Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Rsyslog rules to support RainerScript syntax #12010

Merged
merged 17 commits into from
May 28, 2024
Merged

Improve Rsyslog rules to support RainerScript syntax #12010

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
c7e18f8
Add Rainer script support to rule rsyslog_cron_logging
jan-cerny May 20, 2024
9b191b8
Add Rainer script support to rsyslog_encrypt_offload_actionsendstream…
jan-cerny May 20, 2024
0e418bc
Add Rainer script support to rsyslog_encrypt_offload_actionsendstream…
jan-cerny May 20, 2024
847a9c0
Add Rainer script support to rsyslog_encrypt_offload_defaultnetstream…
jan-cerny May 20, 2024
5786c4a
Extract regex to a Jinja variable
jan-cerny May 27, 2024
65a6ea4
Add .conf extension to the configuration files
jan-cerny May 27, 2024
a035ce2
Extract legaxy regex
jan-cerny May 27, 2024
6cb73c7
Extract regexes to a variable
jan-cerny May 27, 2024
66d0a44
Update rule description with the Rainer script syntax
jan-cerny May 27, 2024
846e2fa
Update rule description with Rainer script syntax
jan-cerny May 27, 2024
85ab249
Extract regexes to variables
jan-cerny May 27, 2024
48aab45
Extract regexes to variables
jan-cerny May 27, 2024
768762d
Update rule description with Rainer script syntax
jan-cerny May 27, 2024
0cf234e
Improve test scenario
jan-cerny May 28, 2024
d8157f5
Use correct name of RainerScript
jan-cerny May 28, 2024
4da9bdb
Ensure the directories are set up
jan-cerny May 28, 2024
e5bfb40
Add packages header to the test scenarios
jan-cerny May 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions ...system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,12 @@
<criteria operator="OR">
<criterion comment="cron is configured in /etc/rsyslog.conf"
test_ref="test_cron_logging_rsyslog" />
<criterion comment="cron is configured in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_cron_logging_rsyslog_rainer" />
<criterion comment="cron is configured in /etc/rsyslog.d"
test_ref="test_cron_logging_rsyslog_dir" />
<criterion comment="cron is configured in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_cron_logging_rsyslog_dir_rainer" />
{{% if product == "ol8" %}}
<criterion comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities"
test_ref="test_cron_logging_rsyslog_logging_all_facilities" />
Expand All @@ -27,6 +31,18 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="cron is configured in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_cron_logging_rsyslog_rainer" version="1">
<ind:object object_ref="obj_cron_logging_rsyslog_rainer" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_cron_logging_rsyslog_rainer" version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<!-- Rainer script keys are case-insensitive -->
<ind:pattern operation="pattern match">^\s*cron\.\*\s+action\(.*(?i)\btype\b(?-i)="omfile".*(?i)\bfile\b(?-i)="/var/log/cron".*\)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="cron is configured in /etc/rsyslog.d"
id="test_cron_logging_rsyslog_dir" version="1">
Expand All @@ -39,6 +55,19 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="cron is configured in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_cron_logging_rsyslog_dir_rainer" version="1">
<ind:object object_ref="obj_cron_logging_rsyslog_dir_rainer" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_cron_logging_rsyslog_dir_rainer" version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<!-- Rainer script keys are case-insensitive -->
<ind:pattern operation="pattern match">^\s*cron\.\*\s+action\(.*(?i)\btype\b(?-i)="omfile".*(?i)\bfile\b(?-i)="/var/log/cron".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

{{% if product == "ol8" %}}
<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="rsyslog is configured in /etc/rsyslog.conf to log to all facilities"
Expand Down
5 changes: 5 additions & 0 deletions .../guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,10 @@ description: |-
cron job status. If <tt>cron</tt> is not logging to <tt>rsyslog</tt>, it
can be implemented by adding the following to the <i>RULES</i> section of
<tt>/etc/rsyslog.conf</tt>:
If the legacy syntax is used:
<pre>cron.* /var/log/cron</pre>
If the modern syntax (Rainer script) is used:
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<pre>cron.* action(type="omfile" file="/var/log/cron")</pre>

rationale: |-
Cron logging can be used to trace the successful or unsuccessful execution
Expand Down Expand Up @@ -46,6 +49,8 @@ ocil: |-
run the following command:
<pre>grep -rni "cron\.\*" /etc/rsyslog.*</pre>
<pre>cron.* /var/log/cron</pre>
or
<pre>cron.* action(type="omfile" file="/var/log/cron")</pre>

fixtext: |-
Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory:
Expand Down
13 changes: 13 additions & 0 deletions ...onfiguration/rsyslog_cron_logging/tests/cron_set_rainer_capital_case_rsyslog_conf.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

echo 'cron.* action(Name="local-cron" Type="omfile" FileCreateMode="0600" FileOwner="root" FileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_CONF"
13 changes: 13 additions & 0 deletions ...og_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rainer_rsyslog_conf.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

echo 'cron.* action(name="local-cron" type="omfile" fileCreateMode="0600" fileOwner="root" fileGroup="root" file="/var/log/cron")' >> "$RSYSLOG_CONF"
13 changes: 13 additions & 0 deletions ...yslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rainer_rsyslog_d.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FOLDER='/etc/rsyslog.d'
RSYSLOG_D_FILE=$RSYSLOG_D_FOLDER'/test'
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved

# Ensure that rsyslog.d folder exists and contains our 'test' file
mkdir -p $RSYSLOG_D_FOLDER
touch $RSYSLOG_D_FILE

sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF

echo 'cron.* action(name="local-cron" type="omfile" FileCreateMode="0600" fileOwner="root" fileGroup="root" File="/var/log/cron")' >> "$RSYSLOG_D_FILE"
16 changes: 16 additions & 0 deletions ...g_log_file_configuration/rsyslog_cron_logging/tests/wrong_log_rainer_rsyslog_conf.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with cron.*
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*cron\.\*/d' $rsyslog_d_file
done

# If there's cron.* line, then remove it
sed -i '/^[[:space:]]*cron\.\*/d' $RSYSLOG_CONF
# Add cron.* that logs into wrong file
echo 'cron.* action(name="local-cron" type="omfile" fileCreateMode="0600" fileOwner="root" fileGroup="root" file="/tmp/log/cron")' >> "$RSYSLOG_CONF"
37 changes: 36 additions & 1 deletion ...file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@
{{{ oval_metadata("Rsyslogd must authenticate remote system its sending logs to.") }}}
<criteria operator="AND">
<criteria operator="OR">
<criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
<criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode" />
<criterion comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
<criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" />
<criterion comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
</criteria>
</criteria>
</definition>
Expand All @@ -26,6 +30,21 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" version="1">

<ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_rainer"
comment="Check if StreamDriverAuthMode is set to x509/name in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverAuthMode\b(?-i)="x509/name".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"
id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir" version="1">
Expand All @@ -40,4 +59,20 @@
<ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" version="1">
<ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_auth_mode_dir_rainer"
comment="Check if StreamDriverAuthMode is set to x509/name in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverAuthMode\b(?-i)="x509/name".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

</def-group>
13 changes: 13 additions & 0 deletions .../rsyslog_encrypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_conf_rainer.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with action
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*action\.\*/d' $rsyslog_d_file
done

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")' >> "$RSYSLOG_CONF"
5 changes: 5 additions & 0 deletions ...rypt_offload_actionsendstreamdriverauthmode/tests/rsyslog_conf_rainer_wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="0")' >> "$RSYSLOG_CONF"
36 changes: 35 additions & 1 deletion ...log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,14 @@
{{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
<criteria operator="AND">
<criteria operator="OR">
<criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
<criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog" />
<criterion comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer" />
<criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d"
test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" />
<criterion comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer" />
</criteria>
</criteria>
</definition>
Expand All @@ -27,6 +31,21 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer" version="1">

<ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_rainer"
comment="Check if StreamDriverMode is set to 1 in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverMode\b(?-i)="1".*\)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"
id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir" version="1">
Expand All @@ -41,4 +60,19 @@
<ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer" version="1">
<ind:object object_ref="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_action_send_stream_driver_mode_rsyslog_dir_rainer"
comment="Check if StreamDriverMode is set to 1 in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*action\(.*(?i)\btype\b(?-i)="omfwd".*(?i)\bStreamDriverMode\b(?-i)="1".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
13 changes: 13 additions & 0 deletions ...tion/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_conf_rainer.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with action
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*action\.\*/d' $rsyslog_d_file
done

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name" StreamDriverMode="1")' >> "$RSYSLOG_CONF"
5 changes: 5 additions & 0 deletions ..._encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_conf_rainer_wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="0" StreamDriverMode="42")' >> "$RSYSLOG_CONF"
14 changes: 14 additions & 0 deletions ...uration/rsyslog_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_d_rainer.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#!/bin/bash

RSYSLOG_CONF='/etc/rsyslog.conf'
RSYSLOG_D_FILES='/etc/rsyslog.d/*'
RSYSLOG_D_TEST_CONF='/etc/rsyslog.d/test.conf'

# Ensure that rsyslog.conf exists and rsyslog.d folder doesn't contain any file with action
touch $RSYSLOG_CONF
for rsyslog_d_file in $RSYSLOG_D_FILES
do
sed -i '/^[[:space:]]*action\.\*/d' $rsyslog_d_file
done

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name" StreamDriverMode="1")' >> "$RSYSLOG_D_TEST_CONF"
5 changes: 5 additions & 0 deletions ...log_encrypt_offload_actionsendstreamdrivermode/tests/rsyslog_d_rainer_wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#!/bin/bash

RSYSLOG_D_TEST_CONF='/etc/rsyslog.d/test.conf'

echo 'action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="0" StreamDriverMode="42")' >> "$RSYSLOG_D_TEST_CONF"
36 changes: 35 additions & 1 deletion ...log_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,14 @@
{{{ oval_metadata("Rsyslogd must encrypt the off-loading of logs off of the system.") }}}
<criteria operator="AND">
<criteria operator="OR">
<criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
<criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
test_ref="test_{{{rule_id}}}_default_netstream_rsyslog" />
<criterion comment="Check if DefaultNetstreamDriver is set to gtls in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_default_netstream_rsyslog_rainer" />
<criterion comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d"
test_ref="test_{{{rule_id}}}_default_netstream_rsyslog_dir" />
<criterion comment="Check if DefaultNetstreamDriver is set to gtls in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
test_ref="test_{{{rule_id}}}_default_netstream_rsyslog_dir_rainer" />
</criteria>
</criteria>
</definition>
Expand All @@ -27,6 +31,21 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if DefaultNetstreamDriver is set to gtls in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_default_netstream_rsyslog_rainer" version="1">

<ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_default_netstream_rsyslog_rainer"
comment="Check if DefaultNetstreamDriver is set to gtls in /etc/rsyslog.conf using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:filepath>/etc/rsyslog.conf</ind:filepath>
<ind:pattern operation="pattern match">^\s*global\(.*(?i)\bDefaultNetStreamDriver\b(?-i)="gtls".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"
id="test_{{{rule_id}}}_default_netstream_rsyslog_dir" version="1">
Expand All @@ -41,4 +60,19 @@
<ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Check if DefaultNetstreamDriver is set to gtls in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
id="test_{{{rule_id}}}_default_netstream_rsyslog_dir_rainer" version="1">
<ind:object object_ref="obj_{{{rule_id}}}_default_netstream_rsyslog_dir_rainer" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{rule_id}}}_default_netstream_rsyslog_dir_rainer"
comment="Check if DefaultNetstreamDriver is set to gtls in files in /etc/rsyslog.d using Rainer script"
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
version="1">
<ind:path>/etc/rsyslog.d</ind:path>
<ind:filename operation="pattern match">^.*conf$</ind:filename>
<ind:pattern operation="pattern match">^\s*global\(.*(?i)\bDefaultNetStreamDriver\b(?-i)="gtls".*\)\s*$</ind:pattern>
marcusburghardt marked this conversation as resolved.
Show resolved Hide resolved
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
3 changes: 3 additions & 0 deletions ...guration/rsyslog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_conf_rainer.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
#!/bin/bash

echo 'global(DefaultNetstreamDriver="gtls" DefaultNetstreamDriverCAFile="/path/to/contrib/gnutls/ca.pem" DefaultNetstreamDriverCertFile="/path/to/contrib/gnutls/cert.pem" DefaultNetstreamDriverKeyFile="/path/to/contrib/gnutls/key.pem")' > /etc/rsyslog.conf
3 changes: 3 additions & 0 deletions ...slog_encrypt_offload_defaultnetstreamdriver/tests/rsyslog_conf_rainer_wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
#!/bin/bash

echo 'global(DefaultNetstreamDriver="tftp" DefaultNetstreamDriverKeyFile="/path/to/contrib/gnutls/key.pem")' > /etc/rsyslog.conf
Loading
Loading