fix ansible SLES stig remediations in check mode #11248

teacup-on-rockingchair · 2023-11-05T14:45:55Z

Description:

When run in check mode ansible remediation scripts should be more isolated and need extra checks instead of assumptions

Rationale:

Fix ansible remediations run in check mode for rules part of the SLE STIG profile
Add var_accounts_tmout variable definition for PCI profile used in accounts_tmout rule

github-actions · 2023-11-05T14:47:13Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-11-05T14:49:42Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_aide_check_audit_tools' differs.
--- xccdf_org.ssgproject.content_rule_aide_check_audit_tools
+++ xccdf_org.ssgproject.content_rule_aide_check_audit_tools
@@ -1,3 +1,20 @@
+- name: Configure AIDE to Verify the Audit Tools - Gather List of Packages
+  tags:
+  - CCE-85964-5
+  - DISA-STIG-RHEL-08-030650
+  - NIST-800-53-AU-9(3)
+  - NIST-800-53-AU-9(3).1
+  - aide_check_audit_tools
+  - aide_check_audit_tools
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+  ansible.builtin.package_facts:
+    manager: auto
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+
 - name: Ensure aide is installed
   package:
     name: '{{ item }}'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_aide_verify_acls' differs.
--- xccdf_org.ssgproject.content_rule_aide_verify_acls
+++ xccdf_org.ssgproject.content_rule_aide_verify_acls
@@ -45,7 +45,7 @@
     replace: \g<1>\g<2>+acl
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
-  - '''aide'' in ansible_facts.packages'
+  - find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"
   with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list }}'
   tags:
   - CCE-84220-3

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes' differs.
--- xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes
+++ xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes
@@ -45,7 +45,7 @@
     replace: \g<1>\g<2>+xattrs
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
-  - '''aide'' in ansible_facts.packages'
+  - find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"
   with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list }}'
   tags:
   - CCE-83733-6

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow
+++ xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow
@@ -22,7 +22,7 @@
   with_items: '{{ users_nopasswd.stdout_lines }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
-  - users_nopasswd.stdout_lines | length > 0
+  - users_nopasswd is not skipped and users_nopasswd.stdout_lines | length > 0
   tags:
   - CCE-85953-8
   - DISA-STIG-RHEL-08-010121

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
+++ xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
@@ -100,7 +100,7 @@
   - no_reboot_needed
   - restrict_strategy
 
-- name: Update Update /etc/audit/audit.rules to audit privileged functions
+- name: Update /etc/audit/audit.rules to audit privileged functions
   ansible.builtin.lineinfile:
     path: /etc/audit/audit.rules
     line: '{{  item.rule  }}'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_network_sniffer_disabled' differs.
--- xccdf_org.ssgproject.content_rule_network_sniffer_disabled
+++ xccdf_org.ssgproject.content_rule_network_sniffer_disabled
@@ -25,7 +25,7 @@
   loop: '{{ network_interfaces.stdout_lines }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
-  - item.split(':')
+  - network_interfaces.stdout_lines is defined and "item.split(':') | length == 3"
   tags:
   - CCE-82283-3
   - DISA-STIG-RHEL-08-040330

marcusburghardt · 2023-12-05T14:22:21Z

@teacup-on-rockingchair , could you resolve the conflict in this PR, please?

teacup-on-rockingchair · 2023-12-19T08:32:14Z

@teacup-on-rockingchair , could you resolve the conflict in this PR, please?

Hi @marcusburghardt any issues with the PR that disturbs you?

marcusburghardt

I have some comments about the new criteria included in the conditionals. Could you take a look, please?

linux_os/guide/services/obsolete/r_services/no_host_based_files/ansible/shared.yml

linux_os/guide/services/obsolete/r_services/no_user_host_based_files/ansible/shared.yml

...-restrictions/password_expiration/accounts_password_set_max_life_existing/ansible/shared.yml

...-restrictions/password_expiration/accounts_password_set_min_life_existing/ansible/shared.yml

...unts/accounts-restrictions/password_storage/no_empty_passwords_etc_shadow/ansible/shared.yml

linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/sle12.yml

linux_os/guide/system/logging/ensure_rtc_utc_configuration/ansible/shared.yml

linux_os/guide/system/network/network_sniffer_disabled/ansible/shared.yml

.../system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml

shared/templates/pam_options/ansible.template

marcusburghardt · 2023-12-20T08:58:34Z

In automatus tests for CS8, CS9 and Fedora this error is appearing:
ERROR - Rule 'network_sniffer_disabled' test setup script 'promisc_interface_exists.fail.sh' failed with exit code 2
It is likely related to restrictions in containers. Possibly enabling the CAP_NET_ADMIN capability should allow the network interfaces inside a container to be set to promiscuous mode but it is not necessary for testing purposes. In VMs, the test scenario works as expected. So the error for this specific test scenario can be safely waived here.

jan-cerny · 2024-02-05T17:23:59Z

/packit retest-failed

marcusburghardt · 2024-02-27T09:11:14Z

/packit test

teacup-on-rockingchair · 2024-03-06T03:19:11Z

/packit test

Hi @marcusburghardt I cannot seem to understand how the changes made have connection to the failing tests, that are preventing the PR for merging can you give me some hints here, so we can push this one through?

marcusburghardt · 2024-03-06T08:47:30Z

/packit test

Hi @marcusburghardt I cannot seem to understand how the changes made have connection to the failing tests, that are preventing the PR for merging can you give me some hints here, so we can push this one through?

Hi @teacup-on-rockingchair , I noticed a weakness in network_sniffer_disabled rule that was causing the error while executing the Ansible Playbook in CI tests. It should be fixed by #11657

Once this PR is merged, I would recommend to rebase your PR.

github-actions · 2024-03-07T02:59:25Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11248
This image was built from commit: 81add9c

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11248

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11248 make deploy-local

marcusburghardt

I couldn't reproduce errors in check mode even before the changes. Some changes are interesting in this PR, but I believe most of the changes are not necessary since they have no effect. Maybe you could share more details on how to reproduce the errors in check mode, please?

linux_os/guide/services/obsolete/r_services/no_host_based_files/ansible/shared.yml

linux_os/guide/services/obsolete/r_services/no_user_host_based_files/ansible/shared.yml

...-restrictions/password_expiration/accounts_password_set_max_life_existing/ansible/shared.yml

linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/sle12.yml

…s rule

teacup-on-rockingchair · 2024-03-25T04:38:49Z

I couldn't reproduce errors in check mode even before the changes. Some changes are interesting in this PR, but I believe most of the changes are not necessary since they have no effect. Maybe you could share more details on how to reproduce the errors in check mode, please?

Thanks for the help and feedback @marcusburghardt I rebased at 6abcf65 and removed irrelevant changes, and applied the suggestion to use file instead of fileglob. In my setup the ansible playbooks in check mode now work ok for stig and pci-dss profiles. which was the initial intention.

marcusburghardt · 2024-04-04T11:22:09Z

@teacup-on-rockingchair , I am finishing some local tests but so far it is good.
Could you only take a look in the "Automatus SLE15" failure, please? It seems legit:

ERROR - Terminating due to error: Couldn't install required packages: passwd.

@marcusburghardt

Make sure that dependencies on passwd package are interpreted for that platform. Thanks to @marcusburghardt for raising the flag on that 🙇

marcusburghardt

Great. Now it is only necessary to update the references for stability tests and the required tests should pass.

codeclimate · 2024-04-08T07:46:42Z

Code Climate has analyzed commit 81add9c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.3% (0.0% change).

View more on Code Climate.

teacup-on-rockingchair · 2024-04-08T09:58:34Z

Great. Now it is only necessary to update the references for stability tests and the required tests should pass.

Thanks @marcusburghardt 🙇 I think the only issue in tests seemed to be network_sniffer_disabled test, which is container related if I understand it correctly

marcusburghardt

Thanks

marcusburghardt · 2024-04-09T09:46:07Z

Overriding CODEOWNERS as @teacup-on-rockingchair can't approve his own PR.

teacup-on-rockingchair added Ansible Ansible remediation update. SLES SUSE Linux Enterprise Server product related. STIG STIG Benchmark related. pci-dss labels Nov 5, 2023

teacup-on-rockingchair requested a review from a team as a code owner November 5, 2023 14:45

marcusburghardt self-assigned this Nov 8, 2023

vojtapolasek added this to the 0.1.72 milestone Nov 29, 2023

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Dec 9, 2023

teacup-on-rockingchair force-pushed the sle15_fix_ansible_stig_remediations branch from 6b6929a to dfd5a13 Compare December 10, 2023 15:31

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Dec 10, 2023

marcusburghardt requested changes Dec 20, 2023

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jan 28, 2024

marcusburghardt modified the milestones: 0.1.72, 0.1.73 Jan 29, 2024

teacup-on-rockingchair force-pushed the sle15_fix_ansible_stig_remediations branch from 542df1f to ff4f931 Compare January 30, 2024 08:45

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jan 30, 2024

marcusburghardt mentioned this pull request Mar 6, 2024

Simplify output of ip link show command #11657

Merged

teacup-on-rockingchair force-pushed the sle15_fix_ansible_stig_remediations branch from ff4f931 to e2d1e21 Compare March 7, 2024 02:49

teacup-on-rockingchair requested a review from marcusburghardt March 12, 2024 06:10

marcusburghardt requested changes Mar 20, 2024

View reviewed changes

teacup-on-rockingchair added 3 commits March 24, 2024 20:59

Fix ansible remediations run in check mode

6abcf65

Add var_accounts_tmout variable definition for PCI profile

d6f2353

Make sure to gather package facts in context of aide_check_audit_tool…

a563a54

…s rule

teacup-on-rockingchair force-pushed the sle15_fix_ansible_stig_remediations branch from e2d1e21 to a563a54 Compare March 25, 2024 04:36

teacup-on-rockingchair requested a review from marcusburghardt March 26, 2024 05:49

Platform package override for passwd in SUSE platforms

beafb08

Make sure that dependencies on passwd package are interpreted for that platform. Thanks to @marcusburghardt for raising the flag on that 🙇

teacup-on-rockingchair force-pushed the sle15_fix_ansible_stig_remediations branch from 9ed6012 to beafb08 Compare April 7, 2024 21:00

marcusburghardt requested changes Apr 8, 2024

View reviewed changes

Update references for product stability

81add9c

marcusburghardt approved these changes Apr 9, 2024

View reviewed changes

marcusburghardt merged commit bec7734 into ComplianceAsCode:master Apr 9, 2024
41 of 45 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix ansible SLES stig remediations in check mode #11248

fix ansible SLES stig remediations in check mode #11248

teacup-on-rockingchair commented Nov 5, 2023

github-actions bot commented Nov 5, 2023

github-actions bot commented Nov 5, 2023 •

edited

Loading

marcusburghardt commented Dec 5, 2023

teacup-on-rockingchair commented Dec 19, 2023

marcusburghardt left a comment

marcusburghardt commented Dec 20, 2023

jan-cerny commented Feb 5, 2024

marcusburghardt commented Feb 27, 2024

teacup-on-rockingchair commented Mar 6, 2024

marcusburghardt commented Mar 6, 2024

github-actions bot commented Mar 7, 2024 •

edited

Loading

marcusburghardt left a comment

teacup-on-rockingchair commented Mar 25, 2024

marcusburghardt commented Apr 4, 2024

marcusburghardt left a comment

codeclimate bot commented Apr 8, 2024

teacup-on-rockingchair commented Apr 8, 2024

marcusburghardt left a comment

marcusburghardt commented Apr 9, 2024

fix ansible SLES stig remediations in check mode #11248

fix ansible SLES stig remediations in check mode #11248

Conversation

teacup-on-rockingchair commented Nov 5, 2023

Description:

Rationale:

github-actions bot commented Nov 5, 2023

github-actions bot commented Nov 5, 2023 • edited Loading

marcusburghardt commented Dec 5, 2023

teacup-on-rockingchair commented Dec 19, 2023

marcusburghardt left a comment

Choose a reason for hiding this comment

marcusburghardt commented Dec 20, 2023

jan-cerny commented Feb 5, 2024

marcusburghardt commented Feb 27, 2024

teacup-on-rockingchair commented Mar 6, 2024

marcusburghardt commented Mar 6, 2024

github-actions bot commented Mar 7, 2024 • edited Loading

marcusburghardt left a comment

Choose a reason for hiding this comment

teacup-on-rockingchair commented Mar 25, 2024

marcusburghardt commented Apr 4, 2024

marcusburghardt left a comment

Choose a reason for hiding this comment

codeclimate bot commented Apr 8, 2024

teacup-on-rockingchair commented Apr 8, 2024

marcusburghardt left a comment

Choose a reason for hiding this comment

marcusburghardt commented Apr 9, 2024

github-actions bot commented Nov 5, 2023 •

edited

Loading

github-actions bot commented Mar 7, 2024 •

edited

Loading