[PATCH] add aide cron oval check
Gabe Alford
redhatrises at gmail.com
Tue Jul 29 23:20:35 UTC 2014
Thanks, Shawn! Minor adjustments have been resubmitted.
Thanks,
Gabe
On Mon, Jul 28, 2014 at 7:06 PM, Shawn Wells <shawn at redhat.com> wrote:
>
> On 7/15/14, 9:23 PM, Gabe wrote:
>
> - add aide oval check to check */etc/crontab and files in /etc/cron.d/*
> - add aide bash fix
> - enable aide oval check in scan
>
> Signed-off-by: Gabe <redhatrises at gmail.com> <redhatrises at gmail.com>
> ---
> RHEL/6/input/checks/aide_cron_checking.xml | 39 +++++++++++++++++++++++++++
> RHEL/6/input/fixes/bash/aide_cron_checking.sh | 1 +
> RHEL/6/input/system/software/integrity.xml | 1 +
> 3 files changed, 41 insertions(+)
> create mode 100644 RHEL/6/input/checks/aide_cron_checking.xml
> create mode 100644 RHEL/6/input/fixes/bash/aide_cron_checking.sh
>
> diff --git a/RHEL/6/input/checks/aide_cron_checking.xml b/RHEL/6/input/checks/aide_cron_checking.xml
> new file mode 100644
> index 0000000..ed8f506
> --- /dev/null
> +++ b/RHEL/6/input/checks/aide_cron_checking.xml
> @@ -0,0 +1,39 @@
> +<def-group>
> + <definition class="compliance" id="aide_cron_checking" version="1">
> + <metadata>
> + <title>Configure Periodic Execution of AIDE</title>
> + <affected family="unix">
> + <platform>Red Hat Enterprise Linux 6</platform>
> + </affected>
> + <description>By default, AIDE does not install itself for periodic
> + execution. Periodically running AIDE is necessary to reveal
> + unexpected changes in installed files.
> + </description>
> + <reference source="MED" ref_id="20130928" ref_url="test_attestation" />
> + </metadata>
> + <criteria operator="OR">
> + <extend_definition comment="Aide is installed" negate="true" definition_ref="package_aide_installed" />
> + <criterion comment="run aide daily with cron" test_ref="test_aide_cron_checking" />
> + <criterion comment="run aide daily with cron" test_ref="test_aide_crond_checking" />
> + </criteria>
> + </definition>
> +
> + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="test_aide_cron_checking" version="1">
> + <ind:object object_ref="object_test_aide_cron_checking" />
> + </ind:textfilecontent54_test>
> + <ind:textfilecontent54_object comment="run aide daily with cron" id="object_test_aide_cron_checking" version="1">
> + <ind:filepath>/etc/crontab</ind:filepath>
> + <ind:pattern operation="pattern match">^[\s]*05[\s]*4[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern>
> + <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
> + </ind:textfilecontent54_object>
> +
> + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="test_aide_crond_checking" version="1">
> + <ind:object object_ref="object_test_aide_crond_checking" />
> + </ind:textfilecontent54_test>
> + <ind:textfilecontent54_object comment="run aide daily with cron" id="object_test_aide_crond_checking" version="1">
> + <ind:path>/etc/cron.d</ind:path>
> + <ind:filename operation="pattern match">^.*$</ind:filename>
> + <ind:pattern operation="pattern match">^[\s]*05[\s]*4[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern>
> + <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
> + </ind:textfilecontent54_object>
> +</def-group>
> diff --git a/RHEL/6/input/fixes/bash/aide_cron_checking.sh b/RHEL/6/input/fixes/bash/aide_cron_checking.sh
> new file mode 100644
> index 0000000..f62ef72
> --- /dev/null
> +++ b/RHEL/6/input/fixes/bash/aide_cron_checking.sh
> @@ -0,0 +1 @@
> +echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab
> diff --git a/RHEL/6/input/system/software/integrity.xml b/RHEL/6/input/system/software/integrity.xml
> index 55bf115..7c2f262 100644
> --- a/RHEL/6/input/system/software/integrity.xml
> +++ b/RHEL/6/input/system/software/integrity.xml
> @@ -100,6 +100,7 @@ To determine that periodic AIDE execution has been scheduled, run the following
> By default, AIDE does not install itself for periodic execution. Periodically
> running AIDE is necessary to reveal unexpected changes in installed files.
> </rationale>
> +<oval id="aide_cron_checking" />
> <ident cce="27222-9" />
> <ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/>
> </Rule>
> --
> 2.0.0
>
>
> I can't tell if anyone responded to this. So, risking being a dupe, thanks
> for filling out this gap in OVAL content! Two minor adjustments are needed:
>
> - The OVAL filename should be named to match the XCCDF rule ID. In this
> case, 'git mv aide_cron_checking.xml aide_periodic_cron_checking.xml'.
> Technically the build scripts will parse whatever is in the XCCDF oval id,
> though eventually we'll drop this bit of code and have things automatically
> (and only) search for matching XCCDF/OVAL/remediation script pairings.
>
> - The 0405 cron time was an example (which we need to make clearer), and
> not meant to mandate DoD systems to kickoff aide at 0405. The OVAL should
> be tolerant of any time combination within the hour/minute fields, and
> require *'s on days/month/week.
>
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140729/500656d8/attachment-0001.html>
More information about the scap-security-guide
mailing list