From 2054929aedddd11c73693cf62cf1dc8d9a3cacfe Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Fri, 29 Nov 2013 17:14:32 +0100
Subject: [PATCH] [Fedora] Add OVAL check for 'Set SSH Client Alive Count' rule

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 .../checks/package_openssh-server_removed.xml      | 25 ++++++++++++++
 Fedora/input/checks/service_sshd_disabled.xml      | 36 ++++++++++++++++++++
 Fedora/input/checks/sshd_set_keepalive.xml         | 35 +++++++++++++++++++
 Fedora/input/checks/templates/Makefile             |  1 +
 .../checks/templates/create_package_removed.py     | 39 ++++++++++++++++++++++
 Fedora/input/checks/templates/packages_removed.csv |  1 +
 .../checks/templates/template_package_removed      | 25 ++++++++++++++
 Fedora/input/services/ssh.xml                      |  2 +-
 Fedora/scap-security-guide.spec                    |  5 ++-
 9 files changed, 167 insertions(+), 2 deletions(-)
 create mode 100644 Fedora/input/checks/package_openssh-server_removed.xml
 create mode 100644 Fedora/input/checks/service_sshd_disabled.xml
 create mode 100644 Fedora/input/checks/sshd_set_keepalive.xml
 create mode 100755 Fedora/input/checks/templates/create_package_removed.py
 create mode 100644 Fedora/input/checks/templates/packages_removed.csv
 create mode 100644 Fedora/input/checks/templates/template_package_removed

diff --git a/Fedora/input/checks/package_openssh-server_removed.xml b/Fedora/input/checks/package_openssh-server_removed.xml
new file mode 100644
index 0000000..785681d
--- /dev/null
+++ b/Fedora/input/checks/package_openssh-server_removed.xml
@@ -0,0 +1,25 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="package_openssh-server_removed"
+  version="1">
+    <metadata>
+      <title>Package openssh-server Removed</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The RPM package openssh-server should be removed.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="package openssh-server is removed"
+      test_ref="test_package_openssh-server_removed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="none_exist"
+  id="test_package_openssh-server_removed" version="1"
+  comment="package openssh-server is removed">
+    <linux:object object_ref="obj_package_openssh-server_removed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_openssh-server_removed" version="1">
+    <linux:name>openssh-server</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/Fedora/input/checks/service_sshd_disabled.xml b/Fedora/input/checks/service_sshd_disabled.xml
new file mode 100644
index 0000000..160c79f
--- /dev/null
+++ b/Fedora/input/checks/service_sshd_disabled.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="service_sshd_disabled" version="1">
+    <metadata>
+      <title>Service sshd Disabled</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>
+        The sshd service should be disabled.
+      </description>
+    </metadata>
+    <criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
+    <extend_definition comment="openssh-server removed" definition_ref="package_openssh-server_removed" />
+      <criterion comment="sshd disabled in multi-user.target" test_ref="test_sshd_disabled_multi_user_target" />
+    </criteria>
+  </definition>
+
+  <unix:file_test check="all" check_existence="none_exist"
+   comment="look for sshd.service in /etc/systemd/system/multi-user.target.wants"
+   id="test_sshd_disabled_multi_user_target" version="1">
+
+    <unix:object object_ref="object_sshd_disabled_multi_user_target" />
+  </unix:file_test>
+
+  <unix:file_object comment="look for sshd.service in /etc/systemd/system/multi-user.target.wants"
+   id="object_sshd_disabled_multi_user_target" version="1">
+
+    <unix:filepath>/etc/systemd/system/multi-user.target.wants/sshd.service</unix:filepath>
+    <filter action="include">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_state id="state_symlink" version="1">
+    <unix:type operation="equals">symbolic link</unix:type>
+  </unix:file_state>
+
+</def-group>
diff --git a/Fedora/input/checks/sshd_set_keepalive.xml b/Fedora/input/checks/sshd_set_keepalive.xml
new file mode 100644
index 0000000..e9beb43
--- /dev/null
+++ b/Fedora/input/checks/sshd_set_keepalive.xml
@@ -0,0 +1,35 @@
+<def-group>
+  <definition class="compliance" id="sshd_set_keepalive" version="1">
+    <metadata>
+      <title>Set ClientAliveCountMax for User Logins</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The SSH ClientAliveCountMax should be set to an appropriate
+      value (and dependencies are met)</description>
+    </metadata>
+    <criteria comment="SSH is not being used or conditions are met" operator="OR">
+      <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" />
+      <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="test_sshd_clientalivecountmax" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"
+   comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file"
+   id="test_sshd_clientalivecountmax" version="1">
+
+    <ind:object object_ref="obj_sshd_clientalivecountmax" />
+    <ind:state state_ref="state_sshd_clientalivecountmax" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_sshd_clientalivecountmax" version="1">
+    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_sshd_clientalivecountmax" version="1">
+    <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
+  </ind:textfilecontent54_state>
+
+</def-group>
diff --git a/Fedora/input/checks/templates/Makefile b/Fedora/input/checks/templates/Makefile
index b0236b0..4db9bec 100644
--- a/Fedora/input/checks/templates/Makefile
+++ b/Fedora/input/checks/templates/Makefile
@@ -2,6 +2,7 @@ templates: packages
 
 packages:
 	./create_package_installed.py packages_installed.csv
+	./create_package_removed.py packages_removed.csv
 
 compare:
 	diff output/ ../ | grep -v "Only in ../"
diff --git a/Fedora/input/checks/templates/create_package_removed.py b/Fedora/input/checks/templates/create_package_removed.py
new file mode 100755
index 0000000..f777cc1
--- /dev/null
+++ b/Fedora/input/checks/templates/create_package_removed.py
@@ -0,0 +1,39 @@
+#!/usr/bin/python
+
+#
+# create_package_removed.py
+#   automatically generate checks for removed packages
+#
+# NOTE: The file 'template_package_removed' should be located in the same working directory as this script. The
+# template contains the following tags that *must* be replaced successfully in order for the checks to work.
+#
+# PKGNAME - the name of the package that should be removed
+#
+
+import sys, csv, re
+
+def output_check(package_info):
+    pkgname = package_info[0]
+    if (pkgname):
+        with open("./template_package_removed", 'r') as templatefile:
+            filestring = templatefile.read()
+            filestring = filestring.replace("PKGNAME", pkgname)
+            with open("./output/package_" + pkgname + "_removed.xml", 'wb+') as outputfile:
+                outputfile.write(filestring)
+                outputfile.close()
+
+def main():
+    if len(sys.argv) < 2:
+        print("usage: %s <CSV_FILE_PATH>" % sys.argv[0])
+        print("   the csv file should contain lines of the format:")
+        print("   PACKAGE_NAME")
+        sys.exit(1)
+
+    with open(sys.argv[1], 'r') as csv_file:
+        csv_lines = csv.reader(csv_file)
+        for line in csv_lines:
+            output_check(line)
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main()
diff --git a/Fedora/input/checks/templates/packages_removed.csv b/Fedora/input/checks/templates/packages_removed.csv
new file mode 100644
index 0000000..dd21b5a
--- /dev/null
+++ b/Fedora/input/checks/templates/packages_removed.csv
@@ -0,0 +1 @@
+openssh-server
diff --git a/Fedora/input/checks/templates/template_package_removed b/Fedora/input/checks/templates/template_package_removed
new file mode 100644
index 0000000..8c37dfe
--- /dev/null
+++ b/Fedora/input/checks/templates/template_package_removed
@@ -0,0 +1,25 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_package_removed.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="package_PKGNAME_removed"
+  version="1">
+    <metadata>
+      <title>Package PKGNAME Removed</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The RPM package PKGNAME should be removed.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="package PKGNAME is removed"
+      test_ref="test_package_PKGNAME_removed" />
+    </criteria>
+  </definition>
+  <linux:rpminfo_test check="all" check_existence="none_exist"
+  id="test_package_PKGNAME_removed" version="1"
+  comment="package PKGNAME is removed">
+    <linux:object object_ref="obj_package_PKGNAME_removed" />
+  </linux:rpminfo_test>
+  <linux:rpminfo_object id="obj_package_PKGNAME_removed" version="1">
+    <linux:name>PKGNAME</linux:name>
+  </linux:rpminfo_object>
+</def-group>
diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
index b41b741..d01e090 100644
--- a/Fedora/input/services/ssh.xml
+++ b/Fedora/input/services/ssh.xml
@@ -84,7 +84,7 @@ follows:
 This ensures a user login will be terminated as soon as the
 <tt>ClientAliveCountMax</tt> is reached.
 </rationale>
-<!-- <oval id="sshd_set_keepalive" /> -->
+<oval id="sshd_set_keepalive" />
 <ref disa="879,1133"/>
 </Rule>
 
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index c7f5fe8..05ca9a6 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
 
-%global	fedorassgversion	4.rc7
+%global	fedorassgversion	4.rc8
 
 Name:		scap-security-guide
 Version:	0.1.%{fedorassgversion}
@@ -54,6 +54,9 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
 %doc Fedora/LICENSE Fedora/output/ssg-fedora-guide.html
 
 %changelog
+* Fri Nov 29 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4.rc8-1
+- Add OVAL check for sshd's ClientAliveCountMax rule
+
 * Thu Nov 28 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4.rc7-1
 - Include descriptions for permissions section, and rules for checking
   permissions and ownership of shared library files and system executables
-- 
1.8.3.1

