From 6eeef4054d707b8b255e9fa600c4c7babffbf5f7 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Mon, 2 Aug 2021 08:37:04 -0500
Subject: [PATCH] Add rule for RHEL-08-020090

---
 .../sssd/sssd_enable_certmap/rule.yml         | 58 +++++++++++++++++++
 .../sssd_enable_certmap/tests/default.fail.sh |  4 ++
 .../tests/with_section.pass.sh                |  7 +++
 products/rhel8/profiles/stig.profile          |  1 +
 shared/references/cce-redhat-avail.txt        |  1 -
 .../data/profile_stability/rhel8/stig.profile |  1 +
 .../profile_stability/rhel8/stig_gui.profile  |  1 +
 7 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
 create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
 create mode 100644 linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh

diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
new file mode 100644
index 0000000000..0614a2f4a0
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml
@@ -0,0 +1,58 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Enable Certmap in SSSD'
+
+description: |-
+   SSSD should be configured to verify the certificate of the user or group. To set this up
+    ensure that section like <tt>certmap/testing.test/rule_name</tt> is setup in
+   <tt>/etc/sssd/sssd.conf</tt>. For example
+   <pre>
+   [certmap/testing.test/rule_name]
+   matchrule =&lt;SAN&gt;.*EDIPI@mil
+   maprule = (userCertificate;binary={cert!bin})
+   domains = testing.test
+   </pre>
+
+rationale: |-
+   Without mapping the certificate used to authenticate to the user account, the ability to
+   determine the identity of the individual user or group will not be available for forensic
+   analysis.
+
+severity: medium
+
+identifiers:
+   cce@rhel8: CCE-86060-1
+
+references:
+   disa: CCI-000187
+   nist: IA-5 (2) (c)
+   stigid@rhel8: RHEL-08-020090
+
+warnings:
+    - general: |-
+        Automatic remediation of this control is not available, since all of the settings in
+        in the certmap need to be customized.
+
+ocil_clause: 'Certmap is not configured in SSSD'
+
+ocil: |-
+    To verify Certmap is enabled in SSSD, run the following command:
+    <pre>$ cat sudo cat /etc/sssd/sssd.conf</pre>
+    If configured properly, output should contain section like the following
+    <pre>
+    [certmap/testing.test/rule_name]
+    matchrule =&lt;SAN&gt;.*EDIPI@mil
+    maprule = (userCertificate;binary={cert!bin})
+    domains = testing.test
+    </pre>
+
+template:
+    name: lineinfile
+    vars:
+      path: '/etc/sssd/sssd.conf'
+      text: '^\[certmap\/.+\/.+\]$'
+    backends:
+        ansible: "off"
+        bash: "off"
diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
new file mode 100644
index 0000000000..1e31c0da19
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/default.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+touch /etc/sssd/sssd.conf
+sed -i "s/\[certmap.*//g" /etc/sssd/sssd.conf
diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
new file mode 100644
index 0000000000..911e095f5d
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd_enable_certmap/tests/with_section.pass.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+cat >> /etc/sssd/sssd.conf<< EOF
+[certmap/testing.test/rule_name]
+matchrule =<SAN>.*EDIPI@mil
+maprule = (userCertificate;binary={cert!bin})
+domains = testing.test
+EOF
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index f17a7b88b1..ec0a3b1753 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -503,6 +503,7 @@ selections:
     # RHEL-08-020080
 
     # RHEL-08-020090
+    - sssd_enable_certmap
 
     # RHEL-08-020100
     - accounts_password_pam_retry
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 73d025484e..e80557f033 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -186,7 +186,6 @@ CCE-86056-9
 CCE-86057-7
 CCE-86058-5
 CCE-86059-3
-CCE-86060-1
 CCE-86061-9
 CCE-86062-7
 CCE-86063-5
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 236e595604..bffa509b69 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -275,6 +275,7 @@ selections:
 - sshd_set_keepalive_0
 - sshd_use_strong_rng
 - sshd_x11_use_localhost
+- sssd_enable_certmap
 - sssd_enable_smartcards
 - sssd_offline_cred_expiration
 - sudo_remove_no_authenticate
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 9973b5adef..c84ac75c7b 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -286,6 +286,7 @@ selections:
 - sshd_set_keepalive_0
 - sshd_use_strong_rng
 - sshd_x11_use_localhost
+- sssd_enable_certmap
 - sssd_enable_smartcards
 - sssd_offline_cred_expiration
 - sudo_remove_no_authenticate