Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Task titles do not quite match CIS rule texts for v2.0.0 #256

Closed
bgro opened this issue Nov 28, 2024 · 2 comments
Closed

Task titles do not quite match CIS rule texts for v2.0.0 #256

bgro opened this issue Nov 28, 2024 · 2 comments
Assignees
Labels
bug Something isn't working

Comments

@bgro
Copy link
Contributor

bgro commented Nov 28, 2024

Describe the Issue

In branch benchmark_v2.0.0
the task titles do not 100% match the rule texts of the CIS Benchmark v2.0

Here is an overview over all differences: the - difference is the text of the CIS Benchmark,
the + difference is what is currently found in the Ansible role.

- id: R1.5.1
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure address space layout randomization is enabled
    -
    +Ensure address space layout randomization (ASLR) is enabled
    ```
- id: R1.6.4
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure access to /etc/motd is configured
    -
    +Ensure permissions on /etc/motd are configured
    ```
- id: R1.6.5
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure access to /etc/issue is configured
    -
    +Ensure permissions on /etc/issue are configured
    ```
- id: R1.6.6
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure access to /etc/issue.net is configured
    -
    +Ensure permissions on /etc/issue.net are configured
    ```
- id: R1.7.1
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure GDM is removed
    -
    +Ensure GNOME Display Manager is removed
    ```
- id: R1.7.3
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure GDM disable-user-list option is enabled
    -
    +Ensure disable-user-list option is enabled
    ```
- id: R2.1.5
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure dnsmasq services are not in use
    -
    +Ensure dnsmasq server services are not in use
    ```
- id: R2.1.21
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure mail transfer agent is configured for local-only mode
    -
    +Ensure mail transfer agents are configured for local-only mode
    ```
- id: R2.2.6
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure ftp client is not installed
    -
    +Ensure ftp is not installed
    ```
- id: R2.3.3.2
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure chrony is running as user \_chrony
    -
    +Ensure chrony is running as user _chrony
    ```
- id: R2.4.1.1
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure cron daemon is enabled and active
    -
    +Ensure cron daemon is enabled and running
    ```
- id: R2.4.1.8
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure crontab is restricted to authorized users
    -
    +Ensure cron is restricted to authorized users
    ```
- id: R4.1.4
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure ufw loopback traffic is configured
    -
    +Ensure loopback traffic is configured
    ```
- id: R5.1.6
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd Ciphers are configured
    -
    +Ensure only strong Ciphers are used
    ```
- id: R5.1.9
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd GSSAPIAuthentication is disabled
    -
    +Ensure sshd GSSAPIAuthentication is is disabled
    ```
- id: R5.1.10
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd HostbasedAuthentication is disabled
    -
    +Ensure SSH HostbasedAuthentication is disabled
    ```
- id: R5.1.11
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd IgnoreRhosts is enabled
    -
    +Ensure SSH IgnoreRhosts is enabled
    ```
- id: R5.1.12
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd KexAlgorithms is configured
    -
    +Ensure only strong Key Exchange algorithms are used
    ```
- id: R5.1.13
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd LoginGraceTime is configured
    -
    +Ensure SSH LoginGraceTime is configured
    ```
- id: R5.1.14
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd LogLevel is configured
    -
    +Ensure SSH LogLevel is configured
    ```
- id: R5.1.15
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd MACs are configured
    -
    +Ensure only strong MAC algorithms are used
    ```
- id: R5.1.16
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd MaxAuthTries is configured
    -
    +Ensure SSH MaxAuthTries is set to 4 or less
    ```
- id: R5.1.18
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd MaxStartups is configured
    -
    +Ensure SSH MaxStartups is configured
    ```
- id: R5.1.19
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd PermitEmptyPasswords is disabled
    -
    +Ensure SSH PermitEmptyPasswords is disabled
    ```
- id: R5.1.21
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure sshd PermitUserEnvironment is disabled
    -
    +Ensure SSH PermitUserEnvironment is disabled
    ```
- id: R5.2.4
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure users must provide password for privilege escalation
    -
    +Ensure users must provide password for escalation
    ```
- id: R5.3.3.2.5
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure password maximum sequential characters is configured
    -
    +Ensure password maximum sequential characters is is configured
    ```
- id: R6.1.3
    - id: R6.2.1.2.3
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure systemd-journal-upload is enabled and active
    -
    +Ensure systemd-journal-remote is enabled and active
    ```
- id: R6.3.3.6
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure use of privileged commands are collected
    -
    +Ensure use of privileged commands is collected
    ```
- id: R6.3.3.7
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure unsuccessful file access attempts are collected
    -
    +Ensure unsuccessful unauthorized file access attempts are collected
    ```
- id: R6.3.3.19
  diff: |-
    **root['rule']**:

    ``` diff
    --- 
    +++ 
    @@ -1,3 +1 @@
    -
    -Ensure kernel module loading unloading and modification is collected
    -
    +Ensure kernel module loading and unloading is collected
    ```

Expected Behavior

Ideally, the task titles should exactly match the CIS rule content (as is already the case for 95% of all rules/tasks)

Actual Behavior
n/a

Control(s) Affected
n/a
Environment (please complete the following information):

  • branch being used: benchmark_v2.0.0]
  • Ansible Version: n/a
  • Host Python Version: n/a
  • Ansible Server Python Version: n/a
  • Additional Details: n/a

Additional Notes
Anything additional goes here

Possible Solution
Enter a suggested fix here

@bgro bgro added the bug Something isn't working label Nov 28, 2024
uk-bolly added a commit that referenced this issue Nov 28, 2024
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
@uk-bolly
Copy link
Member

hi @bgro

Thank you for the issue, items like this really help, I have now updated the branch accordingly well spotted.

Many thanks

uk-bolly

@uk-bolly uk-bolly self-assigned this Nov 28, 2024
@bgro
Copy link
Contributor Author

bgro commented Nov 29, 2024

Very welcome, thank you for the lightning-fast fix!

@bgro bgro closed this as completed Nov 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants