Updates of the rule use_pam_wheel_group_for_su

controls/cis_sle12.yml

@@ -1907,7 +1907,9 @@ controls:
  - l1_workstation
  automated: partially # we check only for usage of use_uid with pam_su, not for the group
  rules:
- - use_pam_wheel_for_su
+ - ensure_pam_wheel_group_empty
+ - use_pam_wheel_group_for_su
+ - var_pam_wheel_group_for_su=cis
 
  - id: 6.1.1
  title: Audit system file permissions (Manual)

controls/cis_sle15.yml

@@ -2102,7 +2102,9 @@ controls:
  - l1_workstation
  automated: partially # we check only for usage of use_uid with pam_su, not for the group
  rules:
- - use_pam_wheel_for_su
+ - ensure_pam_wheel_group_empty
+ - use_pam_wheel_group_for_su
+ - var_pam_wheel_group_for_su=cis
 
  - id: 6.1.1
  title: Audit system file permissions (Manual)

linux_os/guide/system/accounts/accounts-restrictions/root_logins/ensure_pam_wheel_group_empty/ansible/shared.yml

@@ -0,0 +1,17 @@
+# platform = multi_platform_sle,multi_platform_ubuntu
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+{{{ ansible_instantiate_variables("var_pam_wheel_group_for_su") }}}
+
+- name: {{{ rule_title }}} - Ensure group {{ var_pam_wheel_group_for_su }} is removed
+ group:
+ name: "{{ var_pam_wheel_group_for_su }}"
+ state: absent 
+
+- name: {{{ rule_title }}} - Ensure group {{ var_pam_wheel_group_for_su }} exist
+ group:
+ name: "{{ var_pam_wheel_group_for_su }}"
+ state: present

linux_os/guide/system/accounts/accounts-restrictions/root_logins/ensure_pam_wheel_group_empty/bash/shared.sh

@@ -1,4 +1,4 @@
-# platform = multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu
 
 {{{ bash_instantiate_variables("var_pam_wheel_group_for_su") }}}
 

linux_os/guide/system/accounts/accounts-restrictions/root_logins/ensure_pam_wheel_group_empty/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ubuntu2004,ubuntu2204
+prodtype: sle12,sle15,ubuntu2004,ubuntu2204
 
 title: 'Ensure the Group Used by pam_wheel Module Exists on System and is Empty'
 
@@ -17,7 +17,13 @@ rationale: |-
 
 severity: medium
 
+identifiers:
+ cce@sle12: CCE-92353-2
+ cce@sle15: CCE-92528-9
+
 references:
+ cis@sle12: '5.6'
+ cis@sle15: '5.6'
  cis@ubuntu2004: '5.6'
  cis@ubuntu2204: 5.3.7
 

linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_group_for_su/ansible/shared.yml

@@ -0,0 +1,14 @@
+# platform = multi_platform_sle,multi_platform_ubuntu
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+{{{ ansible_instantiate_variables("var_pam_wheel_group_for_su") }}}
+
+- name: {{{ rule_title }}} - Add the group to the /etc/pam.d/su file
+ ansible.builtin.lineinfile:
+ path: "/etc/pam.d/su"
+ state: present
+ regexp: '^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid group=$'
+ line: "auth required pam_wheel.so use_uid group={{ var_pam_wheel_group_for_su }}"

linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_group_for_su/bash/shared.sh

@@ -1,4 +1,4 @@
-# platform = multi_platform_ubuntu
+# platform = multi_platform_sle,multi_platform_ubuntu
 {{{ bash_instantiate_variables("var_pam_wheel_group_for_su") }}}
 
 PAM_CONF=/etc/pam.d/su

linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_group_for_su/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true
 
-prodtype: ubuntu2004,ubuntu2204
+prodtype: sle12,sle15,ubuntu2004,ubuntu2204
 
 title: 'Enforce Usage of pam_wheel with Group Parameter for su Authentication'
 
@@ -19,7 +19,13 @@ rationale: |-
 
 severity: medium
 
+identifiers:
+ cce@sle12: CCE-92351-6
+ cce@sle15: CCE-92522-2
+
 references:
+ cis@sle12: '5.6'
+ cis@sle15: '5.6'
  cis@ubuntu2004: '5.6'
  cis@ubuntu2204: 5.3.7
 

products/sle12/profiles/pci-dss-4.profile

@@ -21,6 +21,7 @@ selections:
  - disable_host_auth
  - disable_prelink
  - disable_users_coredumps
+ - ensure_pam_wheel_group_empty
  - file_at_deny_not_exist
  - file_cron_deny_not_exist
  - file_groupowner_at_allow
@@ -90,3 +91,6 @@ selections:
  - sshd_strong_kex=pcidss
  - sshd_approved_macs=cis_sle12
  - sysctl_fs_suid_dumpable
+ - '!use_pam_wheel_for_su'
+ - use_pam_wheel_group_for_su
+ - var_pam_wheel_group_for_su=cis

products/sle15/profiles/pci-dss-4.profile

@@ -13,6 +13,7 @@ description: |-
 
 selections:
  - pcidss_4:all:base
+ - ensure_pam_wheel_group_empty
  - sshd_strong_kex=pcidss
  - sshd_approved_macs=cis_sle15
  - sshd_approved_ciphers=cis_sle15 
@@ -26,3 +27,6 @@ selections:
  - '!service_ntpd_enabled'
  - '!service_timesyncd_enabled'
  - '!package_libreswan_installed'
+ - '!use_pam_wheel_for_su'
+ - use_pam_wheel_group_for_su
+ - var_pam_wheel_group_for_su=cis

shared/references/cce-sle12-avail.txt

@@ -16,8 +16,6 @@ CCE-92345-8
 CCE-92347-4
 CCE-92348-2
 CCE-92350-8
-CCE-92351-6
-CCE-92353-2
 CCE-92354-0
 CCE-92355-7
 CCE-92357-3

shared/references/cce-sle15-avail.txt

@@ -23,11 +23,9 @@ CCE-92514-9
 CCE-92516-4
 CCE-92517-2
 CCE-92521-4
-CCE-92522-2
 CCE-92524-8
 CCE-92525-5
 CCE-92527-1
-CCE-92528-9
 CCE-92530-5
 CCE-92532-1
 CCE-92533-9