Skip to content

Commit a77acf8

Browse files
fatbasstardfatbasstard
committed
Processed feedback from original PR
Processed the feedback given on original PR dev-sec#54 Signed-off-by: Frank van Boven <[email protected]>
1 parent 06bb6bf commit a77acf8

File tree

5 files changed

+68
-143
lines changed

5 files changed

+68
-143
lines changed

‎controls/1_1_filesystem_configuration.rb

Lines changed: 18 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -237,96 +237,28 @@
237237
end
238238
end
239239

240-
# There is a mistake in the official CIS DIL documentaion 1.1.10-1.1.14 are
241-
# duplicates of 1.1.9. So I used "skipped" to keep the order of the numbering.
242-
control 'cis-dil-benchmark-1.1.10' do
243-
title 'Ensure noexec option set on /var/tmp partition'
244-
desc "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
240+
control 'cis-dil-benchmark-1.1.15' do
241+
title 'Ensure separate partition exists for /var/log'
242+
desc "The /var/log directory is used by system services to store log data .\n\nRationale: There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data."
245243
impact 1.0
246244

247-
tag cis: 'distribution-independent-linux:1.1.10'
248-
tag level: 1
249-
250-
describe 'cis-dil-benchmark-1.1.10' do
251-
skip 'Duplicate of cis-dil-benchmark-1.1.9'
252-
end
253-
end
254-
255-
control 'cis-dil-benchmark-1.1.11' do
256-
title 'Ensure noexec option set on /var/tmp partition'
257-
desc "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
258-
impact 1.0
259-
260-
tag cis: 'distribution-independent-linux:1.1.11'
261-
tag level: 1
262-
263-
264-
describe 'cis-dil-benchmark-1.1.11' do
265-
skip 'Duplicate of cis-dil-benchmark-1.1.9'
266-
end
267-
end
268-
269-
control 'cis-dil-benchmark-1.1.12' do
270-
title 'Ensure noexec option set on /var/tmp partition'
271-
desc "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
272-
impact 1.0
273-
274-
tag cis: 'distribution-independent-linux:1.1.12'
275-
tag level: 1
276-
277-
describe 'cis-dil-benchmark-1.1.12' do
278-
skip 'Duplicate of cis-dil-benchmark-1.1.9'
279-
end
280-
end
281-
282-
control 'cis-dil-benchmark-1.1.13' do
283-
title 'Ensure noexec option set on /var/tmp partition'
284-
desc "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
285-
impact 1.0
286-
287-
tag cis: 'distribution-independent-linux:1.1.13'
288-
tag level: 1
289-
290-
describe 'cis-dil-benchmark-1.1.13' do
291-
skip 'Duplicate of cis-dil-benchmark-1.1.9'
292-
end
293-
end
294-
295-
control 'cis-dil-benchmark-1.1.14' do
296-
title 'Ensure noexec option set on /var/tmp partition'
297-
desc "The noexec mount option specifies that the filesystem cannot contain executable binaries.\n\nRationale: Since the /var/tmp filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from /var/tmp."
298-
impact 1.0
299-
300-
tag cis: 'distribution-independent-linux:1.1.14'
301-
tag level: 1
302-
303-
describe 'cis-dil-benchmark-1.1.14' do
304-
skip 'Duplicate of cis-dil-benchmark-1.1.9'
305-
end
306-
end
307-
308-
if cis_level == '2'
309-
control 'cis-dil-benchmark-1.1.15' do
310-
title 'Ensure separate partition exists for /var/log'
311-
desc "The /var/log directory is used by system services to store log data .\n\nRationale: There are two important reasons to ensure that system logs are stored on a separate partition: protection against resource exhaustion (since logs can grow quite large) and protection of audit data."
312-
impact 1.0
245+
tag cis: 'distribution-independent-linux:1.1.15'
246+
tag level: 2
313247

314-
tag cis: 'distribution-independent-linux:1.1.15'
315-
tag level: 2
248+
only_if { cis_level == 2 }
316249

317250
describe mount('/var/log') do
318251
it { should be_mounted }
319252
end
320-
only_if { cis_level == 2 }
321253
end
322254

323-
control 'cis-dil-benchmark-1.1.16' do
324-
title 'Ensure separate partition exists for /var/log/audit'
325-
desc "The auditing daemon, auditd, stores log data in the /var/log/audit directory.\n\nRationale: There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog) consume space in the same partition as auditd, it may not perform as desired."
326-
impact 1.0
255+
control 'cis-dil-benchmark-1.1.16' do
256+
title 'Ensure separate partition exists for /var/log/audit'
257+
desc "The auditing daemon, auditd, stores log data in the /var/log/audit directory.\n\nRationale: There are two important reasons to ensure that data gathered by auditd is stored on a separate partition: protection against resource exhaustion (since the audit.log file can grow quite large) and protection of audit data. The audit daemon calculates how much free space is left and performs actions based on the results. If other processes (such as syslog) consume space in the same partition as auditd, it may not perform as desired."
258+
impact 1.0
327259

328-
tag cis: 'distribution-independent-linux:1.1.16'
329-
tag level: 2
260+
tag cis: 'distribution-independent-linux:1.1.16'
261+
tag level: 2
330262

331263
only_if { cis_level == 2 }
332264

@@ -335,13 +267,13 @@
335267
end
336268
end
337269

338-
control 'cis-dil-benchmark-1.1.17' do
339-
title 'Ensure separate partition exists for /home'
340-
desc "The /home directory is used to support disk storage needs of local users.\n\nRationale: If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home."
341-
impact 1.0
270+
control 'cis-dil-benchmark-1.1.17' do
271+
title 'Ensure separate partition exists for /home'
272+
desc "The /home directory is used to support disk storage needs of local users.\n\nRationale: If the system is intended to support local users, create a separate partition for the /home directory to protect against resource exhaustion and restrict the type of files that can be stored under /home."
273+
impact 1.0
342274

343-
tag cis: 'distribution-independent-linux:1.1.17'
344-
tag level: 2
275+
tag cis: 'distribution-independent-linux:1.1.17'
276+
tag level: 2
345277

346278
only_if { cis_level == 2 }
347279

‎controls/4_1_configure_system_accounting_auditd.rb

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -240,16 +240,15 @@
240240
tag cis: 'distribution-independent-linux:4.1.9'
241241
tag level: 2
242242

243-
describe file('/etc/audit/audit.rules') do
244-
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b32 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EACCES -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
245-
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b32 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EPERM -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
246-
end
243+
describe file('/etc/audit/audit.rules') do
244+
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b32 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EACCES -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
245+
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b32 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EPERM -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
246+
end
247247

248-
if command('uname -m').stdout.strip == 'x86_64'
249-
describe file('/etc/audit/audit.rules') do
250-
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b64 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EACCES -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
251-
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b64 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EPERM -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
252-
end
248+
if command('uname -m').stdout.strip == 'x86_64'
249+
describe file('/etc/audit/audit.rules') do
250+
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b64 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EACCES -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
251+
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b64 (-S creat -S open -S openat -S truncate -S ftruncate|-S creat,open,openat,open_by_handle_at,truncate,ftruncate) -F exit=-EPERM -F auid>=#{uid_min} -F auid!=4294967295 (-F key=access$|-k access$)/) }
253252
end
254253
end
255254
end
@@ -310,14 +309,13 @@
310309
tag cis: 'distribution-independent-linux:4.1.12'
311310
tag level: 2
312311

313-
describe file('/etc/audit/audit.rules') do
314-
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=#{uid_min} -F auid!=4294967295 (-k delete|-F key=delete)$/) }
315-
end
312+
describe file('/etc/audit/audit.rules') do
313+
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=#{uid_min} -F auid!=4294967295 (-k delete|-F key=delete)$/) }
314+
end
316315

317-
if command('uname -m').stdout.strip == 'x86_64'
318-
describe file('/etc/audit/audit.rules') do
319-
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=#{uid_min} -F auid!=4294967295 (-k delete|-F key=delete)$/) }
320-
end
316+
if command('uname -m').stdout.strip == 'x86_64'
317+
describe file('/etc/audit/audit.rules') do
318+
its(:content) { should match(/^-a (always,exit|exit,always) -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=#{uid_min} -F auid!=4294967295 (-k delete|-F key=delete)$/) }
321319
end
322320
end
323321
end

‎controls/4_2_configure_logging.rb

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -52,28 +52,28 @@
5252
end
5353

5454
describe.one do
55-
command('find /etc/rsyslog.d -name "*.conf"').stdout.split.each do |conf_file|
55+
command('find /etc/rsyslog.d -name "*.conf"').stdout.split.each do |conf_file|
5656
describe file(conf_file) do
57-
its(:content) { should match(%r{^\*.emerg(\s)+:omusrmsg:\*}) }
58-
its(:content) { should match(%r{^mail.\*(\s)+-/var/log/mail}) }
59-
its(:content) { should match(%r{^mail.info(\s)+-/var/log/mail.info}) }
60-
its(:content) { should match(%r{^mail.warning(\s)+-/var/log/mail.warn}) }
61-
its(:content) { should match(%r{^mail.err(\s)+/var/log/mail.err}) }
62-
its(:content) { should match(%r{^news.crit(\s)+-/var/log/news/news.crit}) }
63-
its(:content) { should match(%r{^news.crit(\s)+-/var/log/news/news.crit}) }
64-
its(:content) { should match(%r{^news.notice(\s)+-/var/log/news/news.notice}) }
65-
its(:content) { should match(%r{^\*.=warning;\*.=err(\s)+-/var/log/warn}) }
66-
its(:content) { should match(%r{^\*.crit(\s)+/var/log/warn}) }
67-
its(:content) { should match(%r{^\*.\*;mail.none;news.none(\s)+-/var/log/messages}) }
68-
its(:content) { should match(%r{^local0,local1.\*(\s)+-/var/log/localmessages}) }
69-
its(:content) { should match(%r{^local2,local3.\*(\s)+-/var/log/localmessages}) }
70-
its(:content) { should match(%r{^local2,local3.\*(\s)+-/var/log/localmessages}) }
71-
its(:content) { should match(%r{^local4,local5.\*(\s)+-/var/log/localmessages}) }
72-
its(:content) { should match(%r{^local6,local7.\*(\s)+-/var/log/localmessages}) }
73-
end
57+
its(:content) { should match(%r{^\*.emerg(\s)+:omusrmsg:\*}) }
58+
its(:content) { should match(%r{^mail.\*(\s)+-/var/log/mail}) }
59+
its(:content) { should match(%r{^mail.info(\s)+-/var/log/mail.info}) }
60+
its(:content) { should match(%r{^mail.warning(\s)+-/var/log/mail.warn}) }
61+
its(:content) { should match(%r{^mail.err(\s)+/var/log/mail.err}) }
62+
its(:content) { should match(%r{^news.crit(\s)+-/var/log/news/news.crit}) }
63+
its(:content) { should match(%r{^news.crit(\s)+-/var/log/news/news.crit}) }
64+
its(:content) { should match(%r{^news.notice(\s)+-/var/log/news/news.notice}) }
65+
its(:content) { should match(%r{^\*.=warning;\*.=err(\s)+-/var/log/warn}) }
66+
its(:content) { should match(%r{^\*.crit(\s)+/var/log/warn}) }
67+
its(:content) { should match(%r{^\*.\*;mail.none;news.none(\s)+-/var/log/messages}) }
68+
its(:content) { should match(%r{^local0,local1.\*(\s)+-/var/log/localmessages}) }
69+
its(:content) { should match(%r{^local2,local3.\*(\s)+-/var/log/localmessages}) }
70+
its(:content) { should match(%r{^local2,local3.\*(\s)+-/var/log/localmessages}) }
71+
its(:content) { should match(%r{^local4,local5.\*(\s)+-/var/log/localmessages}) }
72+
its(:content) { should match(%r{^local6,local7.\*(\s)+-/var/log/localmessages}) }
73+
end
7474
end
7575

76-
describe file('/etc/rsyslog.conf') do
76+
describe file('/etc/rsyslog.conf') do
7777
its(:content) { should match(%r{^\*.emerg(\s)+:omusrmsg:\*}) }
7878
its(:content) { should match(%r{^mail.\*(\s)+-/var/log/mail}) }
7979
its(:content) { should match(%r{^mail.info(\s)+-/var/log/mail.info}) }

‎controls/5_4_user_accounts_and_environments.rb

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@
2727

2828
time_now = Time.now.to_i
2929

30-
31-
3230
# The official documentation specifying 365 days in the description but, using
3331
# 90 as an example settings
3432
control 'cis-dil-benchmark-5.4.1.1' do
@@ -132,9 +130,9 @@
132130
tag level: 1
133131

134132
command("cat /etc/shadow | cut -d: -f1").stdout.split.each do |username|
135-
describe command('date -d "`export LANG="en_US.UTF-8" ; chage --list root | grep "Last password" | cut -d: -f2`" +%s') do
133+
describe command('date -d "`export LANG="en_US.UTF-8" ; chage --list root | grep "Last password" | cut -d: -f2`" +%s') do
136134
its(:stdout) { should cmp <= time_now }
137-
end
135+
end
138136
end
139137
end
140138

@@ -201,25 +199,25 @@
201199
end
202200
end
203201

204-
if cis_level == '2'
205-
control 'cis-dil-benchmark-5.4.5' do
206-
title 'Ensure default user shell timeout is 900 seconds or less'
207-
desc "The default TMOUT determines the shell timeout for users. The TMOUT value is measured in seconds.\n\nRationale: Having no timeout value associated with a shell could allow an unauthorized user access to another user's shell session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening."
208-
impact 1.0
202+
control 'cis-dil-benchmark-5.4.5' do
203+
title 'Ensure default user shell timeout is 900 seconds or less'
204+
desc "The default TMOUT determines the shell timeout for users. The TMOUT value is measured in seconds.\n\nRationale: Having no timeout value associated with a shell could allow an unauthorized user access to another user's shell session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening."
205+
impact 1.0
206+
207+
tag cis: 'distribution-independent-linux:5.4.5'
208+
tag level: 2
209209

210-
tag cis: 'distribution-independent-linux:5.4.5'
211-
tag level: 2
210+
only_if { cis_level == 2 }
212211

213-
command("sudo find /etc/ -maxdepth 1 -name *bashrc*").stdout.split.each do |bashrc_file|
214-
describe command("grep '^TMOUT' #{bashrc_file} | cut -d= -f2") do
215-
its(:stdout) { should cmp <= 900 }
216-
end
212+
command("sudo find /etc/ -maxdepth 1 -name *bashrc*").stdout.split.each do |bashrc_file|
213+
describe command("grep '^TMOUT' #{bashrc_file} | cut -d= -f2") do
214+
its(:stdout) { should cmp <= 900 }
217215
end
216+
end
218217

219-
%w(profile).each do |f|
220-
describe command("grep '^TMOUT' /etc/#{f} | cut -d= -f2") do
221-
its(:stdout) { should cmp <= 900 }
222-
end
218+
%w(profile).each do |f|
219+
describe command("grep '^TMOUT' /etc/#{f} | cut -d= -f2") do
220+
its(:stdout) { should cmp <= 900 }
223221
end
224222
end
225223
end

‎inspec.lock

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)