update debian12 anssi bp28 minimal profile #11592

a-skr · 2024-02-15T18:26:42Z

Description:

Add some rules that were previously deactivated because they had a prodtype incompatible with the debian12 product
This work applies to debian12 anssi bp 28 profile.

openshift-ci · 2024-02-15T18:26:53Z

Hi @a-skr. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2024-02-15T18:28:16Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-02-15T20:15:31Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -2,6 +2,10 @@
 if rpm --quiet -q pam; then
 
 var_password_pam_unix_remember=''
+
+
+
+
 
 
 if [ -f /usr/bin/authselect ]; then

OVAL for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- oval:ssg-accounts_passwords_pam_faillock_interval:def:1
+++ oval:ssg-accounts_passwords_pam_faillock_interval:def:1
@@ -1,19 +1,19 @@
 criteria AND
 criteria AND
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_unix_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_unix_auth:tst:1
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_account:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_account:tst:1
 criteria OR
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_faillock_conf:tst:1
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_system:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_password:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:tst:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth'.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -10,8 +10,10 @@
 In file /etc/pam.d/password-auth append rounds='xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds'
          
 to the pam_unix.so entry, as shown below:
+
 password sufficient pam_unix.so ...existing_options... rounds='xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds'
          
+
 The system's default number of rounds is 5000.
 
 [warning]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1
+++ ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1
@@ -1,6 +1,7 @@
 To verify the number of rounds for the password hashing algorithm is configured, run the following command:
 $ sudo grep rounds /etc/pam.d/password-auth
 The output should show the following match:
+
 password sufficient pam_unix.so sha512 rounds=
       Is it the case that rounds is not set to <sub idref="var_password_pam_unix_rounds" /> or is commented out?

a-skr · 2024-02-19T12:13:09Z

Note: PR updated with similar updates for intermediate, enhanced, and high profiles.

Mab879 · 2024-02-20T15:46:40Z

/packit build

jan-cerny · 2024-02-23T10:38:25Z

/packit retest-failed

marcusburghardt

The platform value can be simplified in some rules. I also saw that some OVAL and Remediation files were duplicated from Ubuntu. It is not wrong how it was done and probably doesn't fit in the scope of this PR, but we should think in a way reduce duplication in situations like this. @dodys , could you take a look on this PR too, please?

...counts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/bash/shared.sh

...ts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh

...pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh

...s-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/bash/shared.sh

shared/templates/accounts_password/ansible.template

shared/templates/accounts_password/bash.template

shared/templates/audit_rules_privileged_commands/bash.template

shared/templates/audit_rules_usergroup_modification/bash.template

github-actions · 2024-02-28T18:01:04Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11592
This image was built from commit: f44e383

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11592

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11592 make deploy-local

dodys · 2024-03-01T10:07:26Z

The platform value can be simplified in some rules. I also saw that some OVAL and Remediation files were duplicated from Ubuntu. It is not wrong how it was done and probably doesn't fit in the scope of this PR, but we should think in a way reduce duplication in situations like this. @dodys , could you take a look on this PR too, please?

I believe for all those we could create/use a template instead to avoid having separate files.
Would you like this to be addressed in this PR?

marcusburghardt · 2024-03-12T09:38:40Z

The platform value can be simplified in some rules. I also saw that some OVAL and Remediation files were duplicated from Ubuntu. It is not wrong how it was done and probably doesn't fit in the scope of this PR, but we should think in a way reduce duplication in situations like this. @dodys , could you take a look on this PR too, please?

I believe for all those we could create/use a template instead to avoid having separate files. Would you like this to be addressed in this PR?

@a-skr , did you have an opportunity to see this comment from @dodys ?

a-skr · 2024-03-25T12:36:01Z

@marcusburghardt : I've seen @dodys comment, but as the comment was interrogative, I wasn't sure something more was expected in this PR. I will look into templates this week.

a-skr · 2024-03-26T15:28:11Z

@marcusburghardt : I've seen @dodys comment, but as the comment was interrogative, I wasn't sure something more was expected in this PR. I will look into templates this week.

By the way the "duplication" of ubuntu oval tests are actually symlinks, so there is no code duplication. If symlinks are an acceptable solution, I can factor the code more without ressorting to templates. Just tell me what you prefer.

a-skr · 2024-03-27T16:34:34Z

@marcusburghardt , @dodys : could you please review the last commit? As it is my first template, I would like a review before adding more templates to get rid of the oval symlinks and remaining code duplication.

dodys · 2024-04-01T14:32:28Z

@marcusburghardt , @dodys : could you please review the last commit? As it is my first template, I would like a review before adding more templates to get rid of the oval symlinks and remaining code duplication.

@a-skr, I believe the direction is to always have templates under shared/templates/, just like you did for the tests
a minor comment on the templates is just to keep the space indentation as it was. Your editor might be changing it automatically.

Thanks for working on it on this PR :)

a-skr · 2024-04-02T08:32:37Z

@marcusburghardt , @dodys : could you please review the last commit? As it is my first template, I would like a review before adding more templates to get rid of the oval symlinks and remaining code duplication.

@a-skr, I believe the direction is to always have templates under shared/templates/, just like you did for the tests a minor comment on the templates is just to keep the space indentation as it was. Your editor might be changing it automatically.

Thanks for working on it on this PR :)

@dodys : can you be more specific with the indentation issue? xml and yaml are indented with two spaces, which seems similar to original files. I think I'm missing something.

dodys · 2024-04-02T10:52:30Z

shared/templates/pam_account_password_unix_remember/oval.template

        <criterion test_ref="test_accounts_password_pam_unix_remember"
-          comment="pam_pwhistory.so is properly defined in password section of PAM file"/>
+		   comment="pam_pwhistory.so is properly defined in password section of PAM file"/>


@a-skr like here in this file
There's a lot of indentation changes.

I see...

I mixed content from both ubuntu and shared oval files, but they don't use the same indentation. I will fix it with next PR update.

a-skr · 2024-04-08T08:13:06Z

@dodys, @marcusburghardt : I think the PR is now in good shape to be merged.

A pam_account_password_faillock template has been added. So far, only the rules used by Debian use the new template.

If you don't mind, I prefer to refactor the remaining faillock rules in another PR.

marcusburghardt · 2024-04-18T09:02:15Z

Could you resolve the conflicts, please?

a-skr · 2024-04-18T14:26:49Z

Could you resolve the conflicts, please?

I will do it this week end.

…ation

Add some rules that were previously disabled due to prodtype.

…rd_attempts/accounts_passwords_pam_faillock_deny/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

…rd_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

…rd_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

…ng_algorithm/set_password_hashing_algorithm_logindefs/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

Co-authored-by: Marcus Burghardt <[email protected]>

a-skr · 2024-05-05T16:29:30Z

note: commits amended today to solve a merge conflict.

dodys · 2024-05-06T10:23:16Z

@a-skr some tests you touched are failing on some platforms. Do you know if that was the case already?

a-skr · 2024-05-07T07:25:29Z

@a-skr some tests you touched are failing on some platforms. Do you know if that was the case already?

Some platform (fedora, ...) were already failing before this PR.
I'm not sure wether this PR add more errors (I did keep the old tests).

Is there is a way to run the test suite on commit bd9ef20 ?
(That's the one I rebased on).

If so, we will now if I introduced issues.

dodys · 2024-05-07T09:09:15Z

@a-skr some tests you touched are failing on some platforms. Do you know if that was the case already?

Some platform (fedora, ...) were already failing before this PR. I'm not sure wether this PR add more errors (I did keep the old tests).

Is there is a way to run the test suite on commit bd9ef20 ? (That's the one I rebased on).

If so, we will now if I introduced issues.

@marcusburghardt is it something you can help?

marcusburghardt

The CI tests failing for pam_faillock related rules seem legit. I have tested the rules with the master and with the changes in this PR. Only after these changes these rules are failing. These PAM related rules are complex and some rules differ a little bit based on the specific pam_faillock configuration. We should investigate if the issue is with the assessment or with the test scenarios.

marcusburghardt · 2024-05-13T08:41:53Z

...nts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/shared.yml

+{{% set module='pam_unix.so' %}}
+{{% set option='remember' %}}
+{{% set value='{{ var_password_pam_unix_remember }}' %}}
+{{% elif product in [ "sle12", "sle13" ] %}}


I think there is a typo here. Should it be sle15?

Thank you.

It is effectively a typo.
I will fix it ASAP.

rewrite accounts_passwords_pam_faillock_interval and accounts_passwords_pam_faillock_unlock_time to use this new template.

pam_account_password_faillock template

codeclimate · 2024-05-18T15:31:12Z

Code Climate has analyzed commit f44e383 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

a-skr · 2024-05-20T08:35:49Z

The CI tests failing for pam_faillock related rules seem legit. I have tested the rules with the master and with the changes in this PR. Only after these changes these rules are failing. These PAM related rules are complex and some rules differ a little bit based on the specific pam_faillock configuration. We should investigate if the issue is with the assessment or with the test scenarios.

I did keep the old tests unmodified. I found some bugs in the new OVAL faillock template (commit has been amended).

I also found something that may be an issue with the tests:

I focus on fedora to test and debug. I have this error on the test suite report:

ERROR - Script conflicting_settings_authselect.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in pass, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny'.

But according to platform definitions in the test, this script should not be used with fedora?

#!/bin/bash
# packages = authselect,pam
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9

pam_files=("password-auth" "system-auth")

authselect create-profile testingProfile --base-on minimal
# --- snip ---

(by the way, minimal is not a profile shipped with fedora, so the script can only fail).

Is the platform definition valid?

jan-cerny · 2024-05-20T18:52:12Z

/packit build

jan-cerny · 2024-05-20T19:45:35Z

The CI job "Automatus Fedora" runs tests using RHEL 8 content on a Fedora container, the test suite does some special modification to make the tests executable. That usually works but not always. Sometimes, there are problems caused by different nature of containers - for example, there is no running dbus. Sometimes, the problem is that Fedora is different than RHEL 8. In these situations, it is necessary to run the tests locally using a virtual machine back end to determine if the fail is caused by the fedora container environment or by the actual contents of the PR.

I have executed some of the tests on a RHEL 9 virtual machine backed using content built from this PR and they all pass.

jcerny@fedora content]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 accounts_password_pam_retry
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/content/logs/rule-custom-2024-05-20-2119/test_suite.log
WARNING - Script correct_value.pass.sh is not applicable on given platform
WARNING - Script wrong_value.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
INFO - Script argument_missing.fail.sh using profile (all) OK
INFO - Script pwquality_conf_commented.fail.sh using profile (all) OK
INFO - Script pwquality_conf_conflicting_values.fail.sh using profile (all) OK
INFO - Script pwquality_conf_correct.pass.sh using profile (all) OK
INFO - Script pwquality_conf_correct_with_space.pass.sh using profile (all) OK
INFO - Script pwquality_conf_duplicate_values.pass.sh using profile (all) OK
INFO - Script pwquality_conf_overriden.fail.sh using profile (all) OK
INFO - Script pwquality_conf_wrong.fail.sh using profile (all) OK
[jcerny@fedora content]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 accounts_passwords_pam_faillock_dir
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/content/logs/rule-custom-2024-05-20-2126/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
INFO - Script conflicting_settings_authselect.fail.sh using profile (all) OK
INFO - Script expected_faillock_conf.pass.sh using profile (all) OK
INFO - Script expected_pam_files.pass.sh using profile (all) OK
INFO - Script missing_dir_in_authfail.fail.sh using profile (all) OK
INFO - Script missing_dir_in_preauth.fail.sh using profile (all) OK
INFO - Script wrong_faillock_conf.fail.sh using profile (all) OK
INFO - Script wrong_pam_files.fail.sh using profile (all) OK
[jcerny@fedora content]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 accounts_passwords_pam_faillock_deny
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/content/logs/rule-custom-2024-05-20-2130/test_suite.log
WARNING - Script pam_faillock_expected_pam_files.pass.sh is not applicable on given platform
WARNING - Script pam_faillock_lenient_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_multiple_pam_unix_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_stricter_pam_files.pass.sh is not applicable on given platform
WARNING - Script ubuntu_commented_values.fail.sh is not applicable on given platform
WARNING - Script ubuntu_correct.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct_pamd.pass.sh is not applicable on given platform
WARNING - Script ubuntu_empty_faillock_conf.fail.sh is not applicable on given platform
WARNING - Script ubuntu_missing_pamd.fail.sh is not applicable on given platform
WARNING - Script ubuntu_multiple_pam_unix.fail.sh is not applicable on given platform
WARNING - Script ubuntu_wrong_value.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script conflicting_settings_authselect.fail.sh using profile (all) OK
INFO - Script pam_faillock_conflicting_settings.fail.sh using profile (all) OK
INFO - Script pam_faillock_disabled.fail.sh using profile (all) OK
INFO - Script pam_faillock_expected_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_lenient_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_multiple_pam_unix_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_not_required_pam_files.fail.sh using profile (all) OK
INFO - Script pam_faillock_stricter_faillock_conf.pass.sh using profile (all) OK

Also in the logs from the GitHub job I can see this which I can't see locally

+ authselect create-profile testingProfile --base-on minimal
[error] Unable to read base profile [minimal] [2]: No such file or directory
[error] Unable to create profile [2]: No such file or directory
Unable to create new profile [2]: No such file or directory
++ for file in ${configuration_files[@]}
++ sed -i --follow-symlinks '/pam_pwquality\.so/d' /etc/authselect/custom/testingProfile/password-auth
sed: couldn't readlink /etc/authselect/custom/testingProfile/password-auth: No such file or directory
++ for file in ${configuration_files[@]}

So I assume the fails aren't caused by this PR but are caused by the environment in the CI job.

jan-cerny

I also tried with RHEL 8

jcerny@fedora:~/work/git/scap-security-guide (pr/11592)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 accounts_passwords_pam_faillock_deny,accounts_password_pam_retry,package_ypbind_removed,package_pam_pwquality_installed,accounts_passwords_pam_faillock_dir,accounts_password_pam_unix_remember,accounts_passwords_pam_faillock_interval,accounts_passwords_pam_faillock_unlock_time,accounts_password_pam_unix_rounds_password_auth
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-05-21-1426/test_suite.log
WARNING - Script argument_missing.fail.sh is not applicable on given platform
WARNING - Script correct_value.pass.sh is not applicable on given platform
WARNING - Script wrong_value.fail.sh is not applicable on given platform
WARNING - Script ubuntu_arg_missing.fail.sh is not applicable on given platform
WARNING - Script ubuntu_correct_value.pass.sh is not applicable on given platform
WARNING - Script ubuntu_wrong_value.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_expected_pam_files.pass.sh is not applicable on given platform
WARNING - Script pam_faillock_lenient_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_multiple_pam_unix_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_stricter_pam_files.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct_pamd.pass.sh is not applicable on given platform
WARNING - Script ubuntu_empty_faillock_conf.fail.sh is not applicable on given platform
WARNING - Script ubuntu_multiple_pam_unix.fail.sh is not applicable on given platform
WARNING - Script ubuntu_wrong_value.fail.sh is not applicable on given platform
WARNING - Script ubuntu_commented_values.fail.sh is not applicable on given platform
WARNING - Script ubuntu_missing_pamd.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_expected_pam_files.pass.sh is not applicable on given platform
WARNING - Script pam_faillock_lenient_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_multiple_pam_unix_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_stricter_pam_files.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct_pamd.pass.sh is not applicable on given platform
WARNING - Script ubuntu_empty_faillock_conf.fail.sh is not applicable on given platform
WARNING - Script ubuntu_multiple_pam_unix.fail.sh is not applicable on given platform
WARNING - Script ubuntu_wrong_value.fail.sh is not applicable on given platform
WARNING - Script ubuntu_commented_values.fail.sh is not applicable on given platform
WARNING - Script ubuntu_missing_pamd.fail.sh is not applicable on given platform
WARNING - Script ubuntu_wrong_value.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_expected_pam_files.pass.sh is not applicable on given platform
WARNING - Script pam_faillock_lenient_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_multiple_pam_unix_pam_files.fail.sh is not applicable on given platform
WARNING - Script pam_faillock_stricter_pam_files.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct.pass.sh is not applicable on given platform
WARNING - Script ubuntu_correct_pamd.pass.sh is not applicable on given platform
WARNING - Script ubuntu_empty_faillock_conf.fail.sh is not applicable on given platform
WARNING - Script ubuntu_multiple_pam_unix.fail.sh is not applicable on given platform
WARNING - Script ubuntu_commented_values.fail.sh is not applicable on given platform
WARNING - Script ubuntu_missing_pamd.fail.sh is not applicable on given platform
WARNING - Script correct_value.pass.sh is not applicable on given platform
WARNING - Script wrong_value.fail.sh is not applicable on given platform
WARNING - Script explicit_rounds.pass.sh is not applicable on given platform
WARNING - Script less_rounds.fail.sh is not applicable on given platform
WARNING - Script wrong_control.fail.sh is not applicable on given platform
WARNING - Script default_rounds.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_package_ypbind_removed
INFO - Script package-installed.fail.sh using profile (all) OK
INFO - Script package-installed-removed.pass.sh using profile (all) OK
INFO - Script package-removed.pass.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
INFO - Script authselect_conflict_settings.fail.sh using profile (all) OK
INFO - Script authselect_correct_value_conf.pass.sh using profile (all) OK
INFO - Script authselect_correct_value_pam.pass.sh using profile (all) OK
INFO - Script authselect_missing_argument.fail.sh using profile (all) OK
INFO - Script authselect_missing_line.fail.sh using profile (all) OK
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script authselect_pam_unix_legacy_correct.pass.sh using profile (all) OK
INFO - Script authselect_pam_unix_legacy_wrong.fail.sh using profile (all) OK
INFO - Script authselect_wrong_value_conf.fail.sh using profile (all) OK
INFO - Script authselect_wrong_value_pam.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script conflicting_settings_authselect.fail.sh using profile (all) OK
INFO - Script pam_faillock_conflicting_settings.fail.sh using profile (all) OK
INFO - Script pam_faillock_expected_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_lenient_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_multiple_pam_unix_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_stricter_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_disabled.fail.sh using profile (all) OK
INFO - Script pam_faillock_not_required_pam_files.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
INFO - Script conflicting_settings_authselect.fail.sh using profile (all) OK
INFO - Script expected_faillock_conf.pass.sh using profile (all) OK
INFO - Script expected_pam_files.pass.sh using profile (all) OK
INFO - Script missing_dir_in_authfail.fail.sh using profile (all) OK
INFO - Script missing_dir_in_preauth.fail.sh using profile (all) OK
INFO - Script wrong_faillock_conf.fail.sh using profile (all) OK
INFO - Script wrong_pam_files.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script conflicting_settings_authselect.fail.sh using profile (all) OK
INFO - Script pam_faillock_conflicting_settings.fail.sh using profile (all) OK
INFO - Script pam_faillock_expected_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_lenient_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_multiple_pam_unix_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_stricter_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_disabled.fail.sh using profile (all) OK
INFO - Script pam_faillock_not_required_pam_files.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script conflicting_settings_authselect.fail.sh using profile (all) OK
INFO - Script pam_faillock_conflicting_settings.fail.sh using profile (all) OK
INFO - Script pam_faillock_expected_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_lenient_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_multiple_pam_unix_faillock_conf.fail.sh using profile (all) OK
INFO - Script pam_faillock_stricter_faillock_conf.pass.sh using profile (all) OK
INFO - Script pam_faillock_disabled.fail.sh using profile (all) OK
INFO - Script pam_faillock_not_required_pam_files.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed
INFO - Script package-installed.pass.sh using profile (all) OK
INFO - Script package-removed.fail.sh using profile (all) OK
INFO - Script package-installed-removed.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
INFO - Script argument_missing.fail.sh using profile (all) OK
INFO - Script pwquality_conf_commented.fail.sh using profile (all) OK
INFO - Script pwquality_conf_conflicting_values.fail.sh using profile (all) OK
INFO - Script pwquality_conf_correct.pass.sh using profile (all) OK
INFO - Script pwquality_conf_correct_with_space.pass.sh using profile (all) OK
INFO - Script pwquality_conf_duplicate_values.pass.sh using profile (all) OK
INFO - Script pwquality_conf_overriden.fail.sh using profile (all) OK
INFO - Script pwquality_conf_wrong.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
INFO - Script authselect_argument_missing.fail.sh using profile (all) OK
INFO - Script authselect_correct_value.pass.sh using profile (all) OK
INFO - Script authselect_modified_pam.fail.sh using profile (all) OK
INFO - Script authselect_wrong_control.fail.sh using profile (all) OK
INFO - Script authselect_wrong_value.fail.sh using profile (all) OK
INFO - Script authselect_default_rounds.fail.sh using profile (all) OK

conlficts have been resolved by rebase

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Feb 15, 2024

a-skr force-pushed the feature-refactor-prodtype-debian12 branch from d64b770 to 6950750 Compare February 15, 2024 20:11

a-skr force-pushed the feature-refactor-prodtype-debian12 branch from 2bb8fed to 5fadfe2 Compare February 19, 2024 12:32

marcusburghardt requested changes Feb 27, 2024

View reviewed changes

marcusburghardt added the Debian Debian product related. label Feb 27, 2024

jan-cerny requested a review from dodys February 29, 2024 08:12

a-skr force-pushed the feature-refactor-prodtype-debian12 branch from e1399e2 to b36b129 Compare March 27, 2024 17:07

dodys reviewed Apr 2, 2024

View reviewed changes

a-skr force-pushed the feature-refactor-prodtype-debian12 branch 3 times, most recently from eea0ffa to f592e94 Compare April 5, 2024 11:02

a-skr requested a review from marcusburghardt April 11, 2024 10:23

a-skr force-pushed the feature-refactor-prodtype-debian12 branch from f592e94 to a60ae94 Compare April 19, 2024 12:07

a-skr and others added 11 commits May 5, 2024 18:19

enable bash remediation for debian12 in audit_rules_usergroup_modific…

43e27b7

…ation

update debian12 anssi enhanced profile

99a91f3

Add some rules that were previously disabled due to prodtype.

update debian12 anssi high profile

07aa881

Add some rules that were previously disabled due to prodtype.

Update linux_os/guide/system/accounts/accounts-pam/locking_out_passwo…

1a12864

…rd_attempts/accounts_passwords_pam_faillock_deny/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

Update linux_os/guide/system/accounts/accounts-pam/locking_out_passwo…

92c4206

…rd_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

Update linux_os/guide/system/accounts/accounts-pam/locking_out_passwo…

a438906

…rd_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

Update linux_os/guide/system/accounts/accounts-pam/set_password_hashi…

7ba41dd

…ng_algorithm/set_password_hashing_algorithm_logindefs/bash/shared.sh Co-authored-by: Marcus Burghardt <[email protected]>

Update shared/templates/accounts_password/ansible.template

44a24f3

Co-authored-by: Marcus Burghardt <[email protected]>

Update shared/templates/accounts_password/bash.template

d1dfc70

Co-authored-by: Marcus Burghardt <[email protected]>

Update shared/templates/audit_rules_privileged_commands/bash.template

64fdbaa

Co-authored-by: Marcus Burghardt <[email protected]>

Update shared/templates/audit_rules_usergroup_modification/bash.template

4bb30c3

Co-authored-by: Marcus Burghardt <[email protected]>

a-skr force-pushed the feature-refactor-prodtype-debian12 branch from a60ae94 to 118cf7b Compare May 5, 2024 16:27

marcusburghardt previously requested changes May 13, 2024

View reviewed changes

a-skr added 3 commits May 18, 2024 17:06

add an account_password_pam_faillock template

e43969d

rewrite accounts_passwords_pam_faillock_interval and accounts_passwords_pam_faillock_unlock_time to use this new template.

rewrite accounts_passwords_pam_faillock_deny rule to use

e243f8b

pam_account_password_faillock template

factorise code in pam_account_password_unix_remember

f44e383

a-skr force-pushed the feature-refactor-prodtype-debian12 branch from 55c0193 to f44e383 Compare May 18, 2024 15:14

jan-cerny added this to the 0.1.74 milestone May 20, 2024

jan-cerny self-assigned this May 21, 2024

jan-cerny approved these changes May 21, 2024

View reviewed changes

jan-cerny merged commit 0a1ba93 into ComplianceAsCode:master May 21, 2024
104 of 109 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update debian12 anssi bp28 minimal profile #11592

update debian12 anssi bp28 minimal profile #11592

a-skr commented Feb 15, 2024

openshift-ci bot commented Feb 15, 2024

github-actions bot commented Feb 15, 2024

github-actions bot commented Feb 15, 2024 •

edited

Loading

a-skr commented Feb 19, 2024

Mab879 commented Feb 20, 2024

jan-cerny commented Feb 23, 2024

marcusburghardt left a comment

github-actions bot commented Feb 28, 2024 •

edited

Loading

dodys commented Mar 1, 2024

marcusburghardt commented Mar 12, 2024

a-skr commented Mar 25, 2024

a-skr commented Mar 26, 2024 •

edited

Loading

a-skr commented Mar 27, 2024 •

edited

Loading

dodys commented Apr 1, 2024 •

edited

Loading

a-skr commented Apr 2, 2024

dodys Apr 2, 2024

a-skr Apr 2, 2024

a-skr commented Apr 8, 2024

marcusburghardt commented Apr 18, 2024

a-skr commented Apr 18, 2024

a-skr commented May 5, 2024

dodys commented May 6, 2024

a-skr commented May 7, 2024 •

edited

Loading

dodys commented May 7, 2024

marcusburghardt left a comment

marcusburghardt May 13, 2024

a-skr May 16, 2024

codeclimate bot commented May 18, 2024

a-skr commented May 20, 2024

jan-cerny commented May 20, 2024

jan-cerny commented May 20, 2024

jan-cerny left a comment

update debian12 anssi bp28 minimal profile #11592

update debian12 anssi bp28 minimal profile #11592

Conversation

a-skr commented Feb 15, 2024

Description:

openshift-ci bot commented Feb 15, 2024

github-actions bot commented Feb 15, 2024

github-actions bot commented Feb 15, 2024 • edited Loading

a-skr commented Feb 19, 2024

Mab879 commented Feb 20, 2024

jan-cerny commented Feb 23, 2024

marcusburghardt left a comment

Choose a reason for hiding this comment

github-actions bot commented Feb 28, 2024 • edited Loading

dodys commented Mar 1, 2024

marcusburghardt commented Mar 12, 2024

a-skr commented Mar 25, 2024

a-skr commented Mar 26, 2024 • edited Loading

a-skr commented Mar 27, 2024 • edited Loading

dodys commented Apr 1, 2024 • edited Loading

a-skr commented Apr 2, 2024

dodys Apr 2, 2024

Choose a reason for hiding this comment

a-skr Apr 2, 2024

Choose a reason for hiding this comment

a-skr commented Apr 8, 2024

marcusburghardt commented Apr 18, 2024

a-skr commented Apr 18, 2024

a-skr commented May 5, 2024

dodys commented May 6, 2024

a-skr commented May 7, 2024 • edited Loading

dodys commented May 7, 2024

marcusburghardt left a comment

Choose a reason for hiding this comment

marcusburghardt May 13, 2024

Choose a reason for hiding this comment

a-skr May 16, 2024

Choose a reason for hiding this comment

codeclimate bot commented May 18, 2024

a-skr commented May 20, 2024

jan-cerny commented May 20, 2024

jan-cerny commented May 20, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

github-actions bot commented Feb 15, 2024 •

edited

Loading

github-actions bot commented Feb 28, 2024 •

edited

Loading

a-skr commented Mar 26, 2024 •

edited

Loading

a-skr commented Mar 27, 2024 •

edited

Loading

dodys commented Apr 1, 2024 •

edited

Loading

a-skr commented May 7, 2024 •

edited

Loading