On 4/15/13 10:15 AM, Jeffrey Blank wrote:
NACK, though it is an improvement over what is there, so we could
consider adding it as a stopgap, should there be committment with
timeline to truly fixing it. The remediations can't be allowed until
the OVAL works, however.
The problem is that this does not semantically agree with what the XCCDF
says.
David had even once proposed changing the XCCDF to agree with this
approach, as shown here (and it's my bad for not responding earlier):
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-Februar...
... but Leland (in conversation) pointed out that it should be possible
for OVAL to determine what files are actually written by rsyslog (by
looking in rsyslog.conf) and then performing the actual checks on those
files. That approach requires more complicated OVAL, though it is more
desirable overall. I might consider asking Petr or Simon or Steve for
OVAL help here. I still find much of the OVAL documentation
incomprehensible.
OK, I see where you're going, and my oversight: We can't assume
everything in /var/log is actually syslogs. I have *no* idea how to get
the logfile information through OVAL, will try posting OVAL-Developer [1]
Relatedly, an automated check for ensuring that log files exist
(Rule
id=rsyslog_logfiles_exist) would be particularly nice, since IIRC the
behavior of syslog (possibly also rsyslog) is to not automatically
create new log files (if they are deleted at some point).
[root@rhel6 log]# rm
/var/log/messages /var/log/secure
rm: remove regular file `/var/log/messages'? y
rm: remove regular file `/var/log/secure'? y
[root@rhel6 log]# service rsyslog restart
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
[root@rhel6 log]# tail /var/log/messages
Apr 14 19:33:41 rhel6 kernel: imklog 5.8.10, log source = /proc/kmsg
started.
Apr 14 19:33:41 rhel6 rsyslogd: [origin software="rsyslogd"
swVersion="5.8.10" x-pid="10543"
x-info="http://www.rsyslog.com"] start
[root@rhel6 log]# sudo sh -c "echo \"generating secure syslog
event\""
generating secure syslog event
[root@rhel6 log]# tail /var/log/secure
Apr 14 19:34:09 rhel6 sudo: root : TTY=pts/3 ; PWD=/var/log ;
USER=root ; COMMAND=/bin/sh -c generating secure syslog event
Apr 14 19:34:27 rhel6 sudo: root : TTY=pts/3 ; PWD=/var/log ;
USER=root ; COMMAND=/bin/sh -c echo "generating secure syslog event"
[root@rhel6 log]# sed -i
's/\/var\/log\/messages/\/var\/log\/custom_file/g' /etc/rsyslog.conf
[root@rhel6 log]# service rsyslog restart
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
[root@rhel6 log]# tail /var/log/custom_file
Apr 14 19:42:39 rhel6 kernel: imklog 5.8.10, log source = /proc/kmsg
started.
Apr 14 19:42:39 rhel6 rsyslogd: [origin software="rsyslogd"
swVersion="5.8.10" x-pid="10604"
x-info="http://www.rsyslog.com"] start
rsyslog will automagically create any logfile that's defined in
/etc/rsyslog.conf. Also, if an event occurs against a syslog file which
was deleted during runtime, rsyslog will re-create it:
[root@rhel6 log]# rm /var/log/secure
rm: remove regular file `/var/log/secure'? y
[root@rhel6 log]# sudo sh -c "echo \"testing secure\""
testing secure
[root@rhel6 log]# tail /var/log/secure
Apr 14 19:47:30 rhel6 sudo: root : TTY=pts/3 ; PWD=/var/log ;
USER=root ; COMMAND=/bin/sh -c echo "testing secure"
Should we go ahead and kill this rule?
And that'll be easy once we figure out how to turn regex results
from
rsyslog.conf into filesystem queries (necessary for correct
implementation of these checks too).
[1] For those looking for OVAL forum/developer lists:
https://oval.mitre.org/community/registration.html