Review CIS RHEL7 v4.0.0 Section 4 - Access, Authentication and Authorization #11455

marcusburghardt · 2024-01-18T13:00:14Z

Description:

Review the cis_rhel7.yml control file and update the following section in alignment to CIS RHEL 7 v4.0.0:

Section 4 - Access, Authentication and Authorization

Also update references in related rules.

Rationale:

Keep RHEL 7 profiles updated with CIS RHEL 7 last version.

Review Hints:

The easiest way is to open the CIS RHEL8 v3.0.0 policy and compare the changes in commits with the respective requirements.

openshift-ci · 2024-01-18T13:00:19Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2024-01-18T13:01:34Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

marcusburghardt · 2024-01-19T09:45:09Z

After the #11449 and #11446 be merged this PR was rebased and conflicts in section 4 were resolved.

marcusburghardt · 2024-01-19T13:35:10Z

testing farm for centos7 is failing:
xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su - fail

This rule is not new to the profile. I have to investigate why it is failing now.

vojtapolasek

Hello and thank you for this update, you did a great job. I found just few points which I think should be corrected, see my comments.

controls/cis_rhel7.yml

vojtapolasek · 2024-01-19T13:36:51Z

controls/cis_rhel7.yml

+    levels:
+      - l1_server
+      - l1_workstation
+    status: automated


I think this should be partial because the set of rules below does not check the following files:

/etc/bash.bashrc

/etc/pam.d/postlogin

/etc/default/login

/etc/bash.bashrc is not expected to be used in RHEL 7. Instead is used /etc/bashrc, but the script mentioned in CIS RHEL 7 policy also considers this file. The same case is for /etc/default/login. I will open a ticket in CIS community.

It is indeed missing a rule for /etc/pam.d/postlogin

controls/cis_rhel7.yml

marcusburghardt · 2024-01-23T09:34:49Z

testing farm for centos7 is failing: xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su - fail

This rule is not new to the profile. I have to investigate why it is failing now.

I identified the issue with use_pam_wheel_for_su. It is incorrectly failing when the pam_wheel.so line contains more options configured. For example:
auth required pam_wheel.so use_uid group=sugroup

I will fix in next commits.

github-actions · 2024-01-23T09:46:29Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed'.
--- xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed
+++ xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed
@@ -19,3 +19,6 @@
 of the effectiveness of a password in resisting attempts at guessing and
 brute-force attacks. "pwquality" enforces complex password construction
 configuration and has the ability to limit brute-force attacks on the system.
+
+[ident]:
+CCE-86225-0

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed' differs.
--- xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed
+++ xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed
@@ -2,6 +2,7 @@
   package_facts:
     manager: auto
   tags:
+  - CCE-86225-0
   - enable_strategy
   - low_complexity
   - low_disruption
@@ -15,6 +16,7 @@
     state: present
   when: '"pam" in ansible_facts.packages'
   tags:
+  - CCE-86225-0
   - enable_strategy
   - low_complexity
   - low_disruption

bash remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su' differs.
--- xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su
+++ xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su
@@ -2,7 +2,7 @@
 if rpm --quiet -q pam; then
 
 # uncomment the option if commented
-  sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su
+sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su' differs.
--- xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su
+++ xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su
@@ -9,7 +9,7 @@
 pamstr=$(grep -P '^auth\s+required\s+pam_wheel\.so\s+(?=[^#]*\buse_uid\b)(?=[^#]*\bgroup=)' ${PAM_CONF})
 if [ -z "$pamstr" ]; then
     sed -Ei '/^auth\b.*\brequired\b.*\bpam_wheel\.so/d' ${PAM_CONF} # remove any remaining uncommented pam_wheel.so line
-    sed -Ei "/^auth\s+sufficient\s+pam_rootok\.so.*$/a auth required pam_wheel.so use_uid group=${var_pam_wheel_group_for_su}" ${PAM_CONF}
+    sed -Ei "/^auth\s+sufficient\s+pam_rootok\.so.*$/a auth             required        pam_wheel.so use_uid group=${var_pam_wheel_group_for_su}" ${PAM_CONF}
 else
     group_val=$(echo -n "$pamstr" | grep -Eo '\bgroup=[_a-z][-0-9_a-z]*' | cut -d '=' -f 2)
     if [ -z "${group_val}" ] || [ ${group_val} != ${var_pam_wheel_group_for_su} ]; then

marcusburghardt · 2024-01-23T13:50:37Z

testing farm for centos7 is failing: xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su - fail
This rule is not new to the profile. I have to investigate why it is failing now.

I identified the issue with use_pam_wheel_for_su. It is incorrectly failing when the pam_wheel.so line contains more options configured. For example: auth required pam_wheel.so use_uid group=sugroup

I will fix in next commits.

Fixed

4.1.1 - Configure cron Requirements were just moved from section 5 to section 4.