>From d11a0c296055bfdeefaffd41b6671bb9d23933fd Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 1 Jun 2013 17:10:12 -0400 Subject: [PATCH 3/4] Created remediation template: create_services_disabled.py - Based off OVAL services file --- RHEL6/input/fixes/bash/templates/Makefile | 5 ++- .../bash/templates/create_services_disabled.py | 45 ++++++++++++++++++++ .../fixes/bash/templates/template_service_disabled | 9 ++++ 3 files changed, 58 insertions(+), 1 deletions(-) create mode 100755 RHEL6/input/fixes/bash/templates/create_services_disabled.py create mode 100644 RHEL6/input/fixes/bash/templates/template_service_disabled diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile index a4643d2..fe3f855 100644 --- a/RHEL6/input/fixes/bash/templates/Makefile +++ b/RHEL6/input/fixes/bash/templates/Makefile @@ -1,7 +1,10 @@ -templates: sysctls +templates: sysctls services sysctls: ./create_sysctl_bash.py ../../../checks/templates/sysctl_values.csv + +services: + ./create_services_disabled.py ../../../checks/templates/services_disabled.csv compare: diff output/ ../ | grep -v "Only in ../" diff --git a/RHEL6/input/fixes/bash/templates/create_services_disabled.py b/RHEL6/input/fixes/bash/templates/create_services_disabled.py new file mode 100755 index 0000000..25af608 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/create_services_disabled.py @@ -0,0 +1,45 @@ +#!/usr/bin/python + +# +# create_services_disabled.py +# automatically generate fixes for disabled services +# +# NOTE: The file 'template_service_disabled' should be located in the same working directory as this script. The +# template contains the following tags that *must* be replaced successfully in order for the fixes to work. +# +# SERVICENAME - the name of the service that should be disabled +# PACKAGENAME - the name of the package that installs the service +# + +import sys, csv, re + +def output_checkfile(serviceinfo): + # get the items out of the list + servicename, packagename = serviceinfo + with open("./template_service_disabled", 'r') as templatefile: + filestring = templatefile.read() + filestring = filestring.replace("SERVICENAME", servicename) + if packagename: + filestring = filestring.replace("PACKAGENAME", packagename) + else: + filestring = re.sub("\n\s*\n\s*", "", filestring) + filestring = re.sub("\s*\n\s*", "\n ", filestring) + with open("./output/service_" + servicename + "_disabled.sh", 'wb+') as outputfile: + outputfile.write(filestring) + outputfile.close() + +def main(): + if len(sys.argv) < 2: + print "Provide a CSV file containing lines of the format: servicename,packagename" + sys.exit(1) + with open(sys.argv[1], 'r') as f: + # put the CSV line's items into a list + servicelines = csv.reader(f) + for line in servicelines: + output_checkfile(line) + + sys.exit(0) + +if __name__ == "__main__": + main() + diff --git a/RHEL6/input/fixes/bash/templates/template_service_disabled b/RHEL6/input/fixes/bash/templates/template_service_disabled new file mode 100644 index 0000000..d38a703 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/template_service_disabled @@ -0,0 +1,9 @@ +# +# Disable SERVICENAME for all run levels +# +chkconfig --level 0123456 SERVICENAME off + +# +# Stop SERVICENAME if currently running +# +service SERVICENAME stop -- 1.7.1