diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml index 9fb218a0f7..a056742417 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml @@ -42,3 +42,5 @@ ocil: |- 
$ sudo grep ldap_tls_cacert /etc/sssd/sssd.conf
The output should return the following with a correctly configured CA cert path: 
ldap_tls_cacert /path/to/tls/ca.cert
+ +platform: sssd-ldap diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml index a6e8eeaad3..202fc7f444 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml @@ -3,39 +3,6 @@ # strategy = unknown # complexity = low # disruption = medium -- (xccdf-var var_sssd_ldap_tls_ca_dir) +{{{ ansible_instantiate_variables("var_sssd_ldap_tls_ca_dir") }}} -- name: "Test for domain group" - command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf - register: test_grep_domain - ignore_errors: yes - changed_when: False - check_mode: no - -- name: "Add default domain group and set CA directory (if no domain there)" - ini_file: - path: /etc/sssd/sssd.conf - section: "{{ item.section }}" - option: "{{ item.option }}" - value: "{{ item.value }}" - create: yes - mode: 0600 - with_items: - - { section: sssd, option: domains, value: default} - - { section: domain/default, option: id_provider, value: files } - - { section: domain/default, option: ldap_tls_cacertdir, value: "{{ var_sssd_ldap_tls_ca_dir }}" } - when: - - test_grep_domain.stdout is defined - - test_grep_domain.stdout | length < 1 - -- name: "Configure LDAPs path to CA directory" - ini_file: - path: /etc/sssd/sssd.conf - section: "{{ test_grep_domain.stdout | regex_replace('\\[(.*)\\]','\\1') }}" - option: ldap_tls_cacertdir - value: "{{ var_sssd_ldap_tls_ca_dir }}" - create: yes - mode: 0600 - when: - - test_grep_domain.stdout is defined - - test_grep_domain.stdout | length > 0 +{{{ ansible_sssd_ldap_config(parameter="ldap_tls_cacertdir", value="{{ var_sssd_ldap_tls_ca_dir }}") }}} diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/bash/shared.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/bash/shared.sh index 91464ef04c..8a0d04ad78 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/bash/shared.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/bash/shared.sh @@ -2,20 +2,7 @@ # Include source function library. . /usr/share/scap-security-guide/remediation_functions -populate var_sssd_ldap_tls_ca_dir -SSSD_CONF="/etc/sssd/sssd.conf" -LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*ldap_tls_cacertdir' -DOMAIN_REGEX="[[:space:]]*\[domain\/[^]]*]" +{{{ bash_instantiate_variables("var_sssd_ldap_tls_ca_dir") }}} -# Try find [domain/..] and ldap_tls_cacertdir in sssd.conf, if it exists, set to CA directory -# if it isn't here, add it, if [domain/..] doesn't exist, add it here for default domain -if grep -qzosP $LDAP_REGEX $SSSD_CONF; then - sed -i "s~ldap_tls_cacertdir[^(\n)]*~ldap_tls_cacertdir = $var_sssd_ldap_tls_ca_dir~" $SSSD_CONF -elif grep -qs $DOMAIN_REGEX $SSSD_CONF; then - sed -i "/$DOMAIN_REGEX/a ldap_tls_cacertdir = $var_sssd_ldap_tls_ca_dir" $SSSD_CONF -else - mkdir -p /etc/sssd - touch $SSSD_CONF - echo -e "[domain/default]\nldap_tls_cacertdir = $var_sssd_ldap_tls_ca_dir" >> $SSSD_CONF -fi +{{{ bash_sssd_ldap_config(parameter="ldap_tls_cacertdir", value="$var_sssd_ldap_tls_ca_dir") }}} diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml index d554bc6f18..570aa1baf9 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml @@ -28,11 +28,11 @@ identifiers: cce@rhel8: CCE-82456-5 references: - stigid@ol7: OL07-00-040190 + stigid@ol7: OL07-00-040200 disa: CCI-001453 nist: SC-12(3),CM-6(a) srg: SRG-OS-000250-GPOS-00093 - stigid@rhel7: RHEL-07-040190 + stigid@rhel7: RHEL-07-040200 ocil_clause: 'the TLS CA cert is not configured' @@ -42,3 +42,5 @@ ocil: |- 
$ sudo grep ldap_tls_cacertdir /etc/sssd/sssd.conf
The output should return the following with a correctly configured CA cert path: 
ldap_tls_cacertdir /path/to/tls/cacert
+ +platform: sssd-ldap diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/domain_not_there.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/domain_not_there.fail.sh index 82e56d89a6..ebd2a37df8 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/domain_not_there.fail.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/domain_not_there.fail.sh @@ -4,4 +4,7 @@ . $SHARED/setup_config_files.sh setup_correct_sssd_config +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + sed -i '/\[domain/d' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir.pass.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir.pass.sh index 82bff74acf..99ca3f8fba 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir.pass.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir.pass.sh @@ -3,3 +3,6 @@ . $SHARED/setup_config_files.sh setup_correct_sssd_config + +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_bad_value.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_bad_value.fail.sh index 8e06bfae6b..5fb3609015 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_bad_value.fail.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_bad_value.fail.sh @@ -4,5 +4,8 @@ . $SHARED/setup_config_files.sh setup_correct_sssd_config +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + sed -i 's:\(ldap_tls_cacertdir = \).*:\1/tmp/etc/openldap/cacerts:g' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_absolute_path.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_absolute_path.fail.sh index 58b1324e09..9dd958933d 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_absolute_path.fail.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_absolute_path.fail.sh @@ -4,4 +4,7 @@ . $SHARED/setup_config_files.sh setup_correct_sssd_config +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + sed -i 's:\(ldap_tls_cacertdir = \)/:\1:g' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_there.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_there.fail.sh index 38e88a1dc4..5a09eaf52f 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_there.fail.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_not_there.fail.sh @@ -4,4 +4,7 @@ . $SHARED/setup_config_files.sh setup_correct_sssd_config +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + sed -i '/ldap_tls_cacertdir/d' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml index 07f4b1ea5a..b38bc41fe3 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml @@ -4,44 +4,4 @@ # complexity = low # disruption = medium -- name: "Set LDAP to be used for authentication" - lineinfile: - path: /etc/sysconfig/authconfig - regexp: '^USELDAPAUTH=' - line: 'USELDAPAUTH=yes' - create: yes - -- name: "Test for domain group" - command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf - register: test_grep_domain - ignore_errors: yes - changed_when: False - check_mode: no - -- name: "Add default domain group and use STARTTLS (if no domain there)" - ini_file: - path: /etc/sssd/sssd.conf - section: "{{ item.section }}" - option: "{{ item.option }}" - value: "{{ item.value }}" - create: yes - mode: 0600 - with_items: - - { section: sssd, option: domains, value: default} - - { section: domain/default, option: id_provider, value: files } - - { section: domain/default, option: ldap_id_use_start_tls, value: true} - when: - - test_grep_domain.stdout is defined - - test_grep_domain.stdout | length < 1 - -- name: "Configure LDAP to use STARTTLS" - ini_file: - path: /etc/sssd/sssd.conf - section: "{{ test_grep_domain.stdout | regex_replace('\\[(.*)\\]','\\1') }}" - option: ldap_id_use_start_tls - value: true - create: yes - mode: 0600 - when: - - test_grep_domain.stdout is defined - - test_grep_domain.stdout | length > 0 +{{{ ansible_sssd_ldap_config(parameter="ldap_id_use_start_tls", value="true") }}} diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/bash/shared.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/bash/shared.sh index 4b1d3d2544..805f7ad326 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/bash/shared.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/bash/shared.sh @@ -3,27 +3,5 @@ # Include source function library. . /usr/share/scap-security-guide/remediation_functions -AUTHCONFIG="/etc/sysconfig/authconfig" -USELDAPAUTH_REGEX="^USELDAPAUTH=" -SSSD_CONF="/etc/sssd/sssd.conf" -LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*ldap_id_use_start_tls' -DOMAIN_REGEX="[[:space:]]*\[domain\/[^]]*]" +{{{ bash_sssd_ldap_config(parameter="ldap_id_use_start_tls", value="true") }}} -# Try find USELDAPAUTH in authconfig. If its here set to 'yes', otherwise append USELDAPAUTH=yes -grep -qs "^USELDAPAUTH=" "$AUTHCONFIG" && sed -i 's/^USELDAPAUTH=.*/USELDAPAUTH=yes/g' $AUTHCONFIG -if ! [ $? -eq 0 ]; then - echo "USELDAPAUTH=yes" >> $AUTHCONFIG -fi - -# Try find [domain/..] and ldap_id_use_start_tls in sssd.conf, if it exists, set to 'True' -# if ldap_id_use_start_tls isn't here, add it -# if [domain/..] doesn't exist, add it here for default domain -if grep -qzosP $LDAP_REGEX $SSSD_CONF; then - sed -i 's/ldap_id_use_start_tls[^(\n)]*/ldap_id_use_start_tls = True/' $SSSD_CONF -elif grep -qs $DOMAIN_REGEX $SSSD_CONF; then - sed -i "/$DOMAIN_REGEX/a ldap_id_use_start_tls = True" $SSSD_CONF -else - mkdir -p /etc/sssd - touch $SSSD_CONF - echo -e "[domain/default]\nldap_id_use_start_tls = True" >> $SSSD_CONF -fi diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/oval/shared.xml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/oval/shared.xml index a196220340..ed502062e4 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/oval/shared.xml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/oval/shared.xml @@ -2,40 +2,23 @@ Configure SSSD LDAP Backend to Use TLS For All Transactions - - multi_platform_wrlinux - multi_platform_rhel - multi_platform_ol - + {{{- oval_affected(products) }}} LDAP should be used for authentication and use STARTTLS - - + - - - - - - /etc/sysconfig/authconfig - ^USELDAPAUTH=((?i)yes)[ ]*$ - 1 - - /etc/sssd/sssd.conf - ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ ]*=[ ]*((?i)true)[ ]*$ + ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ \t]*=[ \t]*((?i)true)[ \t]*$ 1 diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml index b81a8b8ff5..452de1d014 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml @@ -5,15 +5,14 @@ prodtype: ol7,ol8,rhel7,rhel8,wrlinux1019 title: 'Configure SSSD LDAP Backend to Use TLS For All Transactions' description: |- - This check verifies that {{{ full_name }}} implements cryptography - to protect the integrity of remote LDAP authentication sessions. + The LDAP client should be configured to implement TLS for the integrity + of all remote LDAP authentication sessions. If the id_provider is + set to ldap or ipa in /etc/sssd/sssd.conf or any of the + /etc/sssd/sssd.conf.d configuration files, ldap_id_use_start_tls + must be set to true.

- To determine if LDAP is being used for authentication, use the following - command: - 
$ sudo grep -i useldapauth /etc/sysconfig/authconfig
-

- If USELDAPAUTH=yes, then LDAP is being used. To check if LDAP is - configured to use TLS, use the following command: + To check if LDAP is configured to use TLS when id_provider is + set to ldap or ipa, use the following command: 
$ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf
rationale: |- @@ -41,8 +40,10 @@ references: iso27001-2013: A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.9.1.2 cis-csc: 11,12,14,15,3,8,9 -ocil_clause: 'the ''ldap_id_use_start_tls'' option is not set to ''True''' +ocil_clause: 'the ''ldap_id_use_start_tls'' option is not set to ''true''' ocil: |- If the system is not using TLS, set the ldap_id_use_start_tls option - in /etc/sssd/sssd.conf to True. + in /etc/sssd/sssd.conf to true. + +platform: sssd-ldap diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ad_id_provider_and_tls_false.notapplicable.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ad_id_provider_and_tls_false.notapplicable.sh new file mode 100644 index 0000000000..83ae606ece --- /dev/null +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ad_id_provider_and_tls_false.notapplicable.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_stig + +. $SHARED/setup_config_files.sh +setup_correct_sssd_config + +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + +sed -i 's/ldap_id_use_start_tls = true/ldap_id_use_start_tls = false/I' /etc/sssd/sssd.conf +sed -i 's/id_provider = ldap/id_provider = ad/I' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_not_there.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value.pass.sh similarity index 50% rename from linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_not_there.fail.sh rename to linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value.pass.sh index 75a80d37cc..99ca3f8fba 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_not_there.fail.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value.pass.sh @@ -2,6 +2,7 @@ # profiles = xccdf_org.ssgproject.content_profile_stig . $SHARED/setup_config_files.sh -setup_correct_auth_and_sssd_configs +setup_correct_sssd_config -sed -i '/USELDAPAUTH/d' /etc/sysconfig/authconfig +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/id_provider_is_set_to_ad.notapplicable.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/id_provider_is_set_to_ad.notapplicable.sh new file mode 100644 index 0000000000..9ec246444f --- /dev/null +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/id_provider_is_set_to_ad.notapplicable.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_stig + +. $SHARED/setup_config_files.sh +setup_correct_sssd_config + +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + +sed -i 's/id_provider = ldap/id_provider = ad/I' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false.fail.sh new file mode 100644 index 0000000000..f0942ddf74 --- /dev/null +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# profiles = xccdf_org.ssgproject.content_profile_stig + +. $SHARED/setup_config_files.sh +setup_correct_sssd_config + +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd + +sed -i 's/ldap_id_use_start_tls = true/ldap_id_use_start_tls = false/I' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_false.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_false.fail.sh deleted file mode 100644 index 4bbf0ad01a..0000000000 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_false.fail.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash -# profiles = xccdf_org.ssgproject.content_profile_stig - -. $SHARED/setup_config_files.sh -setup_correct_auth_and_sssd_configs - -sed -i 's/ldap_id_use_start_tls = True/ldap_id_use_start_tls = False/' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_not_there.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_not_there.fail.sh index 0ce168ed97..3952176952 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_not_there.fail.sh +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_use_start_tls_not_there.fail.sh @@ -2,6 +2,9 @@ # profiles = xccdf_org.ssgproject.content_profile_stig . $SHARED/setup_config_files.sh -setup_correct_auth_and_sssd_configs +setup_correct_sssd_config + +yum -y install /usr/lib/systemd/system/sssd.service +systemctl enable sssd sed -i '/ldap_id_use_start_tls/d' /etc/sssd/sssd.conf diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_and_start_tls.pass.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_and_start_tls.pass.sh deleted file mode 100644 index f8ca33b8d4..0000000000 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_and_start_tls.pass.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash -# profiles = xccdf_org.ssgproject.content_profile_stig - -. $SHARED/setup_config_files.sh -setup_correct_auth_and_sssd_configs diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_no.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_no.fail.sh deleted file mode 100644 index 64b0c21c28..0000000000 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/useldapauth_no.fail.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash -# profiles = xccdf_org.ssgproject.content_profile_stig - -. $SHARED/setup_config_files.sh -setup_correct_auth_and_sssd_configs - -sed -i 's/USELDAPAUTH=yes/USELDAPAUTH=no/' /etc/sysconfig/authconfig diff --git a/ol7/cpe/ol7-cpe-dictionary.xml b/ol7/cpe/ol7-cpe-dictionary.xml index 5d4691aaf6..59c5c728aa 100644 --- a/ol7/cpe/ol7-cpe-dictionary.xml +++ b/ol7/cpe/ol7-cpe-dictionary.xml @@ -76,4 +76,8 @@ System uses zipl installed_env_has_zipl_package + + SSSD is configured to use LDAP + sssd_conf_uses_ldap + diff --git a/ol8/cpe/ol8-cpe-dictionary.xml b/ol8/cpe/ol8-cpe-dictionary.xml index 35167b1f70..473ba36235 100644 --- a/ol8/cpe/ol8-cpe-dictionary.xml +++ b/ol8/cpe/ol8-cpe-dictionary.xml @@ -71,4 +71,8 @@ System uses zipl installed_env_has_zipl_package + + SSSD is configured to use LDAP + sssd_conf_uses_ldap + diff --git a/rhel7/cpe/rhel7-cpe-dictionary.xml b/rhel7/cpe/rhel7-cpe-dictionary.xml index bc2aa869e8..e6b88f55cd 100644 --- a/rhel7/cpe/rhel7-cpe-dictionary.xml +++ b/rhel7/cpe/rhel7-cpe-dictionary.xml @@ -106,4 +106,8 @@ System uses zipl installed_env_has_zipl_package + + SSSD is configured to use LDAP + sssd_conf_uses_ldap + diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile index 41745ea4c3..3d8647de70 100644 --- a/rhel7/profiles/stig.profile +++ b/rhel7/profiles/stig.profile @@ -235,6 +235,7 @@ selections: - accounts_tmout - sshd_enable_warning_banner - sssd_ldap_start_tls + - sssd_ldap_start_tls.severity=medium - sssd_ldap_configure_tls_ca_dir - sssd_ldap_configure_tls_ca - sysctl_kernel_randomize_va_space diff --git a/rhel8/cpe/rhel8-cpe-dictionary.xml b/rhel8/cpe/rhel8-cpe-dictionary.xml index eab827291f..699251868d 100644 --- a/rhel8/cpe/rhel8-cpe-dictionary.xml +++ b/rhel8/cpe/rhel8-cpe-dictionary.xml @@ -76,4 +76,8 @@ System uses zipl installed_env_has_zipl_package + + SSSD is configured to use LDAP + sssd_conf_uses_ldap + diff --git a/shared/checks/oval/sssd_conf_uses_ldap.xml b/shared/checks/oval/sssd_conf_uses_ldap.xml new file mode 100644 index 0000000000..985c1bd8ef --- /dev/null +++ b/shared/checks/oval/sssd_conf_uses_ldap.xml @@ -0,0 +1,28 @@ + + + + SSSD is configured to use LDAP + + multi_platform_all + + Identification provider is not set to ad within /etc/sssd/sssd.conf + + + + + + + + + + + + + /etc/sssd/sssd.conf + ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$ + 1 + + diff --git a/shared/macros-oval.jinja b/shared/macros-oval.jinja index ecaf14ced9..babce11aff 100644 --- a/shared/macros-oval.jinja +++ b/shared/macros-oval.jinja @@ -534,3 +534,29 @@ {{{ description }}} {{%- endmacro %}} + + +{{% macro bash_sssd_ldap_config(parameter, value) -%}} +SSSD_CONF="/etc/sssd/sssd.conf" +LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*{{{ parameter }}}' +AD_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$' +DOMAIN_REGEX="[[:space:]]*\[domain\/[^]]*]" + +# Check if id_provider is not set to ad (Active Directory) which makes start_tls not applicable, note the -v option to invert the grep. +# Try to find [domain/..] and {{{ parameter }}} in sssd.conf, if it exists, set to '{{{ value }}}' +# if {{{ parameter }}} isn't here, add it +# if [domain/..] doesn't exist, add it here for default domain +if grep -qvzosP $AD_REGEX $SSSD_CONF; then + if grep -qzosP $LDAP_REGEX $SSSD_CONF; then + sed -i "s#{{{ parameter }}}[^(\n)]*#{{{ parameter }}} = {{{ value }}}#" $SSSD_CONF + elif grep -qs $DOMAIN_REGEX $SSSD_CONF; then + sed -i "/$DOMAIN_REGEX/a {{{ parameter }}} = {{{ value }}}" $SSSD_CONF + else + if test -f "$SSSD_CONF"; then + echo -e "[domain/default]\n{{{ parameter }}} = {{{ value }}}" >> $SSSD_CONF + else + echo "Config file '$SSSD_CONF' doesnt exist, not remediating, assuming non-applicability." >&2 + fi + fi +fi +{{%- endmacro %}} diff --git a/ssg/constants.py b/ssg/constants.py index 3f9d7d37ce..2af2c580a2 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -496,6 +496,7 @@ "pam": "cpe:/a:pam", "login_defs": "cpe:/a:login_defs", "sssd": "cpe:/a:sssd", + "sssd-ldap": "cpe:/a:sssd-ldap", "systemd": "cpe:/a:systemd", "yum": "cpe:/a:yum", "zipl": "cpe:/a:zipl", diff --git a/tests/shared/setup_config_files.sh b/tests/shared/setup_config_files.sh index 957eab77cb..5bee91890f 100644 --- a/tests/shared/setup_config_files.sh +++ b/tests/shared/setup_config_files.sh @@ -1,15 +1,8 @@ #!/bin/bash -configs_dir="$( dirname "${BASH_SOURCE[0]}" )/example-configs" +configs_dir="$( dirname "${BASH_SOURCE[0]}" )" setup_correct_sssd_config() { mkdir -p /etc/sssd cp "$configs_dir/sssd.conf" /etc/sssd/ } - -setup_correct_auth_and_sssd_configs() { - mkdir -p /etc/sysconfig - cp "$configs_dir/authconfig" /etc/sysconfig/ - - setup_correct_sssd_config -} diff --git a/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml b/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml index ef7e803505..f32e69e118 100644 --- a/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml +++ b/wrlinux1019/cpe/wrlinux1019-cpe-dictionary.xml @@ -75,4 +75,8 @@ System uses zipl installed_env_has_zipl_package + + SSSD is configured to use LDAP + sssd_conf_uses_ldap +