<div dir="ltr"><div><div>Hello,<br><br></div> Just wondering if someone can review this as I would like to push it soon if it is ack'ed.<br><br></div>Thanks,<br><br>Gabe<br></div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On Tue, Aug 5, 2014 at 4:29 PM, Gabe <span dir="ltr"><<a href="mailto:redhatrises@gmail.com" target="_blank">redhatrises@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
- add aide oval check to check /etc/crontab and files in /etc/cron.d/<br>
- add aide bash fix<br>
- enable aide oval check in scan<br>
<br>
Signed-off-by: Gabe <<a href="mailto:redhatrises@gmail.com">redhatrises@gmail.com</a>><br>
---<br>
.../6/input/checks/aide_periodic_cron_checking.xml | 39 ++++++++++++++++++++++<br>
.../fixes/bash/aide_periodic_cron_checking.sh | 1 +<br>
RHEL/6/input/system/software/integrity.xml | 1 +<br>
3 files changed, 41 insertions(+)<br>
create mode 100644 RHEL/6/input/checks/aide_periodic_cron_checking.xml<br>
create mode 100644 RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh<br>
<br>
diff --git a/RHEL/6/input/checks/aide_periodic_cron_checking.xml b/RHEL/6/input/checks/aide_periodic_cron_checking.xml<br>
new file mode 100644<br>
index 0000000..4a4dbff<br>
--- /dev/null<br>
+++ b/RHEL/6/input/checks/aide_periodic_cron_checking.xml<br>
@@ -0,0 +1,39 @@<br>
+<def-group><br>
+ <definition class="compliance" id="aide_periodic_cron_checking" version="1"><br>
+ <metadata><br>
+ <title>Configure Periodic Execution of AIDE</title><br>
+ <affected family="unix"><br>
+ <platform>Red Hat Enterprise Linux 6</platform><br>
+ </affected><br>
+ <description>By default, AIDE does not install itself for periodic<br>
+ execution. Periodically running AIDE is necessary to reveal<br>
+ unexpected changes in installed files.<br>
+ </description><br>
+ <reference source="MED" ref_id="20130928" ref_url="test_attestation" /><br>
+ </metadata><br>
+ <criteria operator="OR"><br>
+ <extend_definition comment="Aide is installed" negate="true" definition_ref="package_aide_installed" /><br>
+ <criterion comment="run aide daily with cron" test_ref="test_aide_periodic_cron_checking" /><br>
+ <criterion comment="run aide daily with cron" test_ref="test_aide_crond_checking" /><br>
+ </criteria><br>
+ </definition><br>
+<br>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="test_aide_periodic_cron_checking" version="1"><br>
+ <ind:object object_ref="object_test_aide_periodic_cron_checking" /><br>
+ </ind:textfilecontent54_test><br>
+ <ind:textfilecontent54_object comment="run aide daily with cron" id="object_test_aide_periodic_cron_checking" version="1"><br>
+ <ind:filepath>/etc/crontab</ind:filepath><br>
+ <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern><br>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance><br>
+ </ind:textfilecontent54_object><br>
+<br>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="test_aide_crond_checking" version="1"><br>
+ <ind:object object_ref="object_test_aide_crond_checking" /><br>
+ </ind:textfilecontent54_test><br>
+ <ind:textfilecontent54_object comment="run aide daily with cron" id="object_test_aide_crond_checking" version="1"><br>
+ <ind:path>/etc/cron.d</ind:path><br>
+ <ind:filename operation="pattern match">^.*$</ind:filename><br>
+ <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check+$</ind:pattern><br>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance><br>
+ </ind:textfilecontent54_object><br>
+</def-group><br>
diff --git a/RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh b/RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh<br>
new file mode 100644<br>
index 0000000..f62ef72<br>
--- /dev/null<br>
+++ b/RHEL/6/input/fixes/bash/aide_periodic_cron_checking.sh<br>
@@ -0,0 +1 @@<br>
+echo "05 4 * * * root /usr/sbin/aide --check" >> /etc/crontab<br>
diff --git a/RHEL/6/input/system/software/integrity.xml b/RHEL/6/input/system/software/integrity.xml<br>
index 55bf115..ab9f44d 100644<br>
--- a/RHEL/6/input/system/software/integrity.xml<br>
+++ b/RHEL/6/input/system/software/integrity.xml<br>
@@ -100,6 +100,7 @@ To determine that periodic AIDE execution has been scheduled, run the following<br>
By default, AIDE does not install itself for periodic execution. Periodically<br>
running AIDE is necessary to reveal unexpected changes in installed files.<br>
</rationale><br>
+<oval id="aide_periodic_cron_checking" /><br>
<ident cce="27222-9" /><br>
<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/><br>
</Rule><br>
<span class="HOEnZb"><font color="#888888">--<br>
2.0.0<br>
<br>
</font></span></blockquote></div><br></div>