Include accounts_set_post_pw_existing rule in CIS RHEL #10269
Conversation
This rule is applicable for RHEL products and also satisfy some CIS requirements for RHEL7, RHEL8 and RHEL9.
It was included a new test case to cover systems where there is no user with a password defined. In this case, the remediation is not necessary. It was also included a filter in the shadow_object to exclude entries without a valid password. Finally, the file was aligned to the project Style Guide.
Aligned to the OVAL check, users without a valid password defined in /etc/shadow should be ignored by the remediation in order to avoid disruption of non-interactive accounts. The remediation header was also updated to multi_platform_all.
The scripts were reviewed and aligned to the OVAL and remediation. New relevant scenarios were included to cover partially compliant systems and also systems without user passwords.
The 5.5.1.4 requirement for RHEL7 and the 5.6.1.4 requirement for RHEL8 and RHEL9 are complete with the accounts_set_post_pw_existing rule.
marcusburghardt
added
RHEL
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
Code Climate has analyzed commit 00f50be and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 51.7% (0.0% change). View more on Code Climate. |
|
@marcusburghardt: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
marcusburghardt
added
Update Rule
Description:
The
accounts_set_post_pw_existingrule completes the5.5.1.4requirement forRHEL7and the5.6.1.4requirement forRHEL8 and RHEL9.Rationale:
Better CIS coverage for RHEL.