From f0ffee4c22283607abe99a99075423e9867de43a Mon Sep 17 00:00:00 2001
From: Molly Jo Bault <Molly.Jo.Bault@ballardtech.com>
Date: Thu, 14 Jul 2016 15:06:33 -0400
Subject: [PATCH] Some added remediation scripts from testing on CentOS 7

---
 .../bash/accounts_password_pam_maxclassrepeat.sh         |  7 +++++++
 .../bash/accounts_passwords_pam_faillock_deny_root.sh    | 11 +++++++++++
 .../bash/accounts_passwords_pam_unix_remember.sh         |  9 +++++++++
 RHEL/7/input/remediations/bash/accounts_tmout.sh         |  7 +++++++
 .../remediations/bash/clean_components_post_updating.sh  |  2 ++
 .../remediations/bash/ensure_gpgcheck_local_packages.sh  |  2 ++
 .../remediations/bash/ensure_gpgcheck_repo_metadata.sh   |  2 ++
 RHEL/7/input/remediations/bash/grub2_enable_fips_mode.sh | 10 ++++++++++
 RHEL/7/input/remediations/bash/mount_option_tmp_nodev.sh | 14 ++++++++++++++
 .../7/input/remediations/bash/mount_option_tmp_noexec.sh | 14 ++++++++++++++
 .../7/input/remediations/bash/mount_option_tmp_nosuid.sh | 14 ++++++++++++++
 .../input/remediations/bash/mount_option_var_tmp_bind.sh |  3 +++
 .../bash/sysctl_net_ipv6_conf_all_accept_source_route.sh | 16 ++++++++++++++++
 RHEL/7/input/xccdf/system/permissions/execution.xml      |  0
 shared/remediations/bash/templates/remediation_functions |  2 +-
 15 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100755 RHEL/7/input/remediations/bash/accounts_password_pam_maxclassrepeat.sh
 create mode 100755 RHEL/7/input/remediations/bash/accounts_passwords_pam_faillock_deny_root.sh
 create mode 100755 RHEL/7/input/remediations/bash/accounts_passwords_pam_unix_remember.sh
 create mode 100755 RHEL/7/input/remediations/bash/accounts_tmout.sh
 create mode 100755 RHEL/7/input/remediations/bash/clean_components_post_updating.sh
 create mode 100755 RHEL/7/input/remediations/bash/ensure_gpgcheck_local_packages.sh
 create mode 100755 RHEL/7/input/remediations/bash/ensure_gpgcheck_repo_metadata.sh
 create mode 100755 RHEL/7/input/remediations/bash/grub2_enable_fips_mode.sh
 create mode 100755 RHEL/7/input/remediations/bash/mount_option_tmp_nodev.sh
 create mode 100755 RHEL/7/input/remediations/bash/mount_option_tmp_noexec.sh
 create mode 100755 RHEL/7/input/remediations/bash/mount_option_tmp_nosuid.sh
 create mode 100755 RHEL/7/input/remediations/bash/mount_option_var_tmp_bind.sh
 create mode 100755 RHEL/7/input/remediations/bash/sysctl_net_ipv6_conf_all_accept_source_route.sh
 mode change 100644 => 100755 RHEL/7/input/xccdf/system/permissions/execution.xml

diff --git a/RHEL/7/input/remediations/bash/accounts_password_pam_maxclassrepeat.sh b/RHEL/7/input/remediations/bash/accounts_password_pam_maxclassrepeat.sh
new file mode 100755
index 0000000..dda73a0
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/accounts_password_pam_maxclassrepeat.sh
@@ -0,0 +1,7 @@
+# platform = Red Hat Enterprise Linux 7
+. /usr/share/scap-security-guide/remediation_functions
+populate var_password_pam_maxclassrepeat
+
+if grep -q "maxclassrepeat=" /etc/security/pwquality.conf ; then   
+	echo "maxclassrepeat = $var_password_pam_maxclassrepeat" >> /etc/security/pwquality.conf
+fi
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/accounts_passwords_pam_faillock_deny_root.sh b/RHEL/7/input/remediations/bash/accounts_passwords_pam_faillock_deny_root.sh
new file mode 100755
index 0000000..4e922d8
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/accounts_passwords_pam_faillock_deny_root.sh
@@ -0,0 +1,11 @@
+# platform = Red Hat Enterprise Linux 7
+
+if [ $( grep -c "auth.*required.*pam_faillock.so.*even_deny_root" /etc/pam.d/system-auth ) -eq 0 ]; then
+        BEGINNING_TXT=$( cat /etc/pam.d/system-auth | grep "auth.*required.*pam_faillock.so" | sed -e 's/[]\/$*.^|[]/\\&/g' )
+	sed -i --follow-symlinks "s/$BEGINNING_TXT/$BEGINNING_TXT even_deny_root/" /etc/pam.d/system-auth
+fi
+
+if [ $( grep -c "auth.*default.*die.*pam_faillock.so.*even_deny_root" /etc/pam.d/system-auth ) -eq 0 ]; then
+        BEGINNING_TXT=$( cat /etc/pam.d/system-auth | grep "auth.*default.*die.*pam_faillock.so"  | sed -e 's/[]\/$*.^|[]/\\&/g' )
+	sed -i --follow-symlinks "s/$BEGINNING_TXT/$BEGINNING_TXT even_deny_root/" /etc/pam.d/system-auth
+fi
diff --git a/RHEL/7/input/remediations/bash/accounts_passwords_pam_unix_remember.sh b/RHEL/7/input/remediations/bash/accounts_passwords_pam_unix_remember.sh
new file mode 100755
index 0000000..aa60c6d
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/accounts_passwords_pam_unix_remember.sh
@@ -0,0 +1,9 @@
+# platform = Red Hat Enterprise Linux 7
+. /usr/share/scap-security-guide/remediation_functions
+populate var_accounts_passwords_pam_unix_remember
+
+if grep -q "remember=" /etc/pam.d/system-auth; then
+        sed -i --follow-symlinks "s/\(remember *= *\).*/\1$var_accounts_passwords_pam_unix_remember/" /etc/pam.d/system-auth
+else
+        sed -i --follow-symlinks "/pam_unix.so/ s/$/ remember=$var_accounts_passwords_pam_unix_remember/" /etc/pam.d/system-auth
+fi
diff --git a/RHEL/7/input/remediations/bash/accounts_tmout.sh b/RHEL/7/input/remediations/bash/accounts_tmout.sh
new file mode 100755
index 0000000..6b26a7c
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/accounts_tmout.sh
@@ -0,0 +1,7 @@
+# platform = Red Hat Enterprise Linux 7
+#. /usr/share/scap-security-guide/remediation_functions
+#popu#late var_#accounts_#tmout
+
+#echo "TMOUT=$var_accounts_tmout" >> /etc/profile
+
+echo "TMOUT=600" >> /etc/profile
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/clean_components_post_updating.sh b/RHEL/7/input/remediations/bash/clean_components_post_updating.sh
new file mode 100755
index 0000000..dd4fd21
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/clean_components_post_updating.sh
@@ -0,0 +1,2 @@
+# platform = Red Hat Enterprise Linux 7
+echo "clean_requirements_on_remove=1" >> /etc/yum.conf
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/ensure_gpgcheck_local_packages.sh b/RHEL/7/input/remediations/bash/ensure_gpgcheck_local_packages.sh
new file mode 100755
index 0000000..36c2ed8
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/ensure_gpgcheck_local_packages.sh
@@ -0,0 +1,2 @@
+# platform = Red Hat Enterprise Linux 7
+echo "localpkg_gpgcheck=1" >> /etc/yum.conf
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/ensure_gpgcheck_repo_metadata.sh b/RHEL/7/input/remediations/bash/ensure_gpgcheck_repo_metadata.sh
new file mode 100755
index 0000000..4620071
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/ensure_gpgcheck_repo_metadata.sh
@@ -0,0 +1,2 @@
+# platform = Red Hat Enterprise Linux 7
+echo "repo_gpgcheck=1" >> /etc/yum.conf
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/grub2_enable_fips_mode.sh b/RHEL/7/input/remediations/bash/grub2_enable_fips_mode.sh
new file mode 100755
index 0000000..c9dbafb
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/grub2_enable_fips_mode.sh
@@ -0,0 +1,10 @@
+# platform = Red Hat Enterprise Linux 7
+sed -i 's/PRELINKING=yes/PRELINKING=no/g' /etc/sysconfig/prelink
+prelink -u -a
+dracut -f
+if [ -e /sys/firmware/efi ]; then
+	BOOT=`df /boot/efi | tail -1 | awk '{print $1 }'`
+else
+	BOOT=`df /boot | tail -1 | awk '{ print $1 }'`
+fi
+/sbin/grubby --update-kernel=ALL --args="boot=${BOOT} fips=1"
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/mount_option_tmp_nodev.sh b/RHEL/7/input/remediations/bash/mount_option_tmp_nodev.sh
new file mode 100755
index 0000000..5e7bd7f
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/mount_option_tmp_nodev.sh
@@ -0,0 +1,14 @@
+# platform = Red Hat Enterprise Linux 7
+FSTAB=/etc/fstab
+SED=`which sed`
+NEW_OPT=nodev
+
+if [ $(grep " \/tmp " ${FSTAB} | grep -c "$NEW_OPT" ) -eq 0 ]; then
+        MNT_OPTS=$(grep " \/tmp " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/tmp.*${MNT_OPTS}\)/\1,${NEW_OPT}/" ${FSTAB}
+        
+        if [ $MNT_OPTS = "defaults" ]
+        then
+                ${SED} -i "s/defaults,//" ${FSTAB}
+        fi
+fi
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/mount_option_tmp_noexec.sh b/RHEL/7/input/remediations/bash/mount_option_tmp_noexec.sh
new file mode 100755
index 0000000..7fe030c
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/mount_option_tmp_noexec.sh
@@ -0,0 +1,14 @@
+# platform = Red Hat Enterprise Linux 7
+FSTAB=/etc/fstab
+SED=`which sed`
+NEW_OPT=noexec
+
+if [ $(grep " \/tmp " ${FSTAB} | grep -c "$NEW_OPT" ) -eq 0 ]; then
+        MNT_OPTS=$(grep " \/tmp " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/tmp.*${MNT_OPTS}\)/\1,${NEW_OPT}/" ${FSTAB}
+        
+        if [ $MNT_OPTS = "defaults" ]
+        then
+                ${SED} -i "s/defaults,//" ${FSTAB}
+        fi
+fi
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/mount_option_tmp_nosuid.sh b/RHEL/7/input/remediations/bash/mount_option_tmp_nosuid.sh
new file mode 100755
index 0000000..f9e4c2c
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/mount_option_tmp_nosuid.sh
@@ -0,0 +1,14 @@
+# platform = Red Hat Enterprise Linux 7
+FSTAB=/etc/fstab
+SED=`which sed`
+NEW_OPT="nosuid"
+
+if [ $(grep " \/tmp " ${FSTAB} | grep -c "$NEW_OPT" ) -eq 0 ]; then
+        MNT_OPTS=$(grep " \/tmp " ${FSTAB} | awk '{print $4}')
+        ${SED} -i "s/\( \/tmp.*${MNT_OPTS}\)/\1,${NEW_OPT}/" ${FSTAB}
+        
+        if [ $MNT_OPTS = "defaults" ]
+        then
+        	${SED} -i "s/defaults,//" ${FSTAB}
+        fi
+fi
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/mount_option_var_tmp_bind.sh b/RHEL/7/input/remediations/bash/mount_option_var_tmp_bind.sh
new file mode 100755
index 0000000..4aaffbc
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/mount_option_var_tmp_bind.sh
@@ -0,0 +1,3 @@
+# platform = Red Hat Enterprise Linux 7
+FSTAB=/etc/fstab
+echo "/tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0" >> $FSTAB
\ No newline at end of file
diff --git a/RHEL/7/input/remediations/bash/sysctl_net_ipv6_conf_all_accept_source_route.sh b/RHEL/7/input/remediations/bash/sysctl_net_ipv6_conf_all_accept_source_route.sh
new file mode 100755
index 0000000..b812b3c
--- /dev/null
+++ b/RHEL/7/input/remediations/bash/sysctl_net_ipv6_conf_all_accept_source_route.sh
@@ -0,0 +1,16 @@
+# platform = Red Hat Enterprise Linux 7
+#
+# Set runtime for SYSCTLVAR
+#
+/sbin/sysctl -q -n -w net.ipv6.conf.all.accept_source_route=0
+
+#
+# If SYSCTLVAR present in /etc/sysctl.conf, change value to "SYSCTLVAL"
+#	else, add "SYSCTLVAR = SYSCTLVAL" to /etc/sysctl.conf
+#
+if grep --silent ^net.ipv6.conf.all.accept_source_route /etc/sysctl.conf ; then
+	sed -i 's/^net.ipv6.conf.all.accept_source_route.*/net.ipv6.conf.all.accept_source_route = 0/g' /etc/sysctl.conf
+else
+	echo -e "\n# Set net.ipv6.conf.all.accept_source_route to 0 per security requirements" >> /etc/sysctl.conf
+	echo "net.ipv6.conf.all.accept_source_route = 0" >> /etc/sysctl.conf
+fi
diff --git a/RHEL/7/input/xccdf/system/permissions/execution.xml b/RHEL/7/input/xccdf/system/permissions/execution.xml
old mode 100644
new mode 100755
diff --git a/shared/remediations/bash/templates/remediation_functions b/shared/remediations/bash/templates/remediation_functions
index 1ef7e19..dcbd6ef 100644
--- a/shared/remediations/bash/templates/remediation_functions
+++ b/shared/remediations/bash/templates/remediation_functions
@@ -788,7 +788,7 @@ function replace_or_append {
     $sed_command "s/$key.*/$formatted_output/g" $config_file
   else
     echo -ne "\n# Per $cce: Set $formatted_output in $config_file" >> $config_file
-    echo -ne "\n$formatted_output" >> $config_file
+    echo -ne "\n$formatted_output\n" >> $config_file
   fi
 
 }
-- 
2.4.3

