>From afa0e0c53c374ed7f42ddcf282ff01cbec7d8b66 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 7 Jul 2013 04:28:25 -0400 Subject: [PATCH 1/2] Created remediation template: create_services_enabled [shawn@rhel6 templates]$ make services ./create_services_disabled.py ../../../checks/templates/services_disabled.csv ./create_services_enabled.py ../../../checks/templates/services_enabled.csv [shawn@rhel6 templates]$ cat output/service_auditd_enabled.sh chkconfig --level 0123456 auditd on service auditd start [shawn@rhel6 templates]$ make copy; make clean cp output/*.sh ../ rm -f output/*.sh --- RHEL6/input/fixes/bash/templates/Makefile | 1 + .../bash/templates/create_services_enabled.py | 40 ++++++++++++++++++++ .../fixes/bash/templates/template_service_enabled | 9 ++++ 3 files changed, 50 insertions(+), 0 deletions(-) create mode 100755 RHEL6/input/fixes/bash/templates/create_services_enabled.py create mode 100644 RHEL6/input/fixes/bash/templates/template_service_enabled diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile index 42fa3d9..74fedbc 100644 --- a/RHEL6/input/fixes/bash/templates/Makefile +++ b/RHEL6/input/fixes/bash/templates/Makefile @@ -5,6 +5,7 @@ sysctls: services: ./create_services_disabled.py ../../../checks/templates/services_disabled.csv + ./create_services_enabled.py ../../../checks/templates/services_enabled.csv permissions: ./create_file_ownership_bash.py ../../../checks/templates/file_dir_permissions.csv diff --git a/RHEL6/input/fixes/bash/templates/create_services_enabled.py b/RHEL6/input/fixes/bash/templates/create_services_enabled.py new file mode 100755 index 0000000..9a9dac8 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/create_services_enabled.py @@ -0,0 +1,40 @@ +#!/usr/bin/python + +# +# create_services_enabled.py +# automatically generate fixes for enabled services +# +# NOTE: The file 'template_service_enabled' should be located in the same working directory as this script. The +# template contains the following tags that *must* be replaced successfully in order for the fixes to work. +# +# SERVICENAME - the name of the service that should be enabled +# PACKAGENAME - the name of the package that installs the service +# + +import sys, csv, re + +def output_checkfile(serviceinfo): + # get the items out of the list + servicename, packagename = serviceinfo + with open("./template_service_enabled", 'r') as templatefile: + filestring = templatefile.read() + filestring = filestring.replace("SERVICENAME", servicename) + with open("./output/service_" + servicename + "_enabled.sh", 'wb+') as outputfile: + outputfile.write(filestring) + outputfile.close() + +def main(): + if len(sys.argv) < 2: + print "Provide a CSV file containing lines of the format: servicename,packagename" + sys.exit(1) + with open(sys.argv[1], 'r') as f: + # put the CSV line's items into a list + servicelines = csv.reader(f) + for line in servicelines: + output_checkfile(line) + + sys.exit(0) + +if __name__ == "__main__": + main() + diff --git a/RHEL6/input/fixes/bash/templates/template_service_enabled b/RHEL6/input/fixes/bash/templates/template_service_enabled new file mode 100644 index 0000000..0467686 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/template_service_enabled @@ -0,0 +1,9 @@ +# +# Enable SERVICENAME for all run levels +# +chkconfig --level 0123456 SERVICENAME on + +# +# Stop SERVICENAME if currently running +# +service SERVICENAME start -- 1.7.1