scap-security-guide

scap-security-guide@lists.fedorahosted.org

1 participants
2355 discussions

Mapping auditd rules to compliance requirements
by Jeff Walzer 03 Dec '24

03 Dec '24

I am reviewing the auditd rules here <https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v4…>, and for example the rules block below lists the rules for Group add delete modify: ## Group add delete modify. This is covered by pam. However, someone could ## open a file and directly create or modify a user, so we'll watch group and ## gshadow for writes -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify I was looking to see if there was a doc that lists the individual auditd rules and the compliance requirement it would validate. So taking those rules above and dumping them into a spreadsheet as follows: User and Group Management Events Compliance Requirement Rules Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/passwd -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=user-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/group -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b32 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Group/Role Add, Delete, Modify (Success/Failure) -a always,exit -F arch=b64 -F path=/etc/gshadow -F perm=wa -F auid>=1000 -F auid!=unset -F key=group-modify Basically a mapping of compliance requirements and the rules associated that would be used to validate the compliance requirement. Thx

3 3

ComplianceAsCode/content v0.1.75
by Matthew Burket 14 Nov '24

14 Nov '24

Hello all, ComplianceAsCode/Content v0.1.75 is out. Some of the highlights of this release are: - Add new product kylinserver10 (#12393) - Create OL10 product (#12290) - Update PCI-DSS control file for version 4.0.1 (#12435) Welcome to the new contributors: * Eric Berry <eric.berry(a)canonical.com> * lichtblaugue <guenther.lichtblau(a)eviden.com> * Dmitry Makovey <dmakovey(a)yahoo.com> * Nicolas SAID <nicolas.said(a)atos.net> * yunimoo <yunimoo(a)nekocake.cafe> * zhaoyun <zhaoyun(a)kylinos.cn> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.75 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.75/scap-… Thank you to everyone who contributed! Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

Stabilization of v0.1.75
by Matthew Burket 06 Nov '24

06 Nov '24

Hello all, The release of Content version 0.1.75 is scheduled for November 07, 2025. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.76 milestone. Any bug fixes you would like to include in release 0.1.75 should be proposed for the *stabilization-v0.1.75* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.76, is scheduled to be released on February 09, 2025, with the stabilization phase starting on January 29, 2025. Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

ComplianceAsCode/content v0.1.74
by Matthew Burket 09 Aug '24

09 Aug '24

Hello all, ComplianceAsCode/Content v0.1.74 is out. Some of the highlights of this release are: - Add Amazon Linux 2023 product (#12006) - Introduce new remediation type Kickstart (#12144) - Make PAM macros more flexible to variables (#12133) - Remove Debian 10 Product (#12205) - Remove Red Hat Enterprise Linux 7 product (#12093) - Update CIS RHEL9 control file to v2.0.0 (#12067) Welcome to the new contributors: * Armando Acosta <armando.acosta(a)oracle.com> * CoreyCook8 <129206271+CoreyCook8(a)users.noreply.github.com> * Marco Fortina <marco_fortina(a)hotmail.it> * hipponix <mirco.santori(a)gmail.com> * Donald Hunter <donald.hunter(a)gmail.com> * Nathan Moyer <nmoyer(a)spectric.com> * namoyer10 <48189779+namoyer10(a)users.noreply.github.com> * Mirco Santori <mirco.santori(a)roche.com> * wqian <alan.moore(a)canonical.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74 Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

Stabilization of v0.1.74
by Matthew Burket 29 Jul '24

29 Jul '24

Hello all, The release of Content version 0.1.74 is scheduled for August 9, 2024. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.75 milestone. Any bug fixes you would like to include in release 0.1.74 should be proposed for the *stabilization-v0.1.74* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.75, is scheduled to be released on November 8, 2024, with the stabilization phase starting on October 28, 2024. Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

ComplianceAsCode/content v0.1.73
by Matthew Burket 16 May '24

16 May '24

Hello all, ComplianceAsCode/Content v0.1.73 is out. Some of the highlights of this release are: - CMP 2417: Implement PCI-DSS v4.0 outline for OpenShift (#11651) - Disable RHEL 10 content for 0.1.73 release (#11989) - Generate rule references from control files (#11540) - Initial implementation of STIG V1R1 profile for Ubuntu 22.04 LTS (#11820) Welcome to the new contributors: * Paul Bastide <pbastide(a)redhat.com> * BenGui <benoit.guillon1(a)etu.unilim.fr> * Ross Murphy <RossMurphy(a)ibm.com> * steven.y.gui <steven_ygui(a)163.com> * Yuqing Yang <yyq01323329(a)alibaba-inc.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.73/scap-… Thank you to everyone who contributed! Regards, Matthew Burket Software Engineer, RHEL Security Compliance Red Hat TZ=America/Chicago

1 0

stabilization of v0.1.73
by Vojtech Polasek 02 May '24

02 May '24

Hello all, The release of Content version 0.1.73 is scheduled for May 10, 2024. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.74 milestone. Any bug fixes you would like to include in release 0.1.73 should be proposed for the *stabilization-v0.1.73* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.74, is scheduled to be released on August 09, 2024, with the stabilization phase starting on July 29, 2024. Regards, Vojtech Polasek -- Vojtech Polasek he/him/his Software engineer, Security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

ComplianceAsCode/content v0.1.72
by Vojtech Polasek 09 Feb '24

09 Feb '24

Hello all, ComplianceAsCode/Content v0.1.72 is out. Some of the highlights of this release are: - ANSSI BP 028 profile for debian12 (#11368) - Building on Windows (#11406) - Control for BSI APP.4.4 (#11342) - update to CIS RHEL 7 and RHEL 8 profiles aligning them with the latest benchmarks Welcome to the new contributors: * David du Colombier <djc(a)datadoghq.com> * Commandcracker <lukas.fricke.dev(a)gmail.com> * ermeratos <manuel.ermer(a)atos.net> * Thomas Montague <montague.thomas(a)gmail.com> * Jennifer Power <barnabei.jennifer(a)gmail.com> * Paul Roche <paul.roche(a)menlosecurity.com> * Benjamin Ruland <benjamin.ruland(a)gmail.com> For full release notes, please have a look at: https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72 Pre-built content: https://github.com/ComplianceAsCode/content/releases/download/v0.1.72/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.72/scap-… Source tarball: https://github.com/ComplianceAsCode/content/releases/download/v0.1.72/scap-… SHA-512 hash: https://github.com/ComplianceAsCode/content/releases/download/v0.1.72/scap-… Thank you to everyone who contributed! Regards, -- Vojtech Polasek he/him/his Software engineer, Security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

1 0

Stabilization of v0.1.72
by Marcus Burghardt 29 Jan '24

29 Jan '24

Hello all, The release of Content version 0.1.72 is scheduled for February 09, 2024. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.73 milestone. Any bug fixes you would like to include in release 0.1.72 should be proposed for the *stabilization-v0.1.72* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.73, is scheduled to be released on April 12, 2024, with the stabilization phase starting on April 01, 2024. Regards, -- Marcus Burghardt Senior Software Engineer, Security Compliance Red Hat <https://www.redhat.com/> <https://www.redhat.com/> Red Hat GmbH <https://www.redhat.com/de/global/dach>, Registered seat: Werner von Siemens Ring 12, D-85630 Grasbrunn, Germany Commercial register: Amtsgericht Muenchen/Munich, HRB 153243, Managing Directors: Ryan Barnhart, Charles Cachera, Michael O'Neill, Amy Ross

1 0

stabilization of v0.1.71
by Vojtech Polasek 03 Jan '24

03 Jan '24

Hello all, the release of Content version 0.1.71 is scheduled for December 8, 2023. As part of the release process, a stabilization branch was created. Issues and PRs that were not solved were moved to the 0.1.72 milestone. Any bug fixes you would like to include in release 0.1.71 should be proposed for the *stabilization-v0.1.71* and *master* branches as a measure to avoid potential conflicts between these branches. The next version, 0.1.72, is scheduled to be released on February 9, 2024, with the stabilization phase starting on January 29, 2024. Regards, -- Vojtech Polasek he/him/his Software engineer, Security compliance Red Hat <https://www.redhat.com> vpolasek(a)redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com>

3 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide