>From 333f8ca2790704c1a18bc73801fa7a10bb55a085 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 5 Apr 2013 22:54:57 -0400 Subject: [PATCH] Example remediation templates Submitting for consideration of a bash 'templates' process, similar to OVAL templates. In this case: - sysctl pairings are kept in templates/sysctl_values.csv - Bash remediation template for sysctl kept in templates/template_sysctl.sh - User runs templates/create_sysctl_checks.py which runs through the CSV file, generating the needed bash remediation scripts. This process would let us centralize (some) repeatable code segments. --- RHEL6/input/fixes/bash/templates/Makefile | 8 +++ .../fixes/bash/templates/create_sysctl_checks.py | 35 +++++++++++ RHEL6/input/fixes/bash/templates/output/.gitignore | 2 + RHEL6/input/fixes/bash/templates/sysctl_values.csv | 17 +++++ .../input/fixes/bash/templates/template_sysctl.sh | 65 ++++++++++++++++++++ 5 files changed, 127 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/fixes/bash/templates/Makefile create mode 100755 RHEL6/input/fixes/bash/templates/create_sysctl_checks.py create mode 100644 RHEL6/input/fixes/bash/templates/output/.gitignore create mode 100644 RHEL6/input/fixes/bash/templates/sysctl_values.csv create mode 100755 RHEL6/input/fixes/bash/templates/template_sysctl.sh diff --git a/RHEL6/input/fixes/bash/templates/Makefile b/RHEL6/input/fixes/bash/templates/Makefile new file mode 100644 index 0000000..81c89ef --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/Makefile @@ -0,0 +1,8 @@ +templates: + ./create_sysctl_checks.py sysctl_values.csv + +copy: + cp output/*.sh ../ + +clean: + rm output/*.sh diff --git a/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py b/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py new file mode 100755 index 0000000..b7c46b0 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/create_sysctl_checks.py @@ -0,0 +1,35 @@ +#!/usr/bin/python + +import sys, csv, re + +def output_checkfile(serviceinfo): + # get the items out of the list + sysctl_var, sysctl_val = serviceinfo + # convert variable name to a format suitable for 'id' tags + sysctl_var_id = re.sub('[-\.]', '_', sysctl_var) + # open the template and perform the conversions + with open("template_sysctl.sh", 'r') as templatefile: + filestring = templatefile.read() + filestring = filestring.replace("SYSCTLID", sysctl_var_id) + filestring = filestring.replace("SYSCTLVAR", sysctl_var) + filestring = filestring.replace("SYSCTLVAL", sysctl_val) + # write the check + with open("./output/sysctl_" + sysctl_var_id + ".sh", 'wb+') as outputfile: + outputfile.write(filestring) + outputfile.close() + +def main(): + if len(sys.argv) < 2: + print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue" + sys.exit(1) + with open(sys.argv[1], 'r') as f: + # put the CSV line's items into a list + sysctl_lines = csv.reader(f) + for line in sysctl_lines: + output_checkfile(line) + + sys.exit(0) + +if __name__ == "__main__": + main() + diff --git a/RHEL6/input/fixes/bash/templates/output/.gitignore b/RHEL6/input/fixes/bash/templates/output/.gitignore new file mode 100644 index 0000000..041cc36 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/output/.gitignore @@ -0,0 +1,2 @@ +# files to ignore +*.sh diff --git a/RHEL6/input/fixes/bash/templates/sysctl_values.csv b/RHEL6/input/fixes/bash/templates/sysctl_values.csv new file mode 100644 index 0000000..787aa5c --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/sysctl_values.csv @@ -0,0 +1,17 @@ +kernel.exec-shield,1 +kernel.randomize_va_space,2 +net.ipv4.conf.all.accept_redirects,0 +net.ipv4.conf.all.accept_source_route,0 +net.ipv4.conf.all.log_martians,1 +net.ipv4.conf.all.rp_filter,1 +net.ipv4.conf.all.secure_redirects,0 +net.ipv4.conf.all.send_redirects,0 +net.ipv4.conf.default.accept_redirects,0 +net.ipv4.conf.default.accept_source_route,0 +net.ipv4.conf.default.rp_filter,1 +net.ipv4.conf.default.secure_redirects,0 +net.ipv4.conf.default.send_redirects,0 +net.ipv4.icmp_echo_ignore_broadcasts,1 +net.ipv4.icmp_ignore_bogus_error_responses,1 +net.ipv4.ip_forward,0 +net.ipv4.tcp_syncookies,1 diff --git a/RHEL6/input/fixes/bash/templates/template_sysctl.sh b/RHEL6/input/fixes/bash/templates/template_sysctl.sh new file mode 100755 index 0000000..4c6bce2 --- /dev/null +++ b/RHEL6/input/fixes/bash/templates/template_sysctl.sh @@ -0,0 +1,65 @@ +#!/bin/bash -u +set -e + +# +# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA +# +# This software was developed by Tresys Technology LLC +# with U.S. Government sponsorship. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +PARAM="SYSCTLVAR" +DESIRED="SYSCTLVAL" +DIR=${PARAM//\./\/} +DIR="/proc/sys/"$DIR + +if [ -f $DIR ]; then + MODULE=`/bin/echo "${PARAM}"|/bin/sed -e "s/\./\//g"` + + [ -f /etc/sysctl.conf ] || return 1 + + if /bin/grep -q "${PARAM}" /etc/sysctl.conf; then + /sbin/sysctl -q -p + else + /bin/echo "" >> /etc/sysctl.conf && + /bin/echo "# Added by $(/bin/basename $0) on $(/bin/date -u)" >> /etc/sysctl.conf && + /bin/echo "$PARAM = $DESIRED" >> /etc/sysctl.conf + fi + + if ! /sbin/sysctl -q -w $PARAM=$DESIRED; then + /bin/echo "sysctl -w $PARAM=$DESIRED failed" + fi +else + return 0 +fi + +SAFE_FIELD="($PARAM\s+=\s+).*" +VAL=$DESIRED +FILEDIR="/etc/sysctl.conf" + +F=` /bin/echo $FILEDIR|/bin/grep -Po "[^\/]*$" ` +FILEDIR=${FILEDIR%"/$F"} + +if /bin/grep -Pq "^(\s*)(\#*)(\s*)($SAFE_FIELD)" "$FILEDIR/$F"; then + /bin/sed -i -r -e "s!(\s*)(\#*)(\s*)$SAFE_FIELD!\3\4$VAL!g" "$FILEDIR/$F" +else + OUT=` /bin/echo $SAFE_FIELD|/bin/grep -Po "\([^\(|^\)]*\)" ` + OUT=` /bin/echo $OUT | /bin/grep -Po "[^\(|^\)]*"`$VAL + OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s\+! !g" ` + OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s\*!!g" ` + OUT=` /bin/echo $OUT| /bin/sed -r -e "s!\\\\\s! !g" ` + OUT=` /bin/echo $OUT| /bin/grep -Po '[^\\\\]*'` + /bin/echo $OUT >> "$FILEDIR/$F" +fi + +/sbin/sysctl -e -q -p -- 1.7.1