From ad4eb5ceb4bb57e70f0dbbb44df35afcb67011a8 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 5 Oct 2023 09:38:45 +0300 Subject: [PATCH 1/6] Make sure to use aide_periodic_checking_systemd_timer for sle15 platform --- controls/anssi.yml | 1 + controls/pcidss_3.yml | 1 + controls/pcidss_4.yml | 1 + .../aide/aide_periodic_cron_checking/rule.yml | 2 +- 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/controls/anssi.yml b/controls/anssi.yml index a28a5dfb24e..c1012353c8e 100644 --- a/controls/anssi.yml +++ b/controls/anssi.yml @@ -1467,6 +1467,7 @@ controls: - package_aide_installed - aide_build_database - aide_periodic_cron_checking + - aide_periodic_checking_systemd_timer - aide_scan_notification - aide_verify_acls - aide_verify_ext_attributes diff --git a/controls/pcidss_3.yml b/controls/pcidss_3.yml index 0d31ec835b5..ca8d4340edf 100644 --- a/controls/pcidss_3.yml +++ b/controls/pcidss_3.yml @@ -2339,6 +2339,7 @@ controls: - disable_prelink - package_aide_installed - aide_periodic_cron_checking + - aide_periodic_checking_systemd_timer - rpm_verify_ownership - rpm_verify_hashes - aide_build_database diff --git a/controls/pcidss_4.yml b/controls/pcidss_4.yml index 1bd41f327ea..cb6b6eae1fb 100644 --- a/controls/pcidss_4.yml +++ b/controls/pcidss_4.yml @@ -2592,6 +2592,7 @@ controls: - disable_prelink - package_aide_installed - aide_periodic_cron_checking + - aide_periodic_checking_systemd_timer - rpm_verify_ownership - rpm_verify_hashes - aide_build_database diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml index 8093c18795c..0d4c3adf876 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml @@ -4,7 +4,7 @@ documentation_complete: true -prodtype: alinux2,alinux3,anolis23,anolis8,fedora,ol7,ol8,ol9,openembedded,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,ubuntu2204 +prodtype: alinux2,alinux3,anolis23,anolis8,fedora,ol7,ol8,ol9,openembedded,rhel7,rhel8,rhel9,rhv4,sle12,ubuntu2004,ubuntu2204 title: 'Configure Periodic Execution of AIDE' From 39a278793985bd52eee1696b5d9541193b9565ae Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 5 Oct 2023 09:44:27 +0300 Subject: [PATCH 2/6] Add checks that allow notification to be implemented via systemd unit --- .../aide_scan_notification/oval/shared.xml | 51 +++++++++++++++++-- 1 file changed, 47 insertions(+), 4 deletions(-) diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml index a762fc159d5..0323134c116 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml @@ -5,9 +5,20 @@ - - - + + + + + + + + @@ -39,5 +50,37 @@ ^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$ 1 - + + + + + /etc/systemd/system/aidecheck.service + ^ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$ + 1 + + + + + + /etc/systemd/system/aidecheck.service + ^Before\=.*aidecheck-notify.service$ + 1 + + + + + + /etc/systemd/system/aidecheck.service + ^Wants\=.*aidecheck-notify.service.*$ + 1 + From 90c29e5a69a7a6cb89c771a7c9c993eb99f6e897 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 5 Oct 2023 09:56:57 +0300 Subject: [PATCH 3/6] Add SLE15 specific remediation for aide check notification --- .../aide_scan_notification/ansible/shared.yml | 36 +++++++++++++++++++ .../aide_scan_notification/bash/shared.sh | 27 +++++++++++--- 2 files changed, 59 insertions(+), 4 deletions(-) diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml index 303fee60fde..f951aabda57 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml @@ -12,6 +12,41 @@ with_items: - aide +{{% if product in ["sle15"] %}} +- name: "{{{ rule_title }}} check service" + ansible.builtin.blockinfile: + create: yes + dest: /etc/systemd/system/aidecheck.service + owner: root + group: root + mode: '0644' + block: | + [Unit] + Description=Aide Check + Before=aidecheck-notify.service + Wants=aidecheck-notify.service + [Service] + Type=forking + ExecStart={{{ aide_bin_path }}} --check -r file:/tmp/aide-report.log + [Install] + WantedBy=multi-user.target + +- name: "{{{ rule_title }}} notify service" + ansible.builtin.blockinfile: + create: yes + dest: /etc/systemd/system/aidecheck-notify.service + owner: root + group: root + mode: '0644' + block: | + [Unit] + Description=Status email for AIDE check result + After=aidecheck.service + [Service] + Type=forking + ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check" {{ var_aide_scan_notification_email }}' + +{{% else %}} - name: "{{{ rule_title }}}" cron: name: "run AIDE check" @@ -20,3 +55,4 @@ weekday: 0 user: root job: '{{{ aide_bin_path }}} --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" {{ var_aide_scan_notification_email }}' +{{% endif %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh index f2b7d62a0b3..cc0f319d6c8 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh @@ -3,9 +3,28 @@ {{{ bash_package_install("aide") }}} {{{ bash_instantiate_variables("var_aide_scan_notification_email") }}} -CRONTAB=/etc/crontab -CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly' - +{{% if product in ["sle15"] %}} +# create unit file for periodic aide database check +cat > /etc/systemd/system/aidecheck.service < /etc/systemd/system/aidecheck-notify.service <> $CRONTAB fi - +{{% endif %}} From 82bd14f13d76b6aa2eaf968508cddbc7c109f1ec Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Fri, 6 Oct 2023 06:44:34 +0300 Subject: [PATCH 4/6] Fix bash remediation --- .../aide/aide_scan_notification/bash/shared.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh index cc0f319d6c8..7ab274273e3 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh @@ -12,7 +12,7 @@ cat > /etc/systemd/system/aidecheck.service < /etc/systemd/system/aidecheck-notify.service < Date: Sun, 15 Oct 2023 13:55:33 +0300 Subject: [PATCH 5/6] Add more information on the SLE15 approach to the aidecheck notifications Drop some extra whitespaces. Thanks to @jan-cerny for the feedback on this :bow: --- .../aide_scan_notification/ansible/shared.yml | 4 ++-- .../aide_scan_notification/bash/shared.sh | 2 +- .../aide_scan_notification/oval/shared.xml | 4 ++++ .../aide/aide_scan_notification/rule.yml | 20 ++++++++++++++++++- 4 files changed, 26 insertions(+), 4 deletions(-) diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml index f951aabda57..6544d5d94ca 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml @@ -39,13 +39,13 @@ group: root mode: '0644' block: | - [Unit] + [Unit] Description=Status email for AIDE check result After=aidecheck.service [Service] Type=forking ExecStart=/bin/sh -c 'cat /tmp/aide-report.log | /bin/mail -s "$(hostname) - AIDE Integrity Check" {{ var_aide_scan_notification_email }}' - + {{% else %}} - name: "{{{ rule_title }}}" cron: diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh index 7ab274273e3..ea2199868f3 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh @@ -17,7 +17,7 @@ cat > /etc/systemd/system/aidecheck.service < /etc/systemd/system/aidecheck-notify.service < +{{% if product in ["sle15"] %}} @@ -19,6 +20,7 @@ +{{% endif %}} @@ -50,6 +52,7 @@ ^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$ 1 +{{% if product in ["sle15"] %}} @@ -83,4 +86,5 @@ ^Wants\=.*aidecheck-notify.service.*$ 1 +{{% endif %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml index 8ba2e206748..f9d1d6fa01d 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml @@ -57,23 +57,41 @@ ocil_clause: 'AIDE has not been configured or has not been configured to notify ocil: |- To determine that periodic AIDE execution has been scheduled, run the following command: +{{% if product in ["sle15"] %}} + 
$ sudo systemctl status  aidecheck-notify|grep loaded
+ The output should return that the service is loaded. + Also we should make sure that notification service is started by the check: + 
$ sudo systemctl list-dependencies --reverse aidecheck-notify
, + which should display the aidecheck.service in the dependency tree +{{% else %}} 
$ grep aide /etc/crontab
The output should return something similar to the following: 
05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
The email address that the notifications are sent to can be changed by overriding
. +{{% endif %}} fixtext: |- Configure the file integrity tool to run automatically on the system at least weekly and to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. - +{{% if product in ["sle15"] %}} + $ cat > /etc/systemd/system/aidecheck-notify.service < Date: Thu, 2 Nov 2023 12:13:32 +0200 Subject: [PATCH 6/6] Restore CRONTAB and CRONDIRS variables needed for non-SLE solution Thanks to @jan-cerny for the note :bow: --- .../aide/aide_scan_notification/bash/shared.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh index ea2199868f3..c3a4301f91c 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh @@ -25,6 +25,9 @@ cat > /etc/systemd/system/aidecheck-notify.service <