ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog" />
|
|
|
76240a |
+ </ind:textfilecontent54_test>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
|
|
|
76240a |
+ version="1">
|
|
|
76240a |
+ <ind:filepath>/etc/rsyslog.conf</ind:filepath>
|
|
|
76240a |
+ <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
|
|
|
76240a |
+ <ind:instance datatype="int">1</ind:instance>
|
|
|
76240a |
+ </ind:textfilecontent54_object>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
|
|
|
76240a |
+ id="test_{{{rule_id}}}_default_netstream_rsyslog_dir" version="1">
|
|
|
76240a |
+ <ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog_dir" />
|
|
|
76240a |
+ </ind:textfilecontent54_test>
|
|
|
76240a |
+
|
|
|
76240a |
+
|
|
|
76240a |
+ comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d"
|
|
|
76240a |
+ version="1">
|
|
|
76240a |
+ <ind:path>/etc/rsyslog.d</ind:path>
|
|
|
76240a |
+ <ind:filename operation="pattern match">^.*conf$</ind:filename>
|
|
|
76240a |
+ <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
|
|
|
76240a |
+ <ind:instance datatype="int">1</ind:instance>
|
|
|
76240a |
+ </ind:textfilecontent54_object>
|
|
|
76240a |
+</def-group>
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..eff85d3fae
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml
|
|
|
76240a |
@@ -0,0 +1,38 @@
|
|
|
76240a |
+documentation_complete: true
|
|
|
76240a |
+
|
|
|
76240a |
+title: Ensure Rsyslog Encrypts Off-Loaded Audit Records
|
|
|
76240a |
+
|
|
|
76240a |
+description: |-
|
|
|
76240a |
+ Rsyslogd is a system utility providing support for message logging. Support
|
|
|
76240a |
+ for both internet and UNIX domain sockets enables this utility to support both local
|
|
|
76240a |
+ and remote logging. Couple this utility with <tt>gnutls</tt> (which is a secure communications
|
|
|
76240a |
+ library implementing the SSL, TLS and DTLS protocols), and you have a method to securely
|
|
|
76240a |
+ encrypt and off-load auditing.
|
|
|
76240a |
+
|
|
|
76240a |
+ When using <tt>rsyslogd</tt> to off-load logs off a encrpytion system must be used.
|
|
|
76240a |
+
|
|
|
76240a |
+rationale: |-
|
|
|
76240a |
+ The audit records generated by Rsyslog contain valuable information regarding system
|
|
|
76240a |
+ configuration, user authentication, and other such information. Audit records should be
|
|
|
76240a |
+ protected from unauthorized access.
|
|
|
76240a |
+
|
|
|
76240a |
+severity: medium
|
|
|
76240a |
+
|
|
|
76240a |
+identifiers:
|
|
|
76240a |
+ cce@rhel8: CCE-85992-6
|
|
|
76240a |
+
|
|
|
76240a |
+references:
|
|
|
76240a |
+ disa: CCI-001851
|
|
|
76240a |
+ nist: AU-4(1)
|
|
|
76240a |
+ srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224
|
|
|
76240a |
+ stigid@rhel8: RHEL-08-030710
|
|
|
76240a |
+
|
|
|
76240a |
+ocil_clause: 'rsyslogd DefaultNetstreamDriver not set to gtls'
|
|
|
76240a |
+
|
|
|
76240a |
+ocil: |-
|
|
|
76240a |
+ Verify the operating system encrypts audit records off-loaded onto a different system
|
|
|
76240a |
+ or media from the system being audited with the following commands:
|
|
|
76240a |
+
|
|
|
76240a |
+ $ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
|
|
|
76240a |
+ The output should be
|
|
|
76240a |
+ /etc/rsyslog.conf:$DefaultNetstreamDriver gtls
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..6ab43bfc0d
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/default_no_pass.fail.sh
|
|
|
76240a |
@@ -0,0 +1,7 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+if [[ -f encrypt.conf ]]; then
|
|
|
76240a |
+ sed -i i/\$DefaultNetstreamDriver*.$//g /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
+fi
|
|
|
76240a |
+ sed -i i/\$DefaultNetstreamDriver*.$//g /etc/rsyslog.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..40f1bfe087
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog.pass.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$DefaultNetstreamDriver gtls" >> /etc/rsyslog.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..30a1d5b43a
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_wrong_value.fail.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$DefaultNetstreamDriver none" >> /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..44715bca66
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd.pass.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$DefaultNetstreamDriver gtls" >> /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..30a1d5b43a
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslogd_wrong_value.fail.sh
|
|
|
76240a |
@@ -0,0 +1,4 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+bash -x setup.sh
|
|
|
76240a |
+
|
|
|
76240a |
+echo "\$DefaultNetstreamDriver none" >> /etc/rsyslog.d/encrypt.conf
|
|
|
76240a |
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
|
|
|
76240a |
new file mode 100644
|
|
|
76240a |
index 0000000000..9686f16bcc
|
|
|
76240a |
--- /dev/null
|
|
|
76240a |
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/setup.sh
|
|
|
76240a |
@@ -0,0 +1,9 @@
|
|
|
76240a |
+#!/bin/bash
|
|
|
76240a |
+# Use this script to ensure the rsyslog directory structure and rsyslog conf file
|
|
|
76240a |
+# exist in the test env.
|
|
|
76240a |
+config_file=/etc/rsyslog.conf
|
|
|
76240a |
+
|
|
|
76240a |
+# Ensure directory structure exists (useful for container based testing)
|
|
|
76240a |
+test -f $config_file || touch $config_file
|
|
|
76240a |
+
|
|
|
76240a |
+test -d /etc/rsyslog.d/ || mkdir /etc/rsyslog.d/
|
|
|
76240a |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
76240a |
index 6372d13cfc..1cc53cf1e1 100644
|
|
|
76240a |
--- a/products/rhel8/profiles/stig.profile
|
|
|
76240a |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
76240a |
@@ -828,6 +828,8 @@ selections:
|
|
|
76240a |
- auditd_overflow_action
|
|
|
76240a |
|
|
|
76240a |
# RHEL-08-030710
|
|
|
76240a |
+ - rsyslog_encrypt_offload_defaultnetstreamdriver
|
|
|
76240a |
+ - rsyslog_encrypt_offload_actionsendstreamdrivermode
|
|
|
76240a |
|
|
|
76240a |
# RHEL-08-030720
|
|
|
76240a |
|
|
|
76240a |
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
|
|
76240a |
index 24e8149168..fdf69f6baa 100644
|
|
|
76240a |
--- a/shared/references/cce-redhat-avail.txt
|
|
|
76240a |
+++ b/shared/references/cce-redhat-avail.txt
|
|
|
76240a |
@@ -129,7 +129,6 @@ CCE-85988-4
|
|
|
76240a |
CCE-85989-2
|
|
|
76240a |
CCE-85990-0
|
|
|
76240a |
CCE-85991-8
|
|
|
76240a |
-CCE-85992-6
|
|
|
76240a |
CCE-85993-4
|
|
|
76240a |
CCE-85994-2
|
|
|
76240a |
CCE-85995-9
|
|
|
76240a |
@@ -235,7 +234,6 @@ CCE-86094-0
|
|
|
76240a |
CCE-86095-7
|
|
|
76240a |
CCE-86096-5
|
|
|
76240a |
CCE-86097-3
|
|
|
76240a |
-CCE-86098-1
|
|
|
76240a |
CCE-86099-9
|
|
|
76240a |
CCE-86100-5
|
|
|
76240a |
CCE-86101-3
|
|
|
76240a |
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
76240a |
index 32f1a24a7a..c0ef381696 100644
|
|
|
76240a |
--- a/tests/data/profile_stability/rhel8/stig.profile
|
|
|
76240a |
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
76240a |
@@ -228,6 +228,8 @@ selections:
|
|
|
76240a |
- require_singleuser_auth
|
|
|
76240a |
- root_permissions_syslibrary_files
|
|
|
76240a |
- rsyslog_cron_logging
|
|
|
76240a |
+- rsyslog_encrypt_offload_actionsendstreamdrivermode
|
|
|
76240a |
+- rsyslog_encrypt_offload_defaultnetstreamdriver
|
|
|
76240a |
- rsyslog_remote_access_monitoring
|
|
|
76240a |
- rsyslog_remote_loghost
|
|
|
76240a |
- security_patches_up_to_date
|
|
|
76240a |
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
76240a |
index d6a27c67dc..5adeea4a35 100644
|
|
|
76240a |
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
76240a |
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
76240a |
@@ -239,6 +239,8 @@ selections:
|
|
|
76240a |
- require_singleuser_auth
|
|
|
76240a |
- root_permissions_syslibrary_files
|
|
|
76240a |
- rsyslog_cron_logging
|
|
|
76240a |
+- rsyslog_encrypt_offload_actionsendstreamdrivermode
|
|
|
76240a |
+- rsyslog_encrypt_offload_defaultnetstreamdriver
|
|
|
76240a |
- rsyslog_remote_access_monitoring
|
|
|
76240a |
- rsyslog_remote_loghost
|
|
|
76240a |
- security_patches_up_to_date
|