Processed feedback from original PR

Processed the feedback given on original PR dev-sec#54

Signed-off-by: Frank van Boven <[email protected]>

Author: fatbasstard

controls/1_1_filesystem_configuration.rb

@@ -237,96 +237,28 @@
   end
 end
 
-# There is a mistake in the official CIS DIL documentaion 1.1.10-1.1.14 are
-# duplicates of 1.1.9. So I used "skipped" to keep the order of the numbering.
-control 'cis-dil-benchmark-1.1.10' do
-  title 'Ensure noexec option set on /var/tmp partition'
-  desc  "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
+control 'cis-dil-benchmark-1.1.15' do
+  title 'Ensure separate partition exists for /var/log'
+  desc  "The /var/log directory is used by system services to store log data .\n\nRationale: There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data."
   impact 1.0
 
-  tag cis: 'distribution-independent-linux:1.1.10'
-  tag level: 1
-
-  describe 'cis-dil-benchmark-1.1.10' do
-    skip 'Duplicate of cis-dil-benchmark-1.1.9'
-  end
-end
-
-control 'cis-dil-benchmark-1.1.11' do
-  title 'Ensure noexec option set on /var/tmp partition'
-  desc  "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
-  impact 1.0
-
-  tag cis: 'distribution-independent-linux:1.1.11'
-  tag level: 1
-
-  
-  describe 'cis-dil-benchmark-1.1.11' do
-    skip 'Duplicate of cis-dil-benchmark-1.1.9'
-  end
-end
-
-control 'cis-dil-benchmark-1.1.12' do
-  title 'Ensure noexec option set on /var/tmp partition'
-  desc  "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
-  impact 1.0
-
-  tag cis: 'distribution-independent-linux:1.1.12'
-  tag level: 1
-
-  describe 'cis-dil-benchmark-1.1.12' do
-    skip 'Duplicate of cis-dil-benchmark-1.1.9'
-  end
-end
-
-control 'cis-dil-benchmark-1.1.13' do
-  title 'Ensure noexec option set on /var/tmp partition'
-  desc  "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
-  impact 1.0
-
-  tag cis: 'distribution-independent-linux:1.1.13'
-  tag level: 1
-
-  describe 'cis-dil-benchmark-1.1.13' do
-    skip 'Duplicate of cis-dil-benchmark-1.1.9'
-  end
-end
-
-control 'cis-dil-benchmark-1.1.14' do
-  title 'Ensure noexec option set on /var/tmp partition'
-  desc  "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
-  impact 1.0
-
-  tag cis: 'distribution-independent-linux:1.1.14'
-  tag level: 1
-  
-  describe 'cis-dil-benchmark-1.1.14' do
-    skip 'Duplicate of cis-dil-benchmark-1.1.9'
-  end
-end
-
-if cis_level == '2'
-  control 'cis-dil-benchmark-1.1.15' do
-    title 'Ensure separate partition exists for /var/log'
-    desc  "The /var/log directory is used by system services to store log data .\n\nRationale: There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data."
-    impact 1.0
+  tag cis: 'distribution-independent-linux:1.1.15'
+  tag level: 2
 
-    tag cis: 'distribution-independent-linux:1.1.15'
-    tag level: 2
+  only_if { cis_level == 2 }
 
   describe mount('/var/log') do
     it { should be_mounted }
   end
-  only_if { cis_level == 2 }
 end
 
-  control 'cis-dil-benchmark-1.1.16' do
-    title 'Ensure separate partition exists for /var/log/audit'
-    desc  "The auditing daemon, auditd, stores log data in the /var/log/audit directory.\n\nRationale: There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog) consume space in the same partition as auditd, it may not perform as desired."
-    impact 1.0
+control 'cis-dil-benchmark-1.1.16' do
+  title 'Ensure separate partition exists for /var/log/audit'
+  desc  "The auditing daemon, auditd, stores log data in the /var/log/audit directory.\n\nRationale: There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog) consume space in the same partition as auditd, it may not perform as desired."
+  impact 1.0
 
-    tag cis: 'distribution-independent-linux:1.1.16'
-    tag level: 2
+  tag cis: 'distribution-independent-linux:1.1.16'
+  tag level: 2
 
   only_if { cis_level == 2 }
 
@@ -335,13 +267,13 @@
   end
 end
 
-  control 'cis-dil-benchmark-1.1.17' do
-    title 'Ensure separate partition exists for /home'
-    desc  "The /home directory is used to support disk storage needs of local users.\n\nRationale: If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home."
-    impact 1.0
+control 'cis-dil-benchmark-1.1.17' do
+  title 'Ensure separate partition exists for /home'
+  desc  "The /home directory is used to support disk storage needs of local users.\n\nRationale: If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home."
+  impact 1.0
 
-    tag cis: 'distribution-independent-linux:1.1.17'
-    tag level: 2
+  tag cis: 'distribution-independent-linux:1.1.17'
+  tag level: 2
 
   only_if { cis_level == 2 }
 

controls/5_4_user_accounts_and_environments.rb

@@ -132,9 +132,9 @@
   tag level: 1
 
   command("cat /etc/shadow | cut -d: -f1").stdout.split.each do |username|
-    describe command('date -d "`export LANG="en_US.UTF-8" ; chage --list root | grep "Last password" | cut -d: -f2`" +%s') do      
+    describe command('date -d "`export LANG="en_US.UTF-8" ; chage --list root | grep "Last password" | cut -d: -f2`" +%s') do
       its(:stdout) { should cmp <= time_now }
-    end        
+    end
   end
 end
 
@@ -201,25 +201,25 @@
   end
 end
 
-if cis_level == '2'
-  control 'cis-dil-benchmark-5.4.5' do
-    title 'Ensure default user shell timeout is 900 seconds or less'
-    desc  "The default TMOUT determines the shell timeout for users. The TMOUT value is measured in seconds.\n\nRationale: Having no timeout value associated with a shell could allow an unauthorized user access to another user's shell session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening."
-    impact 1.0
+control 'cis-dil-benchmark-5.4.5' do
+  title 'Ensure default user shell timeout is 900 seconds or less'
+  desc  "The default TMOUT determines the shell timeout for users. The TMOUT value is measured in seconds.\n\nRationale: Having no timeout value associated with a shell could allow an unauthorized user access to another user's shell session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening."
+  impact 1.0
 
-    tag cis: 'distribution-independent-linux:5.4.5'
-    tag level: 2
+  tag cis: 'distribution-independent-linux:5.4.5'
+  tag level: 2
 
-    command("sudo find /etc/  -maxdepth 1 -name *bashrc*").stdout.split.each do |bashrc_file|
-      describe command("grep '^TMOUT' #{bashrc_file} | cut -d= -f2") do
-        its(:stdout) { should cmp <= 900 }
-      end
+  only_if { cis_level == 2 }
+
+  command("sudo find /etc/  -maxdepth 1 -name *bashrc*").stdout.split.each do |bashrc_file|
+    describe command("grep '^TMOUT' #{bashrc_file} | cut -d= -f2") do
+      its(:stdout) { should cmp <= 900 }
     end
+  end
 
-    %w(profile).each do |f|
-      describe command("grep '^TMOUT' /etc/#{f} | cut -d= -f2") do
-        its(:stdout) { should cmp <= 900 }
-      end
+  %w(profile).each do |f|
+    describe command("grep '^TMOUT' /etc/#{f} | cut -d= -f2") do
+      its(:stdout) { should cmp <= 900 }
     end
   end
 end