[PATCH 1/3] Added two additional ldap checks, renamed one check to better differentiate same attrib. checks
by Kevin Spargur
From: kspargur <kspargur(a)kspargur.csb>
---
.../ldap_server_config_certificate_usage.xml | 79 ++++++++++++++++++++
.../checks/ldap_server_config_olcsecurity.xml | 37 ---------
.../ldap_server_config_olcsecurity_simple_bind.xml | 32 ++++++++
.../checks/ldap_server_config_olcsecurity_tls.xml | 32 ++++++++
4 files changed, 143 insertions(+), 37 deletions(-)
create mode 100644 rhel6/src/input/checks/ldap_server_config_certificate_usage.xml
delete mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity.xml
create mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
create mode 100644 rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml
diff --git a/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml b/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml
new file mode 100644
index 0000000..13f69cb
--- /dev/null
+++ b/rhel6/src/input/checks/ldap_server_config_certificate_usage.xml
@@ -0,0 +1,79 @@
+<def-group>
+ <definition class="compliance"
+ id="ldap_server_config_certificate_usage" version="1">
+ <metadata>
+ <title>LDAP Server Should Use Strong Encryption</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO:CCE" source="CCE" />
+ <description>If installed, LDAP server should be configured use strong certificate based encryption using a CA Cert, Private Key, and Public Cert.</description>
+ </metadata>
+ <criteria comment="If installed, LDAP server should be configured to use strong encryption"
+ operator="AND">
+ <extend_definition comment="openldap server should only be present if it fulfills an operational requirement"
+ definition_ref="package_openldap-servers_installed" />
+ <criterion test_ref="test_ldap_server_config_certificate_usage_ca" />
+ <criterion test_ref="test_ldap_server_config_certificate_usage_cert" />
+ <criterion test_ref="test_ldap_server_config_certificate_usage_key" />
+ </criteria>
+ </definition>
+
+
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist"
+ comment="Tests the value of the ^[\s]*olcTLSCACertificateFile[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
+ id="test_ldap_server_config_certificate_usage_ca" version="1">
+ <ind:object object_ref="obj_ldap_server_config_certificate_usage_ca" />
+ <ind:state state_ref="state_ldap_server_config_certificate_usage_ca" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_ldap_server_config_certificate_usage_ca"
+ version="1">
+ <ind:subexpression operation="equals">/etc/pki/tls/CA/cacert.pem</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="obj_ldap_server_config_certificate_usage_ca"
+ version="1">
+ <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
+ <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*olcTLSCACertificateFile[\s]*:[\s]*(.*)$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist"
+ comment="Tests the value of the ^[\s]*olcTLSCertificateFile[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
+ id="test_ldap_server_config_certificate_usage_cert" version="1">
+ <ind:object object_ref="obj_ldap_server_config_certificate_usage_cert" />
+ <ind:state state_ref="state_ldap_server_config_certificate_usage_cert" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_ldap_server_config_certificate_usage_cert"
+ version="1">
+ <ind:subexpression operation="equals">/etc/pki/tls/ldap/servercert.pem</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="obj_ldap_server_config_certificate_usage_cert"
+ version="1">
+ <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
+ <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*olcTLSCertificateFile[\s]*:[\s]*(.*)$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist"
+ comment="Tests the value of the ^[\s]*olcTLSCertificateKeyFile[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
+ id="test_ldap_server_config_certificate_usage_key" version="1">
+ <ind:object object_ref="obj_ldap_server_config_certificate_usage_key" />
+ <ind:state state_ref="state_ldap_server_config_certificate_usage_key" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state id="state_ldap_server_config_certificate_usage_key"
+ version="1">
+ <ind:subexpression operation="equals">/etc/pki/tls/ldap/serverkey.pem</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object id="obj_ldap_server_config_certificate_usage_key"
+ version="1">
+ <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
+ <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*olcTLSCertificateKeyFile[\s]*:[\s]*(.*)$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml
deleted file mode 100644
index e4bbe30..0000000
--- a/rhel6/src/input/checks/ldap_server_config_olcsecurity.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<def-group>
- <definition class="compliance"
- id="ldap_server_config_olcsecurity" version="1">
- <metadata>
- <title>LDAP Server Should Use TLS</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO:CCE" source="CCE" />
- <description>If installed, LDAP server should use TLS.</description>
- </metadata>
- <criteria comment="If installed, LDAP server should be configured to use strong encryption"
- operator="AND">
- <extend_definition comment="openldap server should only be present if it fulfills an operational requirement"
- definition_ref="package_openldap-servers_installed" />
- <criterion test_ref="test_20141" />
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*(.*)$ expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
- id="test_20141" version="1">
- <ind:object object_ref="obj_20141" />
- <ind:state state_ref="state_20141" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_20141"
- version="1">
- <ind:subexpression operation="equals">tls=128</ind:subexpression>
- </ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_20141"
- version="1">
- <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
- <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*olcSecurity[\s]*:[\s]*(.*)$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
new file mode 100644
index 0000000..19bc8b7
--- /dev/null
+++ b/rhel6/src/input/checks/ldap_server_config_olcsecurity_simple_bind.xml
@@ -0,0 +1,32 @@
+<def-group>
+ <definition class="compliance"
+ id="ldap_server_config_olcsecurity_simple_bind" version="1">
+ <metadata>
+ <title>LDAP Server Should Require Protected Binds</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO:CCE" source="CCE" />
+ <description>If installed, LDAP server should require secure binds.</description>
+ </metadata>
+ <criteria comment="If installed, LDAP server should be configured to use strong encryption"
+ operator="AND">
+ <extend_definition comment="openldap server should only be present if it fulfills an operational requirement"
+ definition_ref="package_openldap-servers_installed" />
+ <criterion test_ref="test_ldap_server_config_olcsecurity_simple_bind" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist"
+ comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*.*simple_bind=128.* expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
+ id="test_ldap_server_config_olcsecurity_simple_bind" version="1">
+ <ind:object object_ref="obj_ldap_server_config_olcsecurity_simple_bind" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_ldap_server_config_olcsecurity_simple_bind"
+ version="1">
+ <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
+ <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*olcSecurity[\s]*:[\s]*\.*simple_bind=128.*</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml b/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml
new file mode 100644
index 0000000..99a422d
--- /dev/null
+++ b/rhel6/src/input/checks/ldap_server_config_olcsecurity_tls.xml
@@ -0,0 +1,32 @@
+<def-group>
+ <definition class="compliance"
+ id="ldap_server_config_olcsecurity_tls" version="1">
+ <metadata>
+ <title>LDAP Server Should Use TLS</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO:CCE" source="CCE" />
+ <description>If installed, LDAP server should use TLS.</description>
+ </metadata>
+ <criteria comment="If installed, LDAP server should be configured to use strong encryption"
+ operator="AND">
+ <extend_definition comment="openldap server should only be present if it fulfills an operational requirement"
+ definition_ref="package_openldap-servers_installed" />
+ <criterion test_ref="test_ldap_server_config_olcsecurity_tls" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all"
+ check_existence="all_exist"
+ comment="Tests the value of the ^[\s]*olcSecurity[\s]*:[\s]*.*tls=128.* expression in the /etc/openldap/slapd.d/cn=config/olcDatabase*bdb.ldif file"
+ id="test_ldap_server_config_olcsecurity_tls" version="1">
+ <ind:object object_ref="obj_ldap_server_config_olcsecurity_tls" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_ldap_server_config_olcsecurity_tls"
+ version="1">
+ <ind:path>/etc/openldap/slapd.d/cn=config</ind:path>
+ <ind:filename operation="pattern match">olcDatabase.*bdb.ldif</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*olcSecurity[\s]*:[\s]*\.*tls=128.*</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
--
1.7.7.6
11 years, 9 months
RFC: -k field value
by Shawn Wells
I'd like to see the audit -k field names match whatever we call the
actual check. Right now they're (fairly arbitrary) strings from the
stig.rules file. Any objection to changing them to match the rule name?
11 years, 9 months
RFC: "-F auid>=500 -F auid!=4294967295" in audit rules
by Shawn Wells
I noticed many of the audit rules apply the "-F auid>=500 -F
auid!=4294967295" fields, and I'm not fully sure I agree with it. It
looks like these were taken from the stig.rules sample file that ships
with RHEL.
This presumes that system administrators are following UID naming
schemes. I suppose we could create a "no UIDs < 500" check, but I'd
rather eliminate the "-F auid>=500 -F auid!=4294967295" from the audit
rules to ensure those with less than noble intent can't create a UID <
500 and escape auditing. By reference, all our Common Criteria profiles
to not have the auid checks.
What's the consensus -- keep or remove auid flags?
11 years, 9 months
Embarrassing question: SSH keys for commits
by Shawn Wells
Trying to sync the commit repo, get key failures. For the life of me I
can't figure out where to upload my SSH keys to, and my google-foo is
failing. Any tips?
11 years, 9 months