SLE15 prefer systemd unit handling of AIDE checks and notifications by teacup-on-rockingchair · Pull Request #11178 · ComplianceAsCode/content

teacup-on-rockingchair · 2023-10-05T07:03:31Z

Description:

Make sure that for SLE15 platform the AIDE periodic check is done via systemd unit and also improve the notification rule so it can be done via systemd unit also

Rationale:

Make sure to use aide_periodic_checking_systemd_timer for sle15 platform
Add OVAL checks that allow notification to be implemented via systemd unit
Add SLE15 specific BASH and Ansible remediation for aide check notification

github-actions · 2023-10-05T07:05:57Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-10-05T07:08:43Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OCIL for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- ocil:ssg-aide_scan_notification_ocil:questionnaire:1
+++ ocil:ssg-aide_scan_notification_ocil:questionnaire:1
@@ -1,4 +1,5 @@
 To determine that periodic AIDE execution has been scheduled, run the following command:
+
 $ grep aide /etc/crontab
 The output should return something similar to the following:
 05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost

bash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -5,6 +5,7 @@
     yum install -y "aide"
 fi
 var_aide_scan_notification_email=''
+
 
 
 CRONTAB=/etc/crontab

jan-cerny · 2023-10-09T11:37:52Z

    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
-
+  <ind:textfilecontent54_test check="all" check_existence="all_exist"


This new part isn't described in rule.yml at all. You should extend the rule description and other artifacts.

got you will do 🙇

jan-cerny · 2023-10-09T11:43:49Z

+          test_ref="test_aide_var_cron_notification" />
+        <criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)"
+          test_ref="test_aide_crontabs_notification" />
+        <criteria operator="AND">


Should this new criteria be guarded as SLE-only? The new code in Bash and Ansible remediations is marked as SLE-only.

Well I prefer to be SLE only for now and other maintainers to adopt it if consider viable, therefore the bash and ansible remediations aer platform dependant

Thanks for reply. But, if you think that this part should be SLE-only for now, would it be better to put it inside a Jinja if product in ... block?

@jan-cerny

…ions Drop some extra whitespaces. Thanks to @jan-cerny for the feedback on this 🙇

jan-cerny · 2023-10-27T07:05:21Z

/packit build

jan-cerny · 2023-10-27T09:24:23Z

-CRONTAB=/etc/crontab
-CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'
-


@teacup-on-rockingchair I think this shouldn't be removed, these variables are used below (lines 37-38). I think this might be the reason why this rule fails the CI.

@jan-cerny

Thanks to @jan-cerny for the note 🙇

qlty-cloud-legacy · 2023-11-02T10:25:57Z

Code Climate has analyzed commit 10173f5 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

jan-cerny

The CI fail of Automatus on SLE15 is fixed by #11212 and isn't related to this PR.

Notice the Automatus CS9 job pass because the rule is evaluated as notapplicable in a container environment. I have run the test scenarios locally with a RHEL 9 virtual machine as a back end. Both Ansible and Bash are passing:

jcerny@fedora ~/work/git/scap-security-guide (pr/11178) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 aide_periodic_cron_checking
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-11-02-1432/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
INFO - Script aide_not_installed.fail.sh using profile (all) OK
INFO - Script cron_daily.pass.sh using profile (all) OK
INFO - Script cron_daily_complex.pass.sh using profile (all) OK
INFO - Script crontab_daily.pass.sh using profile (all) OK
INFO - Script crontab_daily_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_monthly.fail.sh using profile (all) OK
INFO - Script crontab_two_days_week.pass.sh using profile (all) OK
INFO - Script crontab_weekly_on_exact_day.pass.sh using profile (all) OK
INFO - Script crontab_weekly_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_weekly_word.pass.sh using profile (all) OK
INFO - Script crontab_yearly.fail.sh using profile (all) OK
INFO - Script not_in_cron.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11178) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible aide_periodic_cron_checking
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-11-02-1437/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
INFO - Script aide_not_installed.fail.sh using profile (all) OK
INFO - Script cron_daily.pass.sh using profile (all) OK
INFO - Script cron_daily_complex.pass.sh using profile (all) OK
INFO - Script crontab_daily.pass.sh using profile (all) OK
INFO - Script crontab_daily_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_monthly.fail.sh using profile (all) OK
INFO - Script crontab_two_days_week.pass.sh using profile (all) OK
INFO - Script crontab_weekly_on_exact_day.pass.sh using profile (all) OK
INFO - Script crontab_weekly_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_weekly_word.pass.sh using profile (all) OK
INFO - Script crontab_yearly.fail.sh using profile (all) OK
INFO - Script not_in_cron.fail.sh using profile (all) OK

teacup-on-rockingchair added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. SLES SUSE Linux Enterprise Server product related. labels Oct 5, 2023

jan-cerny approved these changes Oct 9, 2023

View reviewed changes

teacup-on-rockingchair added 5 commits October 15, 2023 12:33

Make sure to use aide_periodic_checking_systemd_timer for sle15 platform

ad4eb5c

Add checks that allow notification to be implemented via systemd unit

39a2787

Add SLE15 specific remediation for aide check notification

90c29e5

Fix bash remediation

82bd14f

Add more information on the SLE15 approach to the aidecheck notificat…

8fd0786

…ions Drop some extra whitespaces. Thanks to @jan-cerny for the feedback on this 🙇

teacup-on-rockingchair force-pushed the sle15_aide_check_notification_systemd branch from 6229a3f to 8fd0786 Compare October 15, 2023 10:57

jan-cerny self-assigned this Oct 27, 2023

jan-cerny added this to the 0.1.71 milestone Oct 27, 2023

jan-cerny reviewed Oct 27, 2023

View reviewed changes

Restore CRONTAB and CRONDIRS variables needed for non-SLE solution

10173f5

Thanks to @jan-cerny for the note 🙇

jan-cerny approved these changes Nov 2, 2023

View reviewed changes

jan-cerny merged commit 16e43c7 into ComplianceAsCode:master Nov 2, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SLE15 prefer systemd unit handling of AIDE checks and notifications#11178

SLE15 prefer systemd unit handling of AIDE checks and notifications#11178
jan-cerny merged 6 commits into
ComplianceAsCode:masterfrom
teacup-on-rockingchair:sle15_aide_check_notification_systemd

teacup-on-rockingchair commented Oct 5, 2023

Uh oh!

github-actions Bot commented Oct 5, 2023

Uh oh!

github-actions Bot commented Oct 5, 2023 •

edited

Loading

Uh oh!

jan-cerny Oct 9, 2023

Uh oh!

teacup-on-rockingchair Oct 9, 2023

Uh oh!

jan-cerny Oct 10, 2023

Uh oh!

jan-cerny Oct 9, 2023

Uh oh!

teacup-on-rockingchair Oct 9, 2023

Uh oh!

jan-cerny Oct 10, 2023

Uh oh!

jan-cerny commented Oct 27, 2023

Uh oh!

jan-cerny Oct 27, 2023

Uh oh!

qlty-cloud-legacy Bot commented Nov 2, 2023

Uh oh!

jan-cerny left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		CRONTAB=/etc/crontab
		CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'

Conversation

teacup-on-rockingchair commented Oct 5, 2023

Description:

Rationale:

Uh oh!

github-actions Bot commented Oct 5, 2023

Uh oh!

github-actions Bot commented Oct 5, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jan-cerny Oct 9, 2023

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Oct 9, 2023

Choose a reason for hiding this comment

Uh oh!

jan-cerny Oct 10, 2023

Choose a reason for hiding this comment

Uh oh!

jan-cerny Oct 9, 2023

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Oct 9, 2023

Choose a reason for hiding this comment

Uh oh!

jan-cerny Oct 10, 2023

Choose a reason for hiding this comment

Uh oh!

jan-cerny commented Oct 27, 2023

Uh oh!

jan-cerny Oct 27, 2023

Choose a reason for hiding this comment

Uh oh!

qlty-cloud-legacy Bot commented Nov 2, 2023

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Oct 5, 2023 •

edited

Loading