os-02: Fix for SUSE environments #70
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
controls/os_spec.rb
Outdated
| @@ -21,7 +21,7 @@ | |||
| login_defs_passmaxdays = attribute('login_defs_passmaxdays', default: '60', description: 'Default password maxdays to set in login.defs') | |||
| login_defs_passmindays = attribute('login_defs_passmindays', default: '7', description: 'Default password mindays to set in login.defs') | |||
| login_defs_passwarnage = attribute('login_defs_passwarnage', default: '7', description: 'Default password warnage (days) to set in login.defs') | |||
| if os.redhat? | |||
| if os.redhat? || os.suse? | |||
| shadow_group = 'root' | |||
| elsif os.debian? | |||
| shadow_group = 'shadow' | |||
There was a problem hiding this comment.
@chris-rock @atomic111 we do not have here a sane default. It means in the situation prior to this change on a suse system shadow_group would be nil. How should we handle this? Options from my POV:
- introduction of else and raise, something like:
shadow_group = if os.redhat?
'root'
elsif
'shadow'
else
raise 'Unsupported platform'
end- defined sane default, like
shadow_group = 'root'
if os_debian?
shadow_group = 'shadow'
endIdeas, opinions?
There was a problem hiding this comment.
The correct way is 1., but InSpec does not support exceptions yet. This is a high-prio ticket for one of the next InSpec releases. Should we go with 2. for now?
There was a problem hiding this comment.
@chris-rock As I had to rework my patch I already implemented the second option ...
|
Had to rework my patch as the default group for /etc/shadow is "shadow" and group readable on a fresh SUSE system |
mcgege
added a commit
to mcgege/puppet-os-hardening
that referenced
this pull request
Jun 26, 2017
- for SUSE and Ubuntu environments: group should be "shadow" and file mode "0640" (for SUSE also corrected in Baseline, see dev-sec/linux-baseline#70)
artem-sidorenko
requested changes
Jun 27, 2017
controls/os_spec.rb
Outdated
| @@ -103,7 +100,7 @@ | |||
| describe file('/etc/shadow') do | |||
| it { should_not be_readable.by('group') } | |||
| end | |||
| elsif os.debian? | |||
| elsif os.debian? || os.suse? | |||
There was a problem hiding this comment.
@mcgege can we do here the same/similar like above? Maybe via if os.debian? || os.suse? & else construction
Signed-off-by: Michael Geiger <michael.geiger@telekom.de>
|
@artem-sidorenko done |
artem-sidorenko
approved these changes
Jun 27, 2017
chris-rock
approved these changes
Jun 27, 2017
deric4
pushed a commit
to Logicworks/cis-dil-benchmark
that referenced
this pull request
Jan 5, 2021
* refactor `attribute()` -> `input()` * fix regression/add supportfor evaluating gid on /etc/shadow and friends on - debian - suse - alpine Ref: - dev-sec#33 - dev-sec/linux-baseline#70 on-behalf-of: @Logicworks <dmiguel@logicworks.net> Signed-off-by: Deric Miguel <dmiguel@logicworks.net>
deric4
pushed a commit
to Logicworks/cis-dil-benchmark
that referenced
this pull request
Jan 7, 2021
* refactor `attribute()` -> `input()` * fix regression/add supportfor evaluating gid on /etc/shadow and friends on - debian - suse - alpine Ref: - dev-sec#33 - dev-sec/linux-baseline#70 on-behalf-of: @Logicworks <dmiguel@logicworks.net> Signed-off-by: Deric Miguel <dmiguel@logicworks.net>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Missing shadow_group + test for SUSE