[PATCH 1/1] add aide cron oval check

Gabe Alford redhatrises at gmail.com
Fri Aug 8 13:06:09 UTC 2014


Hello,

       Just wondering if someone can review this as I would like to push it
soon if it is ack'ed.

Thanks,

Gabe


On Tue, Aug 5, 2014 at 4:29 PM, Gabe <redhatrises at gmail.com> wrote:

> - add aide oval check to check /etc/crontab and files in /etc/cron.d/
> - add aide bash fix
> - enable aide oval check in scan
>
> Signed-off-by: Gabe <redhatrises at gmail.com>
> ---
>  .../6/input/checks/aide_periodic_cron_checking.xml | 39
> ++++++++++++++++++++++
>  .../fixes/bash/aide_periodic_cron_checking.sh      |  1 +
>  RHEL/6/input/system/software/integrity.xml         |  1 +
>  3 files changed, 41 insertions(+)
>  create mode 100644 RHEL/6/input/checks/aide_periodic_cron_checking.xml
>  create mode 100644 RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh
>
> diff --git a/RHEL/6/input/checks/aide_periodic_cron_checking.xml
> b/RHEL/6/input/checks/aide_periodic_cron_checking.xml
> new file mode 100644
> index 0000000..4a4dbff
> --- /dev/null
> +++ b/RHEL/6/input/checks/aide_periodic_cron_checking.xml
> @@ -0,0 +1,39 @@
> +<def-group>
> +  <definition class="compliance" id="aide_periodic_cron_checking"
> version="1">
> +    <metadata>
> +      <title>Configure Periodic Execution of AIDE</title>
> +      <affected family="unix">
> +        <platform>Red Hat Enterprise Linux 6</platform>
> +      </affected>
> +      <description>By default, AIDE does not install itself for periodic
> +      execution. Periodically running AIDE is necessary to reveal
> +      unexpected changes in installed files.
> +      </description>
> +      <reference source="MED" ref_id="20130928"
> ref_url="test_attestation" />
> +    </metadata>
> +    <criteria operator="OR">
> +      <extend_definition comment="Aide is installed" negate="true"
> definition_ref="package_aide_installed" />
> +      <criterion comment="run aide daily with cron"
> test_ref="test_aide_periodic_cron_checking" />
> +      <criterion comment="run aide daily with cron"
> test_ref="test_aide_crond_checking" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> comment="run aide daily with cron" id="test_aide_periodic_cron_checking"
> version="1">
> +    <ind:object object_ref="object_test_aide_periodic_cron_checking" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object comment="run aide daily with cron"
> id="object_test_aide_periodic_cron_checking" version="1">
> +    <ind:filepath>/etc/crontab</ind:filepath>
> +    <ind:pattern operation="pattern
> match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern>
> +    <ind:instance datatype="int" operation="greater than or
> equal">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_test check="all" check_existence="all_exist"
> comment="run aide daily with cron" id="test_aide_crond_checking"
> version="1">
> +    <ind:object object_ref="object_test_aide_crond_checking" />
> +  </ind:textfilecontent54_test>
> +  <ind:textfilecontent54_object comment="run aide daily with cron"
> id="object_test_aide_crond_checking" version="1">
> +    <ind:path>/etc/cron.d</ind:path>
> +    <ind:filename operation="pattern match">^.*$</ind:filename>
> +    <ind:pattern operation="pattern
> match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern>
> +    <ind:instance datatype="int" operation="greater than or
> equal">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh
> b/RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh
> new file mode 100644
> index 0000000..f62ef72
> --- /dev/null
> +++ b/RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh
> @@ -0,0 +1 @@
> +echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
> diff --git a/RHEL/6/input/system/software/integrity.xml
> b/RHEL/6/input/system/software/integrity.xml
> index 55bf115..ab9f44d 100644
> --- a/RHEL/6/input/system/software/integrity.xml
> +++ b/RHEL/6/input/system/software/integrity.xml
> @@ -100,6 +100,7 @@ To determine that periodic AIDE execution has been
> scheduled, run the following
>  By default, AIDE does not install itself for periodic execution.
> Periodically
>  running AIDE is necessary to reveal unexpected changes in installed files.
>  </rationale>
> +<oval id="aide_periodic_cron_checking" />
>  <ident cce="27222-9" />
>  <ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7"
> disa="374,416,1069,1263,1297,1589"/>
>  </Rule>
> --
> 2.0.0
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140808/509899f1/attachment-0001.html>


More information about the scap-security-guide mailing list