This is being done in favor of storing CCE identifiers only in the XCCDF Rules as idents (which made sense for a number of reasons).
Yes, these templates/scripts feel so very much like an undergraduate (or possibly high-school) programming project. But consider the superficiality of their operation as a benefit.
If I were starting over, I might have instead created a small dictionary of macros in XSLT to take care of generating the significant non-information-bearing OVAL overhead instead. This would allow for authors to create extremely simple XML files to express the necessary information, and also avoid the creation of any kind of parser. Maybe for RHEL 7...
Jeffrey Blank (4): new helper scripts for making/verifying/installing templated files removed CCE handling from scripts that create templated OVAL checks removed CCE identifiers from template source-info files removal of CCE info from templates for kernelmods, packages, perms, services, sysctls
RHEL6/input/checks/templates/Makefile | 30 ++++++ RHEL6/input/checks/templates/README | 32 +++++- .../templates/create_kernel_modules_disabled.py | 15 ++-- .../checks/templates/create_package_installed.py | 11 +-- .../checks/templates/create_package_removed.py | 10 +-- .../checks/templates/create_permission_checks.py | 9 +- .../checks/templates/create_services_disabled.py | 6 +- .../checks/templates/create_services_enabled.py | 6 +- .../input/checks/templates/create_sysctl_checks.py | 5 +- .../checks/templates/file_dir_permissions.csv | 7 +- RHEL6/input/checks/templates/find_untemplated.py | 31 ++++++ .../checks/templates/kernel_modules_disabled.csv | 24 ++-- .../input/checks/templates/packages_installed.csv | 34 ++++--- RHEL6/input/checks/templates/packages_removed.csv | 106 ++++++++++---------- RHEL6/input/checks/templates/services_disabled.csv | 103 ++++++++++---------- RHEL6/input/checks/templates/services_enabled.csv | 24 ++-- RHEL6/input/checks/templates/sysctl_values.csv | 36 +++---- .../templates/template_kernel_module_disabled | 2 - .../checks/templates/template_package_installed | 1 - .../checks/templates/template_package_removed | 1 - RHEL6/input/checks/templates/template_permissions | 1 - .../checks/templates/template_service_disabled | 1 - .../checks/templates/template_service_enabled | 1 - RHEL6/input/checks/templates/template_sysctl | 1 - 24 files changed, 281 insertions(+), 216 deletions(-) create mode 100644 RHEL6/input/checks/templates/Makefile create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/checks/templates/Makefile | 30 +++++++++++++++++++++ RHEL6/input/checks/templates/find_untemplated.py | 31 ++++++++++++++++++++++ 2 files changed, 61 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/templates/Makefile create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
diff --git a/RHEL6/input/checks/templates/Makefile b/RHEL6/input/checks/templates/Makefile new file mode 100644 index 0000000..c17bfc2 --- /dev/null +++ b/RHEL6/input/checks/templates/Makefile @@ -0,0 +1,30 @@ +templates: services packages kernel_modules permissions sysctls + +services: + ./create_services_disabled.py services_disabled.csv + ./create_services_enabled.py services_enabled.csv + +packages: + ./create_package_installed.py packages_installed.csv + ./create_package_removed.py packages_removed.csv + +kernel_modules: + ./create_kernel_modules_disabled.py kernel_modules_disabled.csv + +permissions: + ./create_permission_checks.py file_dir_permissions.csv + +sysctls: + ./create_sysctl_checks.py sysctl_values.csv + +compare: + diff output/ ../ | grep -v "Only in ../" + +copy: + cp output/*.xml ../ + +find-untemplated: templates + ./find_untemplated.py + +clean: + rm output/*.xml diff --git a/RHEL6/input/checks/templates/find_untemplated.py b/RHEL6/input/checks/templates/find_untemplated.py new file mode 100755 index 0000000..222d105 --- /dev/null +++ b/RHEL6/input/checks/templates/find_untemplated.py @@ -0,0 +1,31 @@ +#!/usr/bin/python + +import sys, os, glob + +# locate files in the parent directory that match a certain filename pattern and thus +# should be templated, and compare to currently templated files. + +def main(): + prefixsearchlist = [ 'package_' , 'service_', 'sysctl_', 'kernel_module_' ] + # the directory/file permission situation still needs to be sorted out, then we should add file_permissions etc + + templatable_files = [] + for prefix in prefixsearchlist: + foundfiles = glob.glob("../"+prefix+"*.xml") + templatable_files.extend(foundfiles) + + templatable = set([os.path.basename(file) for file in templatable_files ]) + templated = set([os.path.basename(file) for file in glob.glob("./output/*.xml")]) + + untemplated = templatable.difference(templated) + + print "\nThe following files' names suggest they could be templated, though they might be intentionally edited:" + for file in untemplated: + print file + print "\nA typical reason for hand-editing a file is to gracefully handle situations where the test should pass." + + sys.exit(0) + +if __name__ == "__main__": + main() +
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- RHEL6/input/checks/templates/README | 32 ++++++++++++++++--- .../templates/create_kernel_modules_disabled.py | 15 ++++----- .../checks/templates/create_package_installed.py | 11 ++---- .../checks/templates/create_package_removed.py | 10 ++---- .../checks/templates/create_permission_checks.py | 9 ++--- .../checks/templates/create_services_disabled.py | 6 +-- .../checks/templates/create_services_enabled.py | 6 +-- .../input/checks/templates/create_sysctl_checks.py | 5 +-- 8 files changed, 51 insertions(+), 43 deletions(-)
diff --git a/RHEL6/input/checks/templates/README b/RHEL6/input/checks/templates/README index d131cb8..f028c5f 100644 --- a/RHEL6/input/checks/templates/README +++ b/RHEL6/input/checks/templates/README @@ -2,12 +2,34 @@ These templates are designed to make generation of OVAL tests which have repetitive structure easier.
For example: - -./create_services_disabled.py services_disabled.csv - -Should produce all the OVAL checks (in a shorthand format) -to disable services in the output folder. + $ ./create_services_disabled.py services_disabled.csv +will produce all the OVAL checks (in a shorthand format) +to disable services, and store them in the output directory.
The CSV input files should contain all the relevant information for each check. Files should be compared to existing OVAL checks for consistency before copying to the main checks directory. + + +A Makefile exists to activate all the scripts here and ease comparison +with existing checks. For example, to run all scripts to generate +OVAL checks from the available templates: + $ make templates + +To compare the newly-generated files in the output directory to the existing +checks, run: + $ make compare + +Then, if the changes are agreeable, the following command can be run to copy the +newly generated files to the main checks directory: + $ make copy + +To list files that have been manually created (and may potentially be +templated), run: + # make find-untemplated + +Note, however, that some checks may have been intentionally hand-edited. +For example, some sysctl checks (such as for IPv6) may include additional +tests so that they pass if the IPv6 module is disabled. Never blindly +copy over existing checks. + diff --git a/RHEL6/input/checks/templates/create_kernel_modules_disabled.py b/RHEL6/input/checks/templates/create_kernel_modules_disabled.py index e2d9f49..51dc812 100755 --- a/RHEL6/input/checks/templates/create_kernel_modules_disabled.py +++ b/RHEL6/input/checks/templates/create_kernel_modules_disabled.py @@ -4,34 +4,33 @@ # create_kernel_modules_disabled.py # automatically generate checks for disabled kernel modules # -# NOTE: The file 'template_kernel_module_disabled' should be located in the same working directory as this script. The -# template contains the following tags that *must* be replaced successfully in order for the checks to work. +# NOTE: The file 'template_kernel_module_disabled' should be located in the +# same working directory as this script. The template contains the following +# tags that *must* be replaced successfully in order for the checks to work. # # KERNMODULE - the name of the kernel module that should be disabled -# CCEID - the corresponding CCE reference (optional) #
import sys, csv, re
def output_checkfile(kerninfo): # get the items out of the list - kernmod, cce = kerninfo + kernmod = kerninfo[0] with open("./template_kernel_module_disabled", 'r') as templatefile: filestring = templatefile.read() filestring = filestring.replace("KERNMODULE", kernmod) - filestring = filestring.replace("CCEID", cce if cce else "TODO") with open("./output/kernel_module_" + kernmod + "_disabled.xml", 'wb+') as outputfile: outputfile.write(filestring) outputfile.close()
def main(): if len(sys.argv) < 2: - print "Provide a CSV file containing lines of the format: kernmod,CCE" + print "Provide a CSV file containing lines of the format: kernmod" sys.exit(1) with open(sys.argv[1], 'r') as f: # put the CSV line's items into a list - servicelines = csv.reader(f) - for line in servicelines: + lines = csv.reader(f) + for line in lines: output_checkfile(line)
sys.exit(0) diff --git a/RHEL6/input/checks/templates/create_package_installed.py b/RHEL6/input/checks/templates/create_package_installed.py index f36ba80..e227567 100755 --- a/RHEL6/input/checks/templates/create_package_installed.py +++ b/RHEL6/input/checks/templates/create_package_installed.py @@ -8,30 +8,27 @@ # template contains the following tags that *must* be replaced successfully in order for the checks to work. # # PKGNAME - the name of the package that should be installed -# PKGCCE - the corresponding CCE reference (optional) #
import sys, csv, re
def output_check(package_info): - pkgname, pkgcce = package_info - if (pkgname): + pkgname = package_info[0] + if pkgname: with open("./template_package_installed", 'r') as templatefile: filestring = templatefile.read() filestring = filestring.replace("PKGNAME", pkgname) - filestring = filestring.replace("PKGCCE", pkgcce if pkgcce else "TODO") with open("./output/package_" + pkgname + "_installed.xml", 'wb+') as outputfile: outputfile.write(filestring) outputfile.close() else: - print("ERROR: input violation: the package name must be defined") - print(" pkgname --> "%s" pkgcce --> "%s"" % (pkgname, pkgcce)) + print "ERROR: input violation: the package name must be defined"
def main(): if len(sys.argv) < 2: print("usage: %s <CSV_FILE_PATH>" % sys.argv[0]) print(" the csv file should contain lines of the format:") - print(" PACKAGE_NAME,PACKAGE_CCE") + print(" PACKAGE_NAME") sys.exit(1) with open(sys.argv[1], 'r') as csv_file: csv_lines = csv.reader(csv_file) diff --git a/RHEL6/input/checks/templates/create_package_removed.py b/RHEL6/input/checks/templates/create_package_removed.py index e7f5c1e..f777cc1 100755 --- a/RHEL6/input/checks/templates/create_package_removed.py +++ b/RHEL6/input/checks/templates/create_package_removed.py @@ -8,31 +8,27 @@ # template contains the following tags that *must* be replaced successfully in order for the checks to work. # # PKGNAME - the name of the package that should be removed -# PKGCCE - the corresponding CCE reference (optional) #
import sys, csv, re
def output_check(package_info): - pkgname, pkgcce = package_info + pkgname = package_info[0] if (pkgname): with open("./template_package_removed", 'r') as templatefile: filestring = templatefile.read() filestring = filestring.replace("PKGNAME", pkgname) - filestring = filestring.replace("PKGCCE", pkgcce if pkgcce else "TODO") with open("./output/package_" + pkgname + "_removed.xml", 'wb+') as outputfile: outputfile.write(filestring) outputfile.close() - else: - print("ERROR: input violation: the package name must be defined") - print(" pkgname --> "%s" pkgcce --> "%s"" % (pkgname, pkgcce))
def main(): if len(sys.argv) < 2: print("usage: %s <CSV_FILE_PATH>" % sys.argv[0]) print(" the csv file should contain lines of the format:") - print(" PACKAGE_NAME,PACKAGE_CCE") + print(" PACKAGE_NAME") sys.exit(1) + with open(sys.argv[1], 'r') as csv_file: csv_lines = csv.reader(csv_file) for line in csv_lines: diff --git a/RHEL6/input/checks/templates/create_permission_checks.py b/RHEL6/input/checks/templates/create_permission_checks.py index e6b6547..70222fb 100755 --- a/RHEL6/input/checks/templates/create_permission_checks.py +++ b/RHEL6/input/checks/templates/create_permission_checks.py @@ -7,14 +7,14 @@ # NOTE: The file 'template_permissions' should be located in the same working directory as this script. The # template contains tags that *must* be replaced successfully in order for the checks to work. # -# directory path,file name,owner uid (numeric),group owner gid (numeric),mode,CCE +# directory path,file name,owner uid (numeric),group owner gid (numeric),mode
import sys, csv, re
def output_check(path_info): # the csv file contains lines that match the following layout: - # directory,file_name,uid,gid,mode,cce - dir_path, file_name, uid, gid, mode, cce = path_info + # directory,file_name,uid,gid,mode + dir_path, file_name, uid, gid, mode = path_info
# build a string out of the path that is suitable for use in id tags # example: /etc/resolv.conf --> _etc_resolv_conf @@ -51,7 +51,6 @@ def output_check(path_info): filestring = filestring.replace("FILEID", path_id) filestring = filestring.replace("FILEPATH", full_path) filestring = filestring.replace("FILEDIR", dir_path) - filestring = filestring.replace("CCEID", cce if cce else "TODO") filestring = filestring.replace("FILEUID", uid) filestring = filestring.replace("FILEGID", gid) filestring = filestring.replace("FILEMODE", mode) @@ -70,7 +69,7 @@ def output_check(path_info): def main(): if len(sys.argv) < 2: print "\nERROR: you must provide the path to a CSV file that contains lines like so:" - print " directory path,file name,owner uid (numeric),group owner gid (numeric),mode,CCE" + print " directory path,file name,owner uid (numeric),group owner gid (numeric),mode" sys.exit(1)
# open and read the csv file diff --git a/RHEL6/input/checks/templates/create_services_disabled.py b/RHEL6/input/checks/templates/create_services_disabled.py index ee7eee2..b500a92 100755 --- a/RHEL6/input/checks/templates/create_services_disabled.py +++ b/RHEL6/input/checks/templates/create_services_disabled.py @@ -9,18 +9,16 @@ # # SERVICENAME - the name of the service that should be disabled # PACKAGENAME - the name of the package that installs the service -# CCE_ID - the corresponding CCE reference (optional) #
import sys, csv, re
def output_checkfile(serviceinfo): # get the items out of the list - servicename, packagename, cce = serviceinfo + servicename, packagename = serviceinfo with open("./template_service_disabled", 'r') as templatefile: filestring = templatefile.read() filestring = filestring.replace("SERVICENAME", servicename) - filestring = filestring.replace("CCE_ID", cce if cce else "TODO") if packagename: filestring = filestring.replace("PACKAGENAME", packagename) else: @@ -32,7 +30,7 @@ def output_checkfile(serviceinfo):
def main(): if len(sys.argv) < 2: - print "Provide a CSV file containing lines of the format: servicename,packagename,CCE" + print "Provide a CSV file containing lines of the format: servicename,packagename" sys.exit(1) with open(sys.argv[1], 'r') as f: # put the CSV line's items into a list diff --git a/RHEL6/input/checks/templates/create_services_enabled.py b/RHEL6/input/checks/templates/create_services_enabled.py index 611bc14..edb606f 100755 --- a/RHEL6/input/checks/templates/create_services_enabled.py +++ b/RHEL6/input/checks/templates/create_services_enabled.py @@ -9,18 +9,16 @@ # # SERVICENAME - the name of the service that should be enabled # PACKAGENAME - the name of the package that installs the service -# CCE_ID - the corresponding CCE reference (optional) #
import sys, csv, re
def output_checkfile(serviceinfo): # get the items out of the list - servicename, packagename, cce = serviceinfo + servicename, packagename = serviceinfo with open("./template_service_enabled", 'r') as templatefile: filestring = templatefile.read() filestring = filestring.replace("SERVICENAME", servicename) - filestring = filestring.replace("CCE_ID", cce if cce else "TODO") if packagename: filestring = filestring.replace("PACKAGENAME", packagename) else: @@ -32,7 +30,7 @@ def output_checkfile(serviceinfo):
def main(): if len(sys.argv) < 2: - print "Provide a CSV file containing lines of the format: servicename,packagename,CCE" + print "Provide a CSV file containing lines of the format: servicename,packagename" sys.exit(1) with open(sys.argv[1], 'r') as f: # put the CSV line's items into a list diff --git a/RHEL6/input/checks/templates/create_sysctl_checks.py b/RHEL6/input/checks/templates/create_sysctl_checks.py index 3da896a..009df15 100755 --- a/RHEL6/input/checks/templates/create_sysctl_checks.py +++ b/RHEL6/input/checks/templates/create_sysctl_checks.py @@ -4,7 +4,7 @@ import sys, csv, re
def output_checkfile(serviceinfo): # get the items out of the list - sysctl_var, sysctl_val, cce = serviceinfo + sysctl_var, sysctl_val = serviceinfo # convert variable name to a format suitable for 'id' tags sysctl_var_id = re.sub('[-.]', '_', sysctl_var) # open the template and perform the conversions @@ -13,7 +13,6 @@ def output_checkfile(serviceinfo): filestring = filestring.replace("SYSCTLID", sysctl_var_id) filestring = filestring.replace("SYSCTLVAR", sysctl_var) filestring = filestring.replace("SYSCTLVAL", sysctl_val) - filestring = filestring.replace("CCE_ID", cce if cce else "TODO") # write the check with open("./output/sysctl_" + sysctl_var_id + ".xml", 'wb+') as outputfile: outputfile.write(filestring) @@ -21,7 +20,7 @@ def output_checkfile(serviceinfo):
def main(): if len(sys.argv) < 2: - print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue,CCE" + print "Provide a CSV file containing lines of the format: sysctlvariable,sysctlvalue" sys.exit(1) with open(sys.argv[1], 'r') as f: # put the CSV line's items into a list
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- .../checks/templates/file_dir_permissions.csv | 7 +- .../checks/templates/kernel_modules_disabled.csv | 24 ++-- .../input/checks/templates/packages_installed.csv | 34 ++++--- RHEL6/input/checks/templates/packages_removed.csv | 106 ++++++++++---------- RHEL6/input/checks/templates/services_disabled.csv | 103 ++++++++++---------- RHEL6/input/checks/templates/services_enabled.csv | 24 ++-- RHEL6/input/checks/templates/sysctl_values.csv | 36 +++---- 7 files changed, 169 insertions(+), 165 deletions(-)
diff --git a/RHEL6/input/checks/templates/file_dir_permissions.csv b/RHEL6/input/checks/templates/file_dir_permissions.csv index 1efaf7d..781f413 100644 --- a/RHEL6/input/checks/templates/file_dir_permissions.csv +++ b/RHEL6/input/checks/templates/file_dir_permissions.csv @@ -1,4 +1,3 @@ -/etc,at.allow,0,0,0600, -/etc,cron.allow,0,0,0600, -/boot/grub,grub.conf,0,0,0600, -/var/log,cron,0,0,0600, +/etc,shadow,0,0,0000 +/etc,passwd,0,0,0644 +/boot/grub,grub.conf,0,0,0600 diff --git a/RHEL6/input/checks/templates/kernel_modules_disabled.csv b/RHEL6/input/checks/templates/kernel_modules_disabled.csv index 80bfc4f..1310316 100644 --- a/RHEL6/input/checks/templates/kernel_modules_disabled.csv +++ b/RHEL6/input/checks/templates/kernel_modules_disabled.csv @@ -1,12 +1,12 @@ -cramfs,14089-7 -dccp,14268-7 -freevxfs,14457-6 -hfs,15087-0 -hfsplus,14093-9 -jffs2,14853-6 -rds,14027-7 -sctp,14132-5 -squashfs,14118-4 -tipc,14911-2 -udf,14871-8 -usb-storage,4187-1 +cramfs +dccp +freevxfs +hfs +hfsplus +jffs2 +rds +sctp +squashfs +tipc +udf +usb-storage diff --git a/RHEL6/input/checks/templates/packages_installed.csv b/RHEL6/input/checks/templates/packages_installed.csv index cb7a5ba..0028011 100644 --- a/RHEL6/input/checks/templates/packages_installed.csv +++ b/RHEL6/input/checks/templates/packages_installed.csv @@ -1,15 +1,19 @@ -aide,4209-3 -audit, -cronie, -ipsec-tools,18031-5 -iptables, -iptables-ipv6, -irqbalance, -lvm2, -ntpdate, -ntp, -openswan, -policycoreutils, -postfix,14068-1 -psacct, -rsyslog,17742-8 +aide +audit +cronie +ipsec-tools +iptables +iptables-ipv6 +irqbalance +lvm2 +ntpdate +ntp +openldap-servers +openswan +policycoreutils +postfix +psacct +rhn_gpgkey +rsyslog +vlock +vsftpd diff --git a/RHEL6/input/checks/templates/packages_removed.csv b/RHEL6/input/checks/templates/packages_removed.csv index 931acab..697f658 100644 --- a/RHEL6/input/checks/templates/packages_removed.csv +++ b/RHEL6/input/checks/templates/packages_removed.csv @@ -1,52 +1,54 @@ -abrt, -acpid, -at, -autofs, -bind,4219-2 -certmonger, -cpuspeed, -cronie-anacron, -cups, -cyrus-sasl, -dbus, -dhcp,4464-4 -dovecot,4239-0 -hal, -httpd,4514-6 -inetd,4023-8 -irda-utils,17504-2 -isdn4k-utils,14825-4 -kexec-tools, -libcgroup, -mdadm, -net-snmp,4404-0 -nfs-utils, -oddjob, -openldap, -openssh-server, -pam_ccreds,17250-2 -portreserve, -qpid-cpp-server, -quota, -rhnsd, -rpcbind, -rsh,4308-3 -rsh-server, -samba-common, -samba, -sendmail,14495-6 -smartmontools, -squid,4076-6 -sssd, -subscription-manager, -sysstat, -talk,18200-6 -talk-server,18151-1 -telnet-server,4330-7 -tftp-server,3916-4 -vlock,3910-7 -vsftpd,14881-7 -xinetd,4164-0 -xorg-x11-server-common,4422-2 -ypbind, -ypserv, +abrt +acpid +at +autofs +bind +certmonger +cpuspeed +cronie-anacron +cups +cyrus-sasl +dbus +dhcp +dhcpd +dovecot +hal +httpd +iputils +irda-utils +isdn4k-utils +kexec-tools +libcgroup +mdadm +net-snmp +nfs-utils +oddjob +openldap +openldap-servers +openssh-server +pam_ldap +portreserve +qpid-cpp-server +quota +rhnsd +rpcbind +rsh +rsh-server +samba-common +samba +sendmail +smartmontools +squid +sssd +subscription-manager +sysstat +talk +talk-server +telnet-server +tftp-server +vlock +vsftpd +xinetd +xorg-x11-server-common +ypbind +ypserv diff --git a/RHEL6/input/checks/templates/services_disabled.csv b/RHEL6/input/checks/templates/services_disabled.csv index 32d93a4..ac10178 100644 --- a/RHEL6/input/checks/templates/services_disabled.csv +++ b/RHEL6/input/checks/templates/services_disabled.csv @@ -1,51 +1,52 @@ -abrtd,, -acpid,, -autofs,, -certmonger,, -cgred,, -sssd,, -telnetd,, -atd,at,4298-6 -avahi-daemon,,4365-3 -bluetooth,,4355-4 -cgconfig,libcgroup, -cpuspeed,cpuspeed, -cups,cups, -dhcpd,dhcp,4336-4 -dovecot,dovecot,3847-1 -haldaemon,hal, -httpd,httpd,4338-0 -isdn,isdn4k-utils,4286-1 -kdump,kexec-tools, -mcstrans,,3668-1 -mdmonitor,mdadm, -messagebus,dbus, -named,bind,3578-2 -netconsole,, -netfs,, -nfs,nfs-utils, -nfslock,nfs-utils, -oddjobd,oddjob, -portreserve,portreserve, -quota_nld,quota, -rdisc,iputils, -rhnsd,rhnsd,3416-5 -rhsmcertd,subscription-manager, -rpcbind,rpcbind, -rpcgssd,nfs-utils, -rpcidmapd,nfs-utils, -rpcsvcgssd,nfs-utils, -saslauthd,cyrus-sasl, -sendmail,sendmail,4416-4 -smartd,smartmontools, -smb,,4551-8 -snmpd,net-snmp,3765-5 -squid,squid,4556-7 -sshd,openssh-server,4268-9 -sysstat,sysstat, -telnet,telnet-server,3390-2 -tftp,tftp-server,4273-9 -vsftpd,vsftpd,3919-8 -xinetd,xinetd,4252-3 -ypbind,ypbind,4072-5 -ypserv,ypserv,3705-1 +abrtd, +acpid, +autofs, +certmonger, +cgred, +sssd, +telnetd, +atd,at +avahi-daemon, +bluetooth, +cgconfig,libcgroup +cpuspeed,cpuspeed +cups,cups +dhcpd,dhcp +dovecot,dovecot +haldaemon,hal +httpd,httpd +isdn,isdn4k-utils +kdump,kexec-tools +mcstrans, +mdmonitor,mdadm +messagebus,dbus +named,bind +netconsole, +netfs, +nfs,nfs-utils +nfslock,nfs-utils +oddjobd,oddjob +portreserve,portreserve +qpidd,qpid-cpp-server +quota_nld,quota +rdisc,iputils +rhnsd,rhnsd +rhsmcertd,subscription-manager +rpcbind,rpcbind +rpcgssd,nfs-utils +rpcidmapd,nfs-utils +rpcsvcgssd,nfs-utils +saslauthd,cyrus-sasl +sendmail,sendmail +smartd,smartmontools +smb, +snmpd,net-snmp +squid,squid +sshd,openssh-server +sysstat,sysstat +telnet,telnet-server +tftp,tftp-server +vsftpd,vsftpd +xinetd,xinetd +ypbind,ypbind +ypserv,ypserv diff --git a/RHEL6/input/checks/templates/services_enabled.csv b/RHEL6/input/checks/templates/services_enabled.csv index ae9a13b..b96d288 100644 --- a/RHEL6/input/checks/templates/services_enabled.csv +++ b/RHEL6/input/checks/templates/services_enabled.csv @@ -1,12 +1,12 @@ -auditd,audit,4292-9 -crond,cronie,4324-0 -ip6tables,iptables-ipv6,4167-3 -iptables,iptables,4189-7 -irqbalance,irqbalance,4123-6 -lvm2-monitor,lvm2, -network,initscripts,4369-5 -ntpd,ntp,4376-0 -postfix,postfix,14068-1 -psacct,psacct, -restorecond,policycoreutils,4129-3 -rsyslog,rsyslog,17698-2 +auditd,audit +crond,cronie +ip6tables,iptables-ipv6 +iptables,iptables +irqbalance,irqbalance +lvm2-monitor,lvm2 +network,initscripts +ntpd,ntp +postfix,postfix +psacct,psacct +restorecond,policycoreutils +rsyslog,rsyslog diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input/checks/templates/sysctl_values.csv index 75e2c6a..00d6b9a 100644 --- a/RHEL6/input/checks/templates/sysctl_values.csv +++ b/RHEL6/input/checks/templates/sysctl_values.csv @@ -1,19 +1,17 @@ -kernel.exec-shield,1,4168-1 -kernel.randomize_va_space,1,4146-7 -net.ipv4.conf.all.accept_redirects,0,4217-6 -net.ipv4.conf.all.accept_source_route,0,4236-6 -net.ipv4.conf.all.log_martians,1,4320-8 -net.ipv4.conf.all.rp_filter,1,4080-8 -net.ipv4.conf.all.secure_redirects,0,3472-8 -net.ipv4.conf.all.send_redirects,0,4155-8 -net.ipv4.conf.default.accept_redirects,0,4186-3 -net.ipv4.conf.default.accept_source_route,0,4091-5 -net.ipv4.conf.default.rp_filter,1,3840-6 -net.ipv4.conf.default.secure_redirects,0,3339-9 -net.ipv4.conf.default.send_redirects,0,4151-7 -net.ipv4.icmp_echo_ignore_broadcasts,1,3644-2 -net.ipv4.icmp_ignore_bogus_error_responses,1,4133-5 -net.ipv4.ip_forward,0,3561-8 -net.ipv4.tcp_syncookies,1,4265-5 -net.ipv6.conf.all.disable_ipv6,1,4298-6 -net.ipv6.conf.default.accept_redirects,0,4365-3 +kernel.exec-shield,1 +kernel.randomize_va_space,1 +net.ipv4.conf.all.accept_redirects,0 +net.ipv4.conf.all.accept_source_route,0 +net.ipv4.conf.all.log_martians,1 +net.ipv4.conf.all.rp_filter,1 +net.ipv4.conf.all.secure_redirects,0 +net.ipv4.conf.all.send_redirects,0 +net.ipv4.conf.default.accept_redirects,0 +net.ipv4.conf.default.accept_source_route,0 +net.ipv4.conf.default.rp_filter,1 +net.ipv4.conf.default.secure_redirects,0 +net.ipv4.conf.default.send_redirects,0 +net.ipv4.icmp_echo_ignore_broadcasts,1 +net.ipv4.icmp_ignore_bogus_error_responses,1 +net.ipv4.ip_forward,0 +net.ipv4.tcp_syncookies,1
Signed-off-by: Jeffrey Blank blank@eclipse.ncsc.mil --- .../templates/template_kernel_module_disabled | 2 -- .../checks/templates/template_package_installed | 1 - .../checks/templates/template_package_removed | 1 - RHEL6/input/checks/templates/template_permissions | 1 - .../checks/templates/template_service_disabled | 1 - .../checks/templates/template_service_enabled | 1 - RHEL6/input/checks/templates/template_sysctl | 1 - 7 files changed, 0 insertions(+), 8 deletions(-)
diff --git a/RHEL6/input/checks/templates/template_kernel_module_disabled b/RHEL6/input/checks/templates/template_kernel_module_disabled index 973f232..8385a76 100644 --- a/RHEL6/input/checks/templates/template_kernel_module_disabled +++ b/RHEL6/input/checks/templates/template_kernel_module_disabled @@ -7,9 +7,7 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="CCEID" source="CCE" /> <description>The kernel module KERNMODULE should be disabled.</description> - <!-- generated by create_kernel_modules_disabled.py --> </metadata> <criteria> <criterion test_ref="test_kernmod_KERNMODULE_disabled" diff --git a/RHEL6/input/checks/templates/template_package_installed b/RHEL6/input/checks/templates/template_package_installed index 0d7f050..d668705 100644 --- a/RHEL6/input/checks/templates/template_package_installed +++ b/RHEL6/input/checks/templates/template_package_installed @@ -7,7 +7,6 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="PKGCCE" source="CCE" /> <description>The RPM package PKGNAME should be installed.</description> </metadata> <criteria> diff --git a/RHEL6/input/checks/templates/template_package_removed b/RHEL6/input/checks/templates/template_package_removed index 8e8b426..ba79f4e 100644 --- a/RHEL6/input/checks/templates/template_package_removed +++ b/RHEL6/input/checks/templates/template_package_removed @@ -7,7 +7,6 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="PKGCCE" source="CCE" /> <description>The RPM package PKGNAME should be removed.</description> </metadata> <criteria> diff --git a/RHEL6/input/checks/templates/template_permissions b/RHEL6/input/checks/templates/template_permissions index 70d1268..c3a2c38 100644 --- a/RHEL6/input/checks/templates/template_permissions +++ b/RHEL6/input/checks/templates/template_permissions @@ -6,7 +6,6 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="CCEID" source="CCE" /> <description>This test makes sure that FILEPATH is owned by FILEUID, group owned by FILEGID, and has mode FILEMODE. If the target file or directory has an extended ACL then it will fail the mode check.</description> </metadata> diff --git a/RHEL6/input/checks/templates/template_service_disabled b/RHEL6/input/checks/templates/template_service_disabled index 05d0427..ed6a491 100644 --- a/RHEL6/input/checks/templates/template_service_disabled +++ b/RHEL6/input/checks/templates/template_service_disabled @@ -7,7 +7,6 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="CCE_ID" source="CCE" /> <description>The SERVICENAME service should be disabled if possible.</description> </metadata> <criteria comment="package PACKAGENAME removed or service SERVICENAME is not configured to start" operator="OR"> diff --git a/RHEL6/input/checks/templates/template_service_enabled b/RHEL6/input/checks/templates/template_service_enabled index 8a6e361..e1fd447 100644 --- a/RHEL6/input/checks/templates/template_service_enabled +++ b/RHEL6/input/checks/templates/template_service_enabled @@ -7,7 +7,6 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="CCE_ID" source="CCE" /> <description>The SERVICENAME service should be enabled if possible.</description> </metadata> <criteria comment="package PACKAGENAME installed and service SERVICENAME is configured to start" operator="AND"> diff --git a/RHEL6/input/checks/templates/template_sysctl b/RHEL6/input/checks/templates/template_sysctl index 1379c6a..e26f7b2 100644 --- a/RHEL6/input/checks/templates/template_sysctl +++ b/RHEL6/input/checks/templates/template_sysctl @@ -6,7 +6,6 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <reference ref_id="CCE-CCE_ID" source="CCE" /> <description>The kernel runtime parameter "SYSCTLVAR" should be set to "SYSCTLVAL".</description> </metadata> <criteria>
My natural antipathy for CCE, particularly within but not limited to OVAL, results in an
ACK.
However, I expect such <ident>s will end up needing augmentation to distinguish amongst "platforms".
On 09/04/2012 01:31 PM, Jeffrey Blank wrote:
This is being done in favor of storing CCE identifiers only in the XCCDF Rules as idents (which made sense for a number of reasons).
Yes, these templates/scripts feel so very much like an undergraduate (or possibly high-school) programming project. But consider the superficiality of their operation as a benefit.
If I were starting over, I might have instead created a small dictionary of macros in XSLT to take care of generating the significant non-information-bearing OVAL overhead instead. This would allow for authors to create extremely simple XML files to express the necessary information, and also avoid the creation of any kind of parser. Maybe for RHEL 7...
Jeffrey Blank (4): new helper scripts for making/verifying/installing templated files removed CCE handling from scripts that create templated OVAL checks removed CCE identifiers from template source-info files removal of CCE info from templates for kernelmods, packages, perms, services, sysctls
RHEL6/input/checks/templates/Makefile | 30 ++++++ RHEL6/input/checks/templates/README | 32 +++++- .../templates/create_kernel_modules_disabled.py | 15 ++-- .../checks/templates/create_package_installed.py | 11 +-- .../checks/templates/create_package_removed.py | 10 +-- .../checks/templates/create_permission_checks.py | 9 +- .../checks/templates/create_services_disabled.py | 6 +- .../checks/templates/create_services_enabled.py | 6 +- .../input/checks/templates/create_sysctl_checks.py | 5 +- .../checks/templates/file_dir_permissions.csv | 7 +- RHEL6/input/checks/templates/find_untemplated.py | 31 ++++++ .../checks/templates/kernel_modules_disabled.csv | 24 ++-- .../input/checks/templates/packages_installed.csv | 34 ++++--- RHEL6/input/checks/templates/packages_removed.csv | 106 ++++++++++---------- RHEL6/input/checks/templates/services_disabled.csv | 103 ++++++++++---------- RHEL6/input/checks/templates/services_enabled.csv | 24 ++-- RHEL6/input/checks/templates/sysctl_values.csv | 36 +++---- .../templates/template_kernel_module_disabled | 2 - .../checks/templates/template_package_installed | 1 - .../checks/templates/template_package_removed | 1 - RHEL6/input/checks/templates/template_permissions | 1 - .../checks/templates/template_service_disabled | 1 - .../checks/templates/template_service_enabled | 1 - RHEL6/input/checks/templates/template_sysctl | 1 - 24 files changed, 281 insertions(+), 216 deletions(-) create mode 100644 RHEL6/input/checks/templates/Makefile create mode 100755 RHEL6/input/checks/templates/find_untemplated.py
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org
-
Gary Gapinski -
Jeffrey Blank