Guide to the Secure Configuration of Red Hat Enterprise Linux 7 (PCI-DSS centric)

with profile PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Ensures PCI-DSS v3.2.1 related security configuration settings are applied.

The SCAP Security Guide Project
https://www.open-scap.org/security-policies/scap-security-guide

This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.

Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile Title	PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Profile ID	xccdf_org.ssgproject.content_profile_pci-dss_centric

CPE Platforms

cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:7::client
cpe:/o:redhat:enterprise_linux:7::computenode

Revision History

Current version: 0.1.43

draft (as of 2019-02-21)

10.1
10.2
10.3
10.4
10.5
10.6
10.7
10.8

11.1
11.2
11.3
11.4
11.5
11.6

Values
Non PCI-DSS

Checklist

Group Guide to the Secure Configuration of Red Hat Enterprise Linux 7 (PCI-DSS centric) Group contains 337 groups and 95 rules

Group 2.

[ref] Do not use vendor-supplied defaults for system passwords and other

Group 2.1

[ref] Always change vendor-supplied

Group 2.1.1

[ref] For wireless environments

Group 2.1.1.a

[ref] Interview responsible personnel and examine

Group 2.1.1.b

[ref] Interview personnel and examine policies and

Group 2.1.1.c

[ref] Examine vendor documentation and login to

Group 2.1.1.d

[ref] Examine vendor documentation and observe

Group 2.1.1.e

[ref] Examine vendor documentation and observe

Group 2.1.a

[ref] Choose a sample of system components, and attempt

Group 2.1.b

[ref] For the sample of system components, verify that all

Group 2.1.c

[ref] Interview personnel and examine supporting

Group 2.2

[ref] Develop configuration standards for

Group 2.2.1

[ref] Implement only one primary

Group 2.2.1.a

[ref] Select a sample of system components and

Group 2.2.1.b

[ref] If virtualization technologies are used, inspect the

Group 2.2.2

[ref] Enable only necessary services,

Group 2.2.2.a

[ref] Select a sample of system components and

Group 2.2.2.b

[ref] Identify any enabled insecure services, daemons,

Group 2.2.3

[ref] Implement additional security

Group 2.2.3.a

[ref] Inspect configuration settings to verify that security

Group 2.2.4

[ref] Configure system security

Group 2.2.4.a

[ref] Interview system administrators and/or security

Group 2.2.4.b

[ref] Examine the system configuration standards to

Group 2.2.4.c

[ref] Select a sample of system components and

Group 2.2.5

[ref] Remove all unnecessary

Group 2.2.5.a

[ref] Select a sample of system components and

Group 2.2.5.b

[ref] . Examine the documentation and security

Group 2.2.5.c

[ref] . Examine the documentation and security

Group 2.2.a

[ref]

Group 2.2.b

[ref] Examine policies and interview personnel to

Group 2.2.c

[ref] Examine policies and interview personnel to

Group 2.2.d

[ref] Verify that system configuration standards include the

Group 2.3

[ref] Encrypt all non-console

Group 2.3.a

[ref] Observe an administrator log on to each system and

Group 2.3.b

[ref] Review services and parameter files on systems to

Group 2.3.c

[ref] Observe an administrator log on to each system to

Group 2.3.d

[ref] Examine vendor documentation and interview

Group 2.4

[ref] Maintain an inventory of system

Group 2.4.a

[ref] Examine system inventory to verify that a list of

Group 2.4.b

[ref] Interview personnel to verify the documented inventory

Group 2.5

[ref] Ensure that security policies and

Group 2.6

[ref] Shared hosting providers must

Group 3.

[ref] Protect stored cardholder data

Group 3.1

[ref] Keep cardholder data storage to a

Group 3.1.a

[ref] Examine the data retention and disposal policies,

Group 3.1.b

[ref] Interview personnel to verify that:

Group 3.1.c

[ref] For a sample of system components that store cardholder

Group 3.2

[ref] Do not store sensitive authentication

Group 3.2.1

[ref] Do not store the full contents of

Group 3.2.2

[ref] Do not store the card verification

Group 3.2.3

[ref] Do not store the personal

Group 3.2.a

[ref] For issuers and/or companies that support issuing

Group 3.2.b

[ref] For issuers and/or companies that support issuing

Group 3.2.c

[ref] For all other entities, if sensitive authentication data is

Group 3.2.d

[ref] For all other entities, if sensitive authentication data is

Group 3.3

[ref] Mask PAN when displayed (the first

Group 3.3.a

[ref] Examine written policies and procedures for masking the

Group 3.3.b

[ref] Examine system configurations to verify that full PAN is

Group 3.3.c

[ref] Examine displays of PAN (for example, on screen, on

Group 3.4

[ref] Render PAN unreadable anywhere it

Group 3.4.1

[ref] If disk encryption is used (rather

Group 3.4.1.a

[ref] If disk encryption is used, inspect the configuration

Group 3.4.1.b

[ref] Observe processes and interview personnel to verify

Group 3.4.1.c

[ref] Examine the configurations and observe the

Group 3.4.a

[ref] Examine documentation about the system used to protect

Group 3.4.b

[ref] Examine several tables or files from a sample of data

Group 3.4.c

[ref] Examine a sample of removable media (for example,

Group 3.4.d

[ref] Examine a sample of audit logs to confirm that the PAN is

Group 3.4.e

[ref] If

Group 3.5

[ref] Document and implement

Group 3.5.1

[ref] Restrict access to cryptographic

Group 3.5.2

[ref] Store secret and private keys

Group 3.5.2.a

[ref] Examine documented procedures to verify that

Group 3.5.2.b

[ref] Examine system configurations and key storage

Group 3.5.2.c

[ref] Wherever key-encrypting keys are used, examine

Group 3.5.3

[ref] Store cryptographic keys in the

Group 3.6

[ref] Fully document and implement all

Group 3.6.1

[ref] Generation of strong

Group 3.6.1.a

[ref] Verify that key-management procedures specify how

Group 3.6.1.b

[ref] Observe the method for generating keys to verify that

Group 3.6.2

[ref] Secure cryptographic key

Group 3.6.2.a

[ref] Verify that key-management procedures specify how

Group 3.6.2.b

[ref] Observe the method for distributing keys to verify that

Group 3.6.3

[ref] Secure cryptographic key storage

Group 3.6.3.a

[ref] Verify that key-management procedures specify how

Group 3.6.3.b

[ref] Observe the method for storing keys to verify that

Group 3.6.4

[ref] Cryptographic key changes for

Group 3.6.4.a

[ref] Verify that key-management procedures include a

Group 3.6.4.b

[ref] Interview personnel to verify that keys are changed at

Group 3.6.5

[ref] Retirement or replacement (for

Group 3.6.5.a

[ref] Verify that key-management procedures specify

Group 3.6.5.b

[ref] Interview personnel to verify the following processes

Group 3.6.6

[ref] If manual clear-text cryptographic

Group 3.6.6.a

[ref] Verify that manual clear-text key-management

Group 3.6.7

[ref] Prevention of unauthorized

Group 3.6.7.a

[ref] Verify that key-management procedures specify

Group 3.6.7.b

[ref] Interview personnel and/or observe processes to

Group 3.6.8

[ref] Requirement for cryptographic

Group 3.6.8.a

[ref] Verify that key-management procedures specify

Group 3.6.8.b

[ref] Observe documentation or other evidence showing

Group 3.6.b

[ref] Examine the key-management procedures and processes

Group 3.7

[ref] Ensure that security policies and

Group 4. Group contains 13 groups and 1 rule

[ref] Encrypt transmission of cardholder data across open, public networks

Group 4.1 Group contains 8 groups and 1 rule

[ref] Use strong cryptography and security

Group 4.1.1

[ref] Ensure wireless networks transmitting

Group 4.1.a

[ref] Identify all locations where cardholder data is

Group 4.1.b

[ref] Review documented policies and procedures to verify

Group 4.1.c

[ref] Select and observe a sample of inbound and outbound

Group 4.1.d

[ref] Examine keys and certificates to verify that only

Group 4.1.e

[ref] Examine system configurations to verify that the

Group 4.1.f

[ref] Examine system configurations to verify that the proper

Group 4.1.g

[ref] For TLS implementations, examine system

Rule Install libreswan Package [ref]

The Libreswan package provides an implementation of IPsec and IKE, which permits the creation of secure tunnels over untrusted networks. The libreswan package can be installed with the following command:

$ sudo yum install libreswan

Rationale:

Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network.

Severity:

medium

Identifiers and References

Identifiers: CCE-80170-4

References: 12, 15, 3, 5, 8, APO13.01, DSS01.04, DSS05.02, DSS05.03, DSS05.04, CCI-001130, CCI-001131, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, SR 1.13, SR 2.6, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.4, A.11.2.6, A.13.1.1, A.13.2.1, A.14.1.3, A.15.1.1, A.15.2.1, A.6.2.1, A.6.2.2, AC-17, MA-4, SC-9, PR.AC-3, PR.MA-2, PR.PT-4, Req-4.1

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

# Function to install packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
#     package_install aide
#
function package_install {

# Load function arguments into local variables
local package="$1"

# Check sanity of the input
if [ $# -ne "1" ]
then
  echo "Usage: package_install 'package_name'"
  echo "Aborting."
  exit 1
fi

if which dnf ; then
  if ! rpm -q --quiet "$package"; then
    dnf install -y "$package"
  fi
elif which yum ; then
  if ! rpm -q --quiet "$package"; then
    yum install -y "$package"
  fi
elif which apt-get ; then
  apt-get install -y "$package"
else
  echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
  echo "Aborting."
  exit 1
fi

}

package_install libreswan

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Ensure libreswan is installed
  package:
    name: libreswan
    state: present
  tags:
    - package_libreswan_installed
    - medium_severity
    - enable_strategy
    - low_complexity
    - low_disruption
    - CCE-80170-4
    - NIST-800-53-AC-17
    - NIST-800-53-MA-4
    - NIST-800-53-SC-9
    - PCI-DSS-Req-4.1

Remediation Puppet snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

include install_libreswan

class install_libreswan {
  package { 'libreswan':
    ensure => 'installed',
  }
}

Remediation Anaconda snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable


package --add=libreswan

Group 4.2

[ref] Never send unprotected PANs by end-

Group 4.2.a

[ref] If end-user messaging technologies are used to send

Group 4.2.b

[ref] Review written policies to verify the existence of a

Group 4.3

[ref] Ensure that security policies and

Group 5.

[ref] Protect all systems against malware and regularly update anti-virus

Group 5.1

[ref] Deploy anti-virus software on all

Group 5.1.1

[ref] Ensure that anti-virus programs

Group 5.1.2

[ref] For systems considered to be not

Group 5.2

[ref] Ensure that all anti-virus mechanisms

Group 5.2.a

[ref] Examine policies and procedures to verify that anti-virus

Group 5.2.b

[ref] Examine anti-virus configurations, including the master

Group 5.2.c

[ref] Examine a sample of system components, including all

Group 5.2.d

[ref] Examine anti-virus configurations, including the master

Group 5.3

[ref] Ensure that anti-virus mechanisms

Group 5.3.a

[ref] Examine anti-virus configurations, including the master

Group 5.3.b

[ref] Examine anti-virus configurations, including the master

Group 5.3.c

[ref] Interview responsible personnel and observe processes to

Group 5.4

[ref] Ensure that security policies and

Group 6. Group contains 45 groups and 4 rules

[ref] Develop and maintain secure systems and applications

Group 6.1

[ref] Establish a process to identify security

Group 6.1.a

[ref] Examine policies and procedures to verify that

Group 6.1.b

[ref] Interview responsible personnel and observe

Group 6.2 Group contains 2 groups and 4 rules

[ref] Ensure that all system components and

Group 6.2.a

[ref] Examine policies and procedures related to security-

Group 6.2.b

[ref] For a sample of system components and related

Rule Ensure gpgcheck Enabled for All yum Package Repositories [ref]

To ensure signature checking is not disabled for any repos, remove any lines from files in /etc/yum.repos.d of the form:

gpgcheck=0

Rationale:

Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA)."

Severity:

high

Identifiers and References

Identifiers: CCE-26876-3

References: 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), CM-11(a), SI-7, MA-1(b), PR.DS-6, PR.DS-8, PR.IP-1, FAU_GEN.1.1.c, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650

Remediation Shell script: (show)

sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium

#
- name: Find All yum Repositories
  find:
    paths: "/etc/yum.repos.d/"
    patterns: "*.repo"
    contains: ^\[.+]$
  register: yum_find

- name: Ensure gpgcheck Enabled For All yum Package Repositories
  with_items: "{{ yum_find.files }}"
  lineinfile:
    create: yes
    dest: "{{ item.path }}"
    regexp: '^gpgcheck'
    line: 'gpgcheck=1'
  tags:
    - ensure_gpgcheck_never_disabled
    - high_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-26876-3
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11(a)
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1

Rule Ensure Software Patches Installed [ref]

If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or a yum server, run the following command to install updates:

$ sudo yum update

If the system is not configured to use one of these sources, updates (in the form of RPM packages) can be manually downloaded from the Red Hat Network and installed using rpm.

NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy dictates.

Rationale:

Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.

Severity:

high

Identifiers and References

Identifiers: CCE-26895-3

References: RHEL-07-020260, SV-86623r4_rule, 1.8, 18, 20, 4, 5.10.4.1, APO12.01, APO12.02, APO12.03, APO12.04, BAI03.10, DSS05.01, DSS05.02, CCI-000366, 4.2.3, 4.2.3.12, 4.2.3.7, 4.2.3.9, A.12.6.1, A.14.2.3, A.16.1.3, A.18.2.2, A.18.2.3, SI-2, SI-2(c), MA-1(b), ID.RA-1, PR.IP-12, FMT_MOF_EXT.1, Req-6.2, SRG-OS-000480-GPOS-00227, SRG-OS-000480-VMM-002000

Remediation Shell script: (show)

Complexity:	low
Disruption:	high
Reboot:	true
Strategy:	patch

yum -y update

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	high
Reboot:	true
Strategy:	patch

- name: "Security patches are up to date"
  package:
    name: "*"
    state: "latest"
  tags:
    - skip_ansible_lint # [ANSIBLE0010] Skipping lint because ANSIBLE0010 is a bad security practice
    - security_patches_up_to_date
    - high_severity
    - patch_strategy
    - low_complexity
    - high_disruption
    - CCE-26895-3
    - NIST-800-53-SI-2
    - NIST-800-53-SI-2(c)
    - NIST-800-53-MA-1(b)
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-07-020260

Rule Ensure Red Hat GPG Key Installed [ref]

To ensure the system can cryptographically verify base software packages come from Red Hat (and to connect to the Red Hat Network to receive them), the Red Hat GPG key must properly be installed. To install the Red Hat GPG key, run:

$ sudo subscription-manager register

If the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom, use the following command as the root user to import it into the keyring:

$ sudo rpm --import /media/cdrom/RPM-GPG-KEY

Rationale:

Changes to software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. The Red Hat GPG key is necessary to cryptographically verify packages are from Red Hat.

Severity:

high

Identifiers and References

Identifiers: CCE-26957-1

References: 1.2.3, 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), CM-11(a), SI-7, MA-1(b), PR.DS-6, PR.DS-8, PR.IP-1, FAU_GEN.1.1.c, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650

Remediation Shell script: (show)

# The two fingerprints below are retrieved from https://access.redhat.com/security/team/key
readonly REDHAT_RELEASE_2_FINGERPRINT="567E347AD0044ADE55BA8A5F199E2F91FD431D51"
readonly REDHAT_AUXILIARY_FINGERPRINT="43A6E49C4A38F4BE9ABF2A5345689C882FA658E0"
# Location of the key we would like to import (once it's integrity verified)
readonly REDHAT_RELEASE_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"

RPM_GPG_DIR_PERMS=$(stat -c %a "$(dirname "$REDHAT_RELEASE_KEY")")

# Verify /etc/pki/rpm-gpg directory permissions are safe
if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]
then
  # If they are safe, try to obtain fingerprints from the key file
  # (to ensure there won't be e.g. CRC error).
  # Backup IFS value
  IFS_BKP=$IFS

  IFS=$'\n' GPG_OUT=($(gpg --with-fingerprint --with-colons "$REDHAT_RELEASE_KEY" | grep "^fpr" | cut -d ":" -f 10))

  GPG_RESULT=$?
  # Reset IFS back to default
  IFS=$IFS_BKP
  # No CRC error, safe to proceed
  if [ "${GPG_RESULT}" -eq "0" ]
  then
    echo "${GPG_OUT[*]}" | grep -vE "${REDHAT_RELEASE_2_FINGERPRINT}|${REDHAT_AUXILIARY_FINGERPRINT}" || {
      # If $REDHAT_RELEASE_KEY file doesn't contain any keys with unknown fingerprint, import it
      rpm --import "${REDHAT_RELEASE_KEY}"
    }
  fi
fi

Remediation Ansible snippet: (show)

Complexity:	medium
Disruption:	medium
Strategy:	restrict

- name: "Read permission of GPG key directory"
  stat:
    path: /etc/pki/rpm-gpg/
  register: gpg_key_directory_permission
  check_mode: no
  tags:
    - ensure_redhat_gpgkey_installed
    - high_severity
    - restrict_strategy
    - medium_complexity
    - medium_disruption
    - CCE-26957-1
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11(a)
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
  

# It should fail if it doesn't find any fingerprints in file - maybe file was not parsed well.

- name: Read signatures in GPG key
  # According to /usr/share/doc/gnupg2/DETAILS fingerprints are in "fpr" record in field 10
  shell: gpg --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" | grep "^fpr" | cut -d ":" -f 10
  changed_when: False
  register: gpg_fingerprints
  check_mode: no
  tags:
    - ensure_redhat_gpgkey_installed
    - high_severity
    - restrict_strategy
    - medium_complexity
    - medium_disruption
    - CCE-26957-1
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11(a)
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
  

- name: Set Fact - Valid fingerprints
  set_fact:
     gpg_valid_fingerprints: ("567E347AD0044ADE55BA8A5F199E2F91FD431D51" "43A6E49C4A38F4BE9ABF2A5345689C882FA658E0")
  tags:
    - ensure_redhat_gpgkey_installed
    - high_severity
    - restrict_strategy
    - medium_complexity
    - medium_disruption
    - CCE-26957-1
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11(a)
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
  

- name: Import RedHat GPG key
  rpm_key:
    state: present
    key: /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
  when:
    (gpg_key_directory_permission.stat.mode <= '0755')
    and (( gpg_fingerprints.stdout_lines | difference(gpg_valid_fingerprints)) | length == 0)
    and (gpg_fingerprints.stdout_lines | length > 0)
    and (ansible_distribution == "RedHat")
    and True
  tags:
    - ensure_redhat_gpgkey_installed
    - high_severity
    - restrict_strategy
    - medium_complexity
    - medium_disruption
    - CCE-26957-1
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11(a)
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1

Rule Ensure gpgcheck Enabled In Main yum Configuration [ref]

The gpgcheck option controls whether RPM packages' signatures are always checked prior to installation. To configure yum to check package signatures before installing them, ensure the following line appears in /etc/yum.conf in the [main] section:

gpgcheck=1

Rationale:

Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization.
Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA).

Severity:

high

Identifiers and References

Identifiers: CCE-26989-4

References: RHEL-07-020050, SV-86601r2_rule, 1.2.2, 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), CM-11, SI-7, MA-1(b), PR.DS-6, PR.DS-8, PR.IP-1, FAU_GEN.1.1.c, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650

Remediation Shell script: (show)

# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append "/etc/yum.conf" '^gpgcheck' '1' 'CCE-26989-4'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium

- name: Check existence of yum on Fedora
  stat:
    path: /etc/yum.conf
  register: yum_config_file
  check_mode: no
  when: ansible_distribution == "Fedora"

# Old versions of Fedora use yum

- name: Ensure GPG check is globally activated (yum)
  ini_file:
    dest: /etc/yum.conf
    section: main
    option: gpgcheck
    value: 1
    create: False
  when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or yum_config_file.stat.exists) and True
  tags:
    - ensure_gpgcheck_globally_activated
    - high_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-26989-4
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-07-020050

- name: Ensure GPG check is globally activated (dnf)
  ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: gpgcheck
    value: 1
    create: False
  when: ansible_distribution == "Fedora" and True
  tags:
    - ensure_gpgcheck_globally_activated
    - high_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-26989-4
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-11
    - NIST-800-53-SI-7
    - NIST-800-53-MA-1(b)
    - NIST-800-171-3.4.8
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-07-020050

Group 6.3

[ref] Develop internal and external software

Group 6.3.1

[ref] Remove development, test and/or

Group 6.3.2

[ref] Review custom code prior to release

Group 6.3.2.a

[ref] Examine written software-development procedures

Group 6.3.2.b

[ref] Select a sample of recent custom application

Group 6.3.a

[ref] Examine written software-development processes to

Group 6.3.b

[ref] Examine written software-development processes to

Group 6.3.c

[ref] Examine written software-development processes to

Group 6.3.d

[ref] Interview software developers to verify that written

Group 6.4

[ref] Follow change control processes and

Group 6.4.1

[ref] Separate development/test

Group 6.4.1.a

[ref] Examine network documentation and network

Group 6.4.1.b

[ref] Examine access controls settings to verify that

Group 6.4.2

[ref] Separation of duties between

Group 6.4.3

[ref] Production data (live PANs) are not

Group 6.4.3.a

[ref] Observe testing processes and interview

Group 6.4.3.b

[ref] Examine a sample of test data to verify production

Group 6.4.4

[ref] Removal of test data and accounts

Group 6.4.4.a

[ref] Observe testing processes and interview

Group 6.4.4.b

[ref] Examine a sample of data and accounts from

Group 6.4.5

[ref] Change control procedures for the

Group 6.4.5.a

[ref] Examine documented change control procedures

Group 6.4.5.b

[ref] For a sample of system components, interview

Group 6.5

[ref] Address common coding vulnerabilities in

Group 6.5.1

[ref] Injection flaws, particularly SQL

Group 6.5.10

[ref] Broken authentication and session

Group 6.5.2

[ref] Buffer overflows

Group 6.5.3

[ref] Insecure cryptographic storage

Group 6.5.4

[ref] Insecure communications

Group 6.5.5

[ref] Improper error handling

Group 6.5.6

[ref] Examine software-development policies and

Group 6.5.7

[ref] Cross-site scripting (XSS)

Group 6.5.8

[ref] Improper access control (such as

Group 6.5.9

[ref] Cross-site request forgery (CSRF)

Group 6.5.a

[ref] Examine software-development policies and

Group 6.5.b

[ref] Interview a sample of developers to verify that they are

Group 6.5.c

[ref] Examine records of training to verify that software

Group 6.6

[ref] For public-facing web applications,

Group 6.7

[ref] Ensure that security policies and

Group 7. Group contains 12 groups and 2 rules

[ref] Restrict access to cardholder data by business need to know

Group 7.1 Group contains 6 groups and 2 rules

[ref] Limit access to system

Group 7.1.1

[ref] Define access needs for

Group 7.1.2

[ref] Restrict access to privileged

Group 7.1.2.a

[ref] Interview personnel responsible for assigning access to

Group 7.1.2.b

[ref] Select a sample of user IDs with privileged access and

Group 7.1.3

[ref] Assign access based on

Group 7.1.4

[ref] Require documented

Rule Verify /boot/grub2/grub.cfg User Ownership [ref]

The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. To properly set the owner of /boot/grub2/grub.cfg, run the command:

$ sudo chown root /boot/grub2/grub.cfg

Rationale:

Only root should be able to modify important boot parameters.

Severity:

medium

Identifiers and References

Identifiers: CCE-26860-7

References: 1.4.1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000225, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-6(7), PR.AC-4, PR.DS-5, Req-7.1

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chown 0 /boot/grub2/grub.cfg

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: 0
  when: file_exists.stat.exists and (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")
  tags:
    - file_owner_grub2_cfg
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26860-7
    - NIST-800-53-AC-6(7)
    - NIST-800-171-3.4.5
    - PCI-DSS-Req-7.1
    - CJIS-5.5.2.2

Rule Verify /boot/grub2/grub.cfg Group Ownership [ref]

The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. To properly set the group owner of /boot/grub2/grub.cfg, run the command:

$ sudo chgrp root /boot/grub2/grub.cfg

Rationale:

The root group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.

Severity:

medium

Identifiers and References

Identifiers: CCE-26812-8

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chgrp 0 /boot/grub2/grub.cfg

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: 0
  when: file_exists.stat.exists and (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")
  tags:
    - file_groupowner_grub2_cfg
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26812-8
    - NIST-800-53-AC-6(7)
    - NIST-800-171-3.4.5
    - PCI-DSS-Req-7.1
    - CJIS-5.5.2.2

Group 7.2

[ref] Establish an access control

Group 7.2.1

[ref] Coverage of all system

Group 7.2.2

[ref] Assignment of privileges to

Group 7.2.3

[ref]

Group 7.3

[ref] Ensure that security policies and

Group 8. Group contains 56 groups and 31 rules

[ref] Identify and authenticate access to system components

Group 8.1 Group contains 16 groups and 9 rules

[ref] Define and implement policies and

Group 8.1.1 Group contains 1 rule

[ref] Assign all users a unique ID

Rule Ensure All Accounts on the System Have Unique Names [ref]
Change usernames, or delete accounts, so each has a unique name.
Rationale:	Unique usernames allow for accountability on the system.
Severity:	medium
Identifiers and References	Identifiers: CCE-80208-2 References: 5.5.2, CCI-000770, CCI-000804, Req-8.1.1

Group 8.1.2

[ref] Control addition, deletion, and

Group 8.1.3

[ref] Immediately revoke access for

Group 8.1.3.a

[ref] Select a sample of users terminated in the past six

Group 8.1.3.b

[ref] Verify all physical authentication methods

Group 8.1.4 Group contains 1 rule

[ref] Remove/disable inactive user

Rule Set Account Expiration Following Inactivity [ref]

To specify the number of days after a password expires (which signifies inactivity) until an account is permanently disabled, add or correct the following lines in /etc/default/useradd, substituting NUM_DAYS appropriately:

INACTIVE=90

A value of 35 is recommended; however, this profile expects that the value is set to 90. If a password is currently on the verge of expiration, then 35 days remain until the account is automatically disabled. However, if the password will not expire for another 60 days, then 95 days could elapse until the account would be automatically disabled. See the useradd man page for more information. Determining the inactivity timeout must be done with careful consideration of the length of a "normal" period of inactivity for users in the particular environment. Setting the timeout too low incurs support costs and also has the potential to impact availability of the system to legitimate users.

Rationale:

Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.

Severity:

medium

Identifiers and References

Identifiers: CCE-27355-7

References: RHEL-07-010310, SV-86565r2_rule, 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.6.2.1.1, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.6, CCI-000795, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-2(2), AC-2(3), IA-4(e), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, Req-8.1.4, SRG-OS-000118-GPOS-00060

Remediation Shell script: (show)


var_account_disable_post_pw_expiration="90"
# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append '/etc/default/useradd' '^INACTIVE' "$var_account_disable_post_pw_expiration" 'CCE-27355-7' '%s=%s'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str 90
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  lineinfile:
    create: yes
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: "INACTIVE={{ var_account_disable_post_pw_expiration }}"
  tags:
    - account_disable_post_pw_expiration
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27355-7
    - NIST-800-53-AC-2(2)
    - NIST-800-53-AC-2(3)
    - NIST-800-53-IA-4(e)
    - NIST-800-171-3.5.6
    - PCI-DSS-Req-8.1.4
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-07-010310

Group 8.1.5

[ref] Manage IDs used by vendors to

Group 8.1.5.a

[ref] Interview personnel and observe processes for

Group 8.1.5.b

[ref] Interview personnel and observe processes to verify

Group 8.1.6 Group contains 2 groups and 1 rule

[ref] Limit repeated access attempts

Group 8.1.6.a

[ref] For a sample of system components, inspect system

Group 8.1.6.b

[ref]

Rule Set Deny For Failed Password Attempts [ref]

To configure the system to lock out accounts after a number of incorrect login attempts using pam_faillock.so, modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:

add the following line immediately before the pam_unix.so statement in the AUTH section:

auth required pam_faillock.so preauth silent deny=6 unlock_time=1800 fail_interval=900

add the following line immediately after the pam_unix.so statement in the AUTH section:

auth [default=die] pam_faillock.so authfail deny=6 unlock_time=1800 fail_interval=900

add the following line immediately before the pam_unix.so statement in the ACCOUNT section:
```
account required pam_faillock.so
```

Rationale:

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks.

Severity:

medium

Identifiers and References

Identifiers: CCE-27350-8

References: RHEL-07-010320, SV-86567r4_rule, 5.3.2, 1, 12, 15, 16, 5.5.3, DSS05.04, DSS05.10, DSS06.10, 3.1.8, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-7(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.6, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000021-VMM-000050

Remediation Shell script: (show)


var_accounts_passwords_pam_faillock_deny="6"
function include_set_faillock_option {
	:
}

function insert_preauth {
	local pam_file="$1"
	local option="$2"
	local value="$3"
	# is auth required pam_faillock.so preauth present?
	if grep -qE "^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$" "$pam_file" ; then
		# is the option set?
		if grep -qE "^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$option=([0-9]*).*$" "$pam_file" ; then
			# just change the value of option to a correct value
			sed -i --follow-symlinks "s/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\($option *= *\).*/\1\2$value/" "$pam_file"
		# the option is not set.
		else
			# append the option
			sed -i --follow-symlinks "/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ $option=$value/" "$pam_file"
		fi
	# auth required pam_faillock.so preauth is not present, insert the whole line
	else
		sed -i --follow-symlinks "/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent $option=$value" "$pam_file"
	fi
}

function insert_authfail {
	local pam_file="$1"
	local option="$2"
	local value="$3"
	# is auth default pam_faillock.so authfail present?
	if grep -qE "^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$" "$pam_file" ; then
		# is the option set?
		if grep -qE "^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$option=([0-9]*).*$" "$pam_file" ; then
			# just change the value of option to a correct value
			sed -i --follow-symlinks "s/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\($option *= *\).*/\1\2$value/" "$pam_file"
		# the option is not set.
		else
			# append the option
			sed -i --follow-symlinks "/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ $option=$value/" "$pam_file"
		fi
	# auth default pam_faillock.so authfail is not present, insert the whole line
	else
		sed -i --follow-symlinks "/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail $option=$value" "$pam_file"
	fi
}

function insert_account {
	local pam_file="$1"
	if ! grep -qE "^\s*account\s+required\s+pam_faillock\.so.*$" "$pam_file" ; then
		sed -E -i --follow-symlinks "/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so" "$pam_file"
	fi
}

function set_faillock_option {
	local pam_file="$1"
	local option="$2"
	local value="$3"
	insert_preauth "$pam_file" "$option" "$value"
	insert_authfail "$pam_file" "$option" "$value"
	insert_account "$pam_file"
}

include_set_faillock_option

AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pam_file in "${AUTH_FILES[@]}"
do
	set_faillock_option "$pam_file" "deny" "$var_accounts_passwords_pam_faillock_deny"
done

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_passwords_pam_faillock_deny # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_deny: !!str 6
  tags:
    - always

- name: Add auth pam_faillock preauth deny before pam_unix.so
  pamd:
    name: "{{ item }}"
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: 'preauth
        silent
        deny={{ var_accounts_passwords_pam_faillock_deny }}'
    state: before
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_deny
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27350-8
    - NIST-800-53-AC-7(a)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.6
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add deny argument to auth pam_faillock preauth
  pamd:
    name: "{{ item }}"
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: 'preauth
        silent
        deny={{ var_accounts_passwords_pam_faillock_deny }}'
    state: args_present
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_deny
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27350-8
    - NIST-800-53-AC-7(a)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.6
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add auth pam_faillock authfail deny after pam_unix.so
  pamd:
    name: "{{ item }}"
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: 'authfail
        deny={{ var_accounts_passwords_pam_faillock_deny }}'
    state: after
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_deny
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27350-8
    - NIST-800-53-AC-7(a)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.6
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add deny argument to auth pam_faillock authfail
  pamd:
    name: "{{ item }}"
    type: auth
    new_type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: 'authfail
        deny={{ var_accounts_passwords_pam_faillock_deny }}'
    state: args_present
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_deny
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27350-8
    - NIST-800-53-AC-7(a)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.6
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: "{{ item }}"
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_deny
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27350-8
    - NIST-800-53-AC-7(a)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.6
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320

Group 8.1.7 Group contains 1 rule

[ref] Set the lockout duration to a

Rule Set Lockout Time for Failed Password Attempts [ref]

To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using pam_faillock.so, modify the content of both /etc/pam.d/system-auth and /etc/pam.d/password-auth as follows:

add the following line immediately before the pam_unix.so statement in the AUTH section:

auth required pam_faillock.so preauth silent deny=6 unlock_time=1800 fail_interval=900

add the following line immediately after the pam_unix.so statement in the AUTH section:

auth [default=die] pam_faillock.so authfail deny=6 unlock_time=1800 fail_interval=900

add the following line immediately before the pam_unix.so statement in the ACCOUNT section:
```
account required pam_faillock.so
```

Rationale:

Locking out user accounts after a number of incorrect attempts prevents direct password guessing attacks. Ensuring that an administrator is involved in unlocking locked accounts draws appropriate attention to such situations.

Severity:

medium

Identifiers and References

Identifiers: CCE-26884-7

References: RHEL-07-010320, SV-86567r4_rule, 5.3.2, 1, 12, 15, 16, 5.5.3, DSS05.04, DSS05.10, DSS06.10, 3.1.8, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-7(b), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.7, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000329-VMM-001180

Remediation Shell script: (show)


var_accounts_passwords_pam_faillock_unlock_time="1800"
function include_set_faillock_option {
	:
}

function insert_preauth {
	local pam_file="$1"
	local option="$2"
	local value="$3"
	# is auth required pam_faillock.so preauth present?
	if grep -qE "^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$" "$pam_file" ; then
		# is the option set?
		if grep -qE "^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$option=([0-9]*).*$" "$pam_file" ; then
			# just change the value of option to a correct value
			sed -i --follow-symlinks "s/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\($option *= *\).*/\1\2$value/" "$pam_file"
		# the option is not set.
		else
			# append the option
			sed -i --follow-symlinks "/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ $option=$value/" "$pam_file"
		fi
	# auth required pam_faillock.so preauth is not present, insert the whole line
	else
		sed -i --follow-symlinks "/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent $option=$value" "$pam_file"
	fi
}

function insert_authfail {
	local pam_file="$1"
	local option="$2"
	local value="$3"
	# is auth default pam_faillock.so authfail present?
	if grep -qE "^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$" "$pam_file" ; then
		# is the option set?
		if grep -qE "^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$option=([0-9]*).*$" "$pam_file" ; then
			# just change the value of option to a correct value
			sed -i --follow-symlinks "s/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\($option *= *\).*/\1\2$value/" "$pam_file"
		# the option is not set.
		else
			# append the option
			sed -i --follow-symlinks "/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ $option=$value/" "$pam_file"
		fi
	# auth default pam_faillock.so authfail is not present, insert the whole line
	else
		sed -i --follow-symlinks "/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail $option=$value" "$pam_file"
	fi
}

function insert_account {
	local pam_file="$1"
	if ! grep -qE "^\s*account\s+required\s+pam_faillock\.so.*$" "$pam_file" ; then
		sed -E -i --follow-symlinks "/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so" "$pam_file"
	fi
}

function set_faillock_option {
	local pam_file="$1"
	local option="$2"
	local value="$3"
	insert_preauth "$pam_file" "$option" "$value"
	insert_authfail "$pam_file" "$option" "$value"
	insert_account "$pam_file"
}

include_set_faillock_option

AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pam_file in "${AUTH_FILES[@]}"
do
	set_faillock_option "$pam_file" "unlock_time" "$var_accounts_passwords_pam_faillock_unlock_time"
done

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_passwords_pam_faillock_unlock_time # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_unlock_time: !!str 1800
  tags:
    - always

- name: Add auth pam_faillock preauth unlock_time before pam_unix.so
  pamd:
    name: "{{ item }}"
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: 'preauth
        silent
        unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}'
    state: before
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_unlock_time
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-26884-7
    - NIST-800-53-AC-7(b)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.7
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add unlock_time argument to pam_faillock preauth
  pamd:
    name: "{{ item }}"
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: 'preauth
        silent
        unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}'
    state: args_present
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_unlock_time
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-26884-7
    - NIST-800-53-AC-7(b)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.7
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add auth pam_faillock authfail unlock_interval after pam_unix.so
  pamd:
    name: "{{ item }}"
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: 'authfail
        unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}'
    state: after
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_unlock_time
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-26884-7
    - NIST-800-53-AC-7(b)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.7
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add unlock_time argument to auth pam_faillock authfail
  pamd:
    name: "{{ item }}"
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: 'authfail
        unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}'
    state: args_present
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_unlock_time
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-26884-7
    - NIST-800-53-AC-7(b)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.7
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320
  

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: "{{ item }}"
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  tags:
    - accounts_passwords_pam_faillock_unlock_time
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-26884-7
    - NIST-800-53-AC-7(b)
    - NIST-800-171-3.1.8
    - PCI-DSS-Req-8.1.7
    - CJIS-5.5.3
    - DISA-STIG-RHEL-07-010320

Group 8.1.8 Group contains 5 rules

[ref] If a session has been idle for

Rule Set SSH Idle Timeout Interval [ref]

SSH allows administrators to set an idle timeout interval. After this interval has passed, the idle user will be automatically logged out.

To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as follows:

ClientAliveInterval 900

The timeout interval is given in seconds. To have a timeout of 15 minutes, set interval to 900.

If a shorter timeout has already been set for the login shell, that value will preempt any SSH setting made here. Keep in mind that some processes may stop SSH from correctly detecting that the user is idle.

Rationale:

Terminating an idle ssh session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been let unattended.

Severity:

medium

Identifiers and References

Identifiers: CCE-27433-2

References: RHEL-07-040320, SV-86861r4_rule, 5.2.12, 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.5.6, APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.11, CCI-001133, CCI-002361, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-2(5), SA-8(i), AC-12, AC-17(b), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2, Req-8.1.8, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000480-VMM-002000

Remediation Shell script: (show)


sshd_idle_timeout_value="900"
# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append '/etc/ssh/sshd_config' '^ClientAliveInterval' $sshd_idle_timeout_value 'CCE-27433-2' '%s %s'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str 900
  tags:
    - always

- name: Set SSH Idle Timeout Interval
  lineinfile:
    create: yes
    dest: /etc/ssh/sshd_config
    regexp: ^ClientAliveInterval
    line: "ClientAliveInterval {{ sshd_idle_timeout_value }}"
    validate: /usr/sbin/sshd -t -f %s
  #notify: restart sshd
  tags:
    - sshd_set_idle_timeout
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27433-2
    - NIST-800-53-AC-2(5)
    - NIST-800-53-SA-8(i)
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(b)
    - NIST-800-171-3.1.11
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.6
    - DISA-STIG-RHEL-07-040320
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Rule Enable GNOME3 Screensaver Idle Activation [ref]

To activate the screensaver in the GNOME3 desktop after a period of inactivity, add or set idle-activation-enabled to true in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/screensaver]
idle-activation-enabled=true

Once the setting has been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/screensaver/idle-activation-enabled

After the settings have been set, run dconf update.

Warning: When selecting this rule in a profile, make sure that rule with ID dconf_use_text_backend is selected as well: dconf-related rules can't be checked by OVAL if dconf is using a binary database as it's data backend. dconf has to be forced to use config files directly as backend, as those config files are checked by OVAL probes.

Rationale:

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the session lock.

Enabling idle activation of the screensaver ensures the screensaver will be activated after the idle delay. Applications requiring continuous, real-time screen display (such as network management products) require the login session does not have administrator rights and the display station is located in a controlled-access area.

Severity:

medium

Identifiers and References

Identifiers: CCE-80111-8

References: RHEL-07-010100, SV-86523r4_rule, 1, 12, 15, 16, 5.5.5, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-11(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8, SRG-OS-000029-GPOS-00010

Remediation Shell script: (show)

function include_dconf_settings {
	:
}

# Function to configure DConf settings for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_settings 'org/gnome/login-screen' 'banner-message-enable' 'true' 'local.d' '10-banner'
#
function dconf_settings {
	local _path=$1 _key=$2 _value=$3 _db=$4 _settingFile=$5

	# Check sanity of the input
	if [ $# -ne "5" ]
	then
		echo "Usage: dconf_settings 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_settingsfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	SETTINGSFILES=($(grep -r "\[${_path}]" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1))
	DCONFFILE="/etc/dconf/db/${_db}/${_settingFile}"
	DBDIR="/etc/dconf/db/${_db}"

	mkdir -p "${DBDIR}"

	if [[ -z "${SETTINGSFILES[@]}" ]]
	then
		[ ! -z ${DCONFFILE} ] || $(echo "" >> ${DCONFFILE})
		echo "[${_path}]" >> ${DCONFFILE}
		echo "${_key}=${_value}" >> ${DCONFFILE}
	else
		if grep -q "^(?!#)${_key}" ${SETTINGSFILES[@]}
		then
			sed -i "s/${_key}\s*=\s*.*/${_key}=${_value}/g" ${SETTINGSFILES[@]}
		else
			sed -i "\|\[${_path}]|a\\${_key}=${_value}" ${SETTINGSFILES[@]}
		fi
	fi

	dconf update
}

# Function to configure DConf locks for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_lock 'org/gnome/login-screen' 'banner-message-enable' 'local.d' 'banner'
#
function dconf_lock {
	local _key=$1 _setting=$2 _db=$3 _lockFile=$4

	# Check sanity of the input
	if [ $# -ne "4" ]
	then
		echo "Usage: dconf_lock 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_lockfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	LOCKFILES=$(grep -r "^/${_key}/${_setting}$" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1)
	LOCKSFOLDER="/etc/dconf/db/${_db}/locks"

	mkdir -p "${LOCKSFOLDER}"

	if [[ -z "${LOCKFILES}" ]]
	then
		echo "/${_key}/${_setting}" >> "/etc/dconf/db/${_db}/locks/${_lockFile}"
	fi
}


include_dconf_settings

dconf_settings 'org/gnome/desktop/screensaver' 'idle-activation-enabled' 'true' 'local.d' '00-security-settings'
dconf_lock 'org/gnome/desktop/screensaver' 'idle-activation-enabled' 'local.d' '00-security-settings-lock'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium

- name: "Enable GNOME3 Screensaver Idle Activation"
  ini_file:
    dest: "/etc/dconf/db/local.d/00-security-settings"
    section: "org/gnome/desktop/screensaver"
    option: idle_activation_enabled
    value: "true"
    create: yes
  tags:
    - dconf_gnome_screensaver_idle_activation_enabled
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80111-8
    - NIST-800-53-AC-11(a)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
    - DISA-STIG-RHEL-07-010100
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

- name: "Prevent user modification of GNOME idle_activation_enabled"
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: '^/org/gnome/desktop/screensaver/idle-activation-enabled'
    line: '/org/gnome/desktop/screensaver/idle-activation-enabled'
    create: yes
  tags:
    - dconf_gnome_screensaver_idle_activation_enabled
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80111-8
    - NIST-800-53-AC-11(a)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
    - DISA-STIG-RHEL-07-010100
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Rule Implement Blank Screensaver [ref]

To set the screensaver mode in the GNOME3 desktop to a blank screen, add or set picture-uri to string '' in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/screensaver]
picture-uri=''

Once the settings have been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/screensaver/picture-uri

After the settings have been set, run dconf update.

Rationale:

Setting the screensaver mode to blank-only conceals the contents of the display from passersby.

Severity:

medium

Identifiers and References

Identifiers: CCE-80113-4

References: 1, 12, 15, 16, 5.5.5, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000060, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-11(b), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8

Remediation Shell script: (show)

function include_dconf_settings {
	:
}

# Function to configure DConf settings for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_settings 'org/gnome/login-screen' 'banner-message-enable' 'true' 'local.d' '10-banner'
#
function dconf_settings {
	local _path=$1 _key=$2 _value=$3 _db=$4 _settingFile=$5

	# Check sanity of the input
	if [ $# -ne "5" ]
	then
		echo "Usage: dconf_settings 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_settingsfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	SETTINGSFILES=($(grep -r "\[${_path}]" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1))
	DCONFFILE="/etc/dconf/db/${_db}/${_settingFile}"
	DBDIR="/etc/dconf/db/${_db}"

	mkdir -p "${DBDIR}"

	if [[ -z "${SETTINGSFILES[@]}" ]]
	then
		[ ! -z ${DCONFFILE} ] || $(echo "" >> ${DCONFFILE})
		echo "[${_path}]" >> ${DCONFFILE}
		echo "${_key}=${_value}" >> ${DCONFFILE}
	else
		if grep -q "^(?!#)${_key}" ${SETTINGSFILES[@]}
		then
			sed -i "s/${_key}\s*=\s*.*/${_key}=${_value}/g" ${SETTINGSFILES[@]}
		else
			sed -i "\|\[${_path}]|a\\${_key}=${_value}" ${SETTINGSFILES[@]}
		fi
	fi

	dconf update
}

# Function to configure DConf locks for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_lock 'org/gnome/login-screen' 'banner-message-enable' 'local.d' 'banner'
#
function dconf_lock {
	local _key=$1 _setting=$2 _db=$3 _lockFile=$4

	# Check sanity of the input
	if [ $# -ne "4" ]
	then
		echo "Usage: dconf_lock 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_lockfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	LOCKFILES=$(grep -r "^/${_key}/${_setting}$" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1)
	LOCKSFOLDER="/etc/dconf/db/${_db}/locks"

	mkdir -p "${LOCKSFOLDER}"

	if [[ -z "${LOCKFILES}" ]]
	then
		echo "/${_key}/${_setting}" >> "/etc/dconf/db/${_db}/locks/${_lockFile}"
	fi
}


include_dconf_settings

dconf_settings 'org/gnome/desktop/screensaver' 'picture-uri' "string ''" 'local.d' '00-security-settings'
dconf_lock 'org/gnome/desktop/screensaver' 'picture-uri' 'local.d' '00-security-settings-lock'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium

- name: "Implement Blank Screensaver"
  ini_file:
    dest: "/etc/dconf/db/local.d/00-security-settings"
    section: "org/gnome/desktop/screensaver"
    option: picture-uri
    value: string ''
    create: yes
  tags:
    - dconf_gnome_screensaver_mode_blank
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80113-4
    - NIST-800-53-AC-11(b)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

- name: "Prevent user modification of GNOME picture-uri"
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: '^/org/gnome/desktop/screensaver/picture-uri'
    line: '/org/gnome/desktop/screensaver/picture-uri'
    create: yes
  tags:
    - dconf_gnome_screensaver_mode_blank
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80113-4
    - NIST-800-53-AC-11(b)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Rule Set GNOME3 Screensaver Inactivity Timeout [ref]

The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/local.d directory and locked in /etc/dconf/db/local.d/locks directory to prevent user modification.

For example, to configure the system for a 15 minute delay, add the following to /etc/dconf/db/local.d/00-security-settings:

[org/gnome/desktop/session]
idle-delay=uint32 900

Once the setting has been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/session/idle-delay

After the settings have been set, run dconf update.

Rationale:

Severity:

medium

Identifiers and References

Identifiers: CCE-80110-0

References: RHEL-07-010070, SV-86517r5_rule, 1, 12, 15, 16, 5.5.5, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-11(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8, SRG-OS-000029-GPOS-00010

Remediation Shell script: (show)


inactivity_timeout_value="900"
function include_dconf_settings {
	:
}

# Function to configure DConf settings for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_settings 'org/gnome/login-screen' 'banner-message-enable' 'true' 'local.d' '10-banner'
#
function dconf_settings {
	local _path=$1 _key=$2 _value=$3 _db=$4 _settingFile=$5

	# Check sanity of the input
	if [ $# -ne "5" ]
	then
		echo "Usage: dconf_settings 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_settingsfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	SETTINGSFILES=($(grep -r "\[${_path}]" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1))
	DCONFFILE="/etc/dconf/db/${_db}/${_settingFile}"
	DBDIR="/etc/dconf/db/${_db}"

	mkdir -p "${DBDIR}"

	if [[ -z "${SETTINGSFILES[@]}" ]]
	then
		[ ! -z ${DCONFFILE} ] || $(echo "" >> ${DCONFFILE})
		echo "[${_path}]" >> ${DCONFFILE}
		echo "${_key}=${_value}" >> ${DCONFFILE}
	else
		if grep -q "^(?!#)${_key}" ${SETTINGSFILES[@]}
		then
			sed -i "s/${_key}\s*=\s*.*/${_key}=${_value}/g" ${SETTINGSFILES[@]}
		else
			sed -i "\|\[${_path}]|a\\${_key}=${_value}" ${SETTINGSFILES[@]}
		fi
	fi

	dconf update
}

# Function to configure DConf locks for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_lock 'org/gnome/login-screen' 'banner-message-enable' 'local.d' 'banner'
#
function dconf_lock {
	local _key=$1 _setting=$2 _db=$3 _lockFile=$4

	# Check sanity of the input
	if [ $# -ne "4" ]
	then
		echo "Usage: dconf_lock 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_lockfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	LOCKFILES=$(grep -r "^/${_key}/${_setting}$" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1)
	LOCKSFOLDER="/etc/dconf/db/${_db}/locks"

	mkdir -p "${LOCKSFOLDER}"

	if [[ -z "${LOCKFILES}" ]]
	then
		echo "/${_key}/${_setting}" >> "/etc/dconf/db/${_db}/locks/${_lockFile}"
	fi
}


include_dconf_settings

dconf_settings 'org/gnome/desktop/session' 'idle-delay' "uint32 ${inactivity_timeout_value}" 'local.d' '00-security-settings'
dconf_lock 'org/gnome/desktop/session' 'idle-delay' 'local.d' '00-security-settings-lock'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium

- name: XCCDF Value inactivity_timeout_value # promote to variable
  set_fact:
    inactivity_timeout_value: !!str 900
  tags:
    - always

- name: "Set GNOME3 Screensaver Inactivity Timeout"
  ini_file:
    dest: "/etc/dconf/db/local.d/00-security-settings"
    section: "org/gnome/desktop/screensaver"
    option: idle-delay
    value: "{{ inactivity_timeout_value }}"
    create: yes
  tags:
    - dconf_gnome_screensaver_idle_delay
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80110-0
    - NIST-800-53-AC-11(a)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
    - DISA-STIG-RHEL-07-010070
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

- name: "Prevent user modification of GNOME idle-delay"
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: '^/org/gnome/desktop/screensaver/idle-delay'
    line: '/org/gnome/desktop/screensaver/idle-delay'
    create: yes
  tags:
    - dconf_gnome_screensaver_idle_delay
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80110-0
    - NIST-800-53-AC-11(a)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
    - DISA-STIG-RHEL-07-010070
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Rule Enable GNOME3 Screensaver Lock After Idle Period [ref]

To activate locking of the screensaver in the GNOME3 desktop when it is activated, add or set lock-enabled to true in /etc/dconf/db/local.d/00-security-settings. For example:

[org/gnome/desktop/screensaver]
lock-enabled=true

Once the settings have been added, add a lock to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example:

/org/gnome/desktop/screensaver/lock-enabled

After the settings have been set, run dconf update.

Rationale:

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to logout because of the temporary nature of the absense.

Severity:

medium

Identifiers and References

Identifiers: CCE-80112-6

References: RHEL-07-010060, SV-86515r5_rule, 1, 12, 15, 16, 5.5.5, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000056, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-11(b), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8, SRG-OS-000028-GPOS-00009, OS-SRG-000030-GPOS-00011

Remediation Shell script: (show)

function include_dconf_settings {
	:
}

# Function to configure DConf settings for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_settings 'org/gnome/login-screen' 'banner-message-enable' 'true' 'local.d' '10-banner'
#
function dconf_settings {
	local _path=$1 _key=$2 _value=$3 _db=$4 _settingFile=$5

	# Check sanity of the input
	if [ $# -ne "5" ]
	then
		echo "Usage: dconf_settings 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_settingsfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	SETTINGSFILES=($(grep -r "\[${_path}]" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1))
	DCONFFILE="/etc/dconf/db/${_db}/${_settingFile}"
	DBDIR="/etc/dconf/db/${_db}"

	mkdir -p "${DBDIR}"

	if [[ -z "${SETTINGSFILES[@]}" ]]
	then
		[ ! -z ${DCONFFILE} ] || $(echo "" >> ${DCONFFILE})
		echo "[${_path}]" >> ${DCONFFILE}
		echo "${_key}=${_value}" >> ${DCONFFILE}
	else
		if grep -q "^(?!#)${_key}" ${SETTINGSFILES[@]}
		then
			sed -i "s/${_key}\s*=\s*.*/${_key}=${_value}/g" ${SETTINGSFILES[@]}
		else
			sed -i "\|\[${_path}]|a\\${_key}=${_value}" ${SETTINGSFILES[@]}
		fi
	fi

	dconf update
}

# Function to configure DConf locks for RHEL and Fedora systems.
#
# Example Call(s):
#
#     dconf_lock 'org/gnome/login-screen' 'banner-message-enable' 'local.d' 'banner'
#
function dconf_lock {
	local _key=$1 _setting=$2 _db=$3 _lockFile=$4

	# Check sanity of the input
	if [ $# -ne "4" ]
	then
		echo "Usage: dconf_lock 'dconf_path' 'dconf_setting' 'dconf_db' 'dconf_lockfile'"
		echo "Aborting."
		exit 1
	fi

	# Check for setting in any of the DConf db directories
	LOCKFILES=$(grep -r "^/${_key}/${_setting}$" "/etc/dconf/db/" | grep -v "distro\|ibus" | cut -d":" -f1)
	LOCKSFOLDER="/etc/dconf/db/${_db}/locks"

	mkdir -p "${LOCKSFOLDER}"

	if [[ -z "${LOCKFILES}" ]]
	then
		echo "/${_key}/${_setting}" >> "/etc/dconf/db/${_db}/locks/${_lockFile}"
	fi
}


include_dconf_settings

dconf_settings 'org/gnome/desktop/screensaver' 'lock-enabled' 'true' 'local.d' '00-security-settings'
dconf_lock 'org/gnome/desktop/screensaver' 'lock-enabled' 'local.d' '00-security-settings-lock'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium

- name: "Enable GNOME3 Screensaver Lock After Idle Period"
  ini_file:
    dest: "/etc/dconf/db/local.d/00-security-settings"
    section: "org/gnome/desktop/screensaver"
    option: lock-enabled
    value: "true"
    create: yes
  tags:
    - dconf_gnome_screensaver_lock_enabled
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80112-6
    - NIST-800-53-AC-11(b)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
    - DISA-STIG-RHEL-07-010060
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

- name: "Prevent user modification of GNOME lock-enabled"
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: '^/org/gnome/desktop/screensaver/lock-enabled'
    line: '/org/gnome/desktop/screensaver/lock-enabled'
    create: yes
  tags:
    - dconf_gnome_screensaver_lock_enabled
    - medium_severity
    - unknown_strategy
    - low_complexity
    - medium_disruption
    - CCE-80112-6
    - NIST-800-53-AC-11(b)
    - NIST-800-171-3.1.10
    - PCI-DSS-Req-8.1.8
    - CJIS-5.5.5
    - DISA-STIG-RHEL-07-010060
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Group 8.1.a

[ref] Review procedures and confirm they define processes for

Group 8.1.b

[ref] Verify that procedures are implemented for user

Group 8.2 Group contains 16 groups and 11 rules

[ref] In addition to assigning a unique ID,

Group 8.2.1 Group contains 4 groups and 4 rules

[ref] Using strong cryptography,

Group 8.2.1.a

[ref] Examine vendor documentation and system

Group 8.2.1.b

[ref] For a sample of system components, examine

Group 8.2.1.c

[ref] For a sample of system components, examine data

Group 8.2.1.d

[ref]

Rule Set Password Hashing Algorithm in /etc/login.defs [ref]

In /etc/login.defs, add or correct the following line to ensure the system will use SHA-512 as the hashing algorithm:

ENCRYPT_METHOD SHA512

Rationale:

Severity:

medium

Identifiers and References

Identifiers: CCE-27124-7

References: RHEL-07-010210, SV-86545r2_rule, 6.3.1, 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, CCI-000196, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(b), IA-5(c), IA-5(1)(c), IA-7, PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041

Remediation Shell script: (show)

if grep --silent ^ENCRYPT_METHOD /etc/login.defs ; then
	sed -i 's/^ENCRYPT_METHOD.*/ENCRYPT_METHOD SHA512/g' /etc/login.defs
else
	echo "" >> /etc/login.defs
	echo "ENCRYPT_METHOD SHA512" >> /etc/login.defs
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Set Password Hashing Algorithm in /etc/login.defs
  lineinfile:
      dest: /etc/login.defs
      regexp: ^#?ENCRYPT_METHOD
      line: ENCRYPT_METHOD SHA512
      state: present
  tags:
    - set_password_hashing_algorithm_logindefs
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27124-7
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-7
    - NIST-800-171-3.13.11
    - PCI-DSS-Req-8.2.1
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-07-010210

Rule Set Password Hashing Algorithm in /etc/libuser.conf [ref]

In /etc/libuser.conf, add or correct the following line in its [defaults] section to ensure the system will use the SHA-512 algorithm for password hashing:

crypt_style = sha512

Rationale:

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kepy in plain text.

This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the crypt_style configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.

Severity:

medium

Identifiers and References

Identifiers: CCE-27053-8

References: RHEL-07-010220, SV-86547r3_rule, 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, CCI-000196, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(b), IA-5(c), IA-5(1)(c), IA-7, PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041, SRG-OS-000480-VMM-002000

Remediation Shell script: (show)


LIBUSER_CONF="/etc/libuser.conf"
CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*'

# Try find crypt_style in [defaults] section. If it is here, then change algorithm to sha512.
# If it isn't here, then add it to [defaults] section.
if grep -qzosP $CRYPT_STYLE_REGEX $LIBUSER_CONF ; then
        sed -i "s/\(crypt_style[[:space:]]*=[[:space:]]*\).*/\1sha512/g" $LIBUSER_CONF
elif grep -qs "\[defaults]" $LIBUSER_CONF ; then
        sed -i "/[[:space:]]*\[defaults]/a crypt_style = sha512" $LIBUSER_CONF
else
        echo -e "[defaults]\ncrypt_style = sha512" >> $LIBUSER_CONF
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: Set Password Hashing Algorithm in /etc/libuser.conf
  lineinfile:
    dest: /etc/libuser.conf
    insertafter: '^\s*\[defaults]'
    regexp: ^#?crypt_style
    line: crypt_style = sha512
    state: present
  tags:
    - set_password_hashing_algorithm_libuserconf
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27053-8
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-7
    - NIST-800-171-3.13.11
    - PCI-DSS-Req-8.2.1
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-07-010220

Rule Set PAM's Password Hashing Algorithm [ref]
The PAM system service can be configured to only store encrypted representations of passwords. In `/etc/pam.d/system-auth`, the `password` section of the file controls which PAM modules execute during a password change. Set the `pam_unix.so` module in the `password` section to include the argument `sha512`, as shown below: password sufficient pam_unix.so sha512 other arguments... This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default.
Rationale:	Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm are no more protected than if they are kepy in plain text. This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the `crypt_style` configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
Severity:	medium
Identifiers and References	Identifiers: CCE-27104-9 References: RHEL-07-010200, SV-86543r3_rule, 6.3.1, 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, CCI-000196, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(b), IA-5(c), IA-5(1)(c), IA-7, PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041, SRG-OS-000480-VMM-002000
Remediation Shell script: (show) `AUTH_FILES[0]="/etc/pam.d/system-auth" AUTH_FILES[1]="/etc/pam.d/password-auth" for pamFile in "${AUTH_FILES[@]}" do if ! grep -q "^password.sufficient.pam_unix.so.sha512" $pamFile; then sed -i --follow-symlinks "/^password.sufficient.*pam_unix.so/ s/$/ sha512/" $pamFile fi done`

Rule Verify All Account Password Hashes are Shadowed [ref]
If any password hashes are stored in `/etc/passwd` (in the second field, instead of an `x` or `*`), the cause of this misconfiguration should be investigated. The account should have its password reset and the hash should be properly stored, or the account should be deleted entirely.
Rationale:	The hashes for all user account passwords should be stored in the file `/etc/shadow` and never in `/etc/passwd`, which is readable by all users.
Severity:	medium
Identifiers and References	Identifiers: CCE-27352-4 References: 1, 12, 15, 16, 5, 5.5.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.10, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(h), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1

Group 8.2.2

[ref] Verify user identity before

Group 8.2.3 Group contains 2 groups and 5 rules

[ref] Passwords/phrases must meet

Group 8.2.3.a

[ref] For a sample of system components, inspect system

Group 8.2.3.b

[ref]

Rule Set Password Minimum Length [ref]

The pam_pwquality module's minlen parameter controls requirements for minimum characters required in a password. Add minlen=7 after pam_pwquality to set minimum password length requirements.

Rationale:

The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromose the password.

Severity:

medium

Identifiers and References

Identifiers: CCE-27293-0

References: RHEL-07-010280, SV-86559r2_rule, 6.3.2, 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000205, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(1)(a), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000078-GPOS-00046, SRG-OS-000072-VMM-000390, SRG-OS-000078-VMM-000450

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict


var_password_pam_minlen="7"
# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append '/etc/security/pwquality.conf' '^minlen' $var_password_pam_minlen 'CCE-27293-0' '%s = %s'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str 7
  tags:
    - always

- name: Ensure PAM variable minlen is set accordingly

  lineinfile:
    create: yes
    dest: "/etc/security/pwquality.conf"
    regexp: '^#?\s*minlen'
    line: "minlen = {{ var_password_pam_minlen }}"

  tags:
    - accounts_password_pam_minlen
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27293-0
    - NIST-800-53-IA-5(1)(a)
    - PCI-DSS-Req-8.2.3
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-07-010280

Rule Set Password Strength Minimum Digit Characters [ref]

The pam_pwquality module's dcredit parameter controls requirements for usage of digits in a password. When set to a negative number, any password will be required to contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional length credit for each digit. Modify the dcredit setting in /etc/security/pwquality.conf to require the use of a digit in passwords.

Rationale:

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring digits makes password guessing attacks more difficult by ensuring a larger search space.

Severity:

medium

Identifiers and References

Identifiers: CCE-27214-6

References: RHEL-07-010140, SV-86531r3_rule, 6.3.2, 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000194, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(1)(a), IA-5(b), IA-5(c), 194, PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000071-GPOS-00039, SRG-OS-000071-VMM-000380

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict


var_password_pam_dcredit="-1"
# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append '/etc/security/pwquality.conf' '^dcredit' $var_password_pam_dcredit 'CCE-27214-6' '%s = %s'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_password_pam_dcredit # promote to variable
  set_fact:
    var_password_pam_dcredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable dcredit is set accordingly

  lineinfile:
    create: yes
    dest: "/etc/security/pwquality.conf"
    regexp: '^#?\s*dcredit'
    line: "dcredit = {{ var_password_pam_dcredit }}"

  tags:
    - accounts_password_pam_dcredit
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27214-6
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-194
    - PCI-DSS-Req-8.2.3
    - DISA-STIG-RHEL-07-010140

Rule Set Password Strength Minimum Lowercase Characters [ref]

The pam_pwquality module's lcredit parameter controls requirements for usage of lowercase letters in a password. When set to a negative number, any password will be required to contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each lowercase character. Modify the lcredit setting in /etc/security/pwquality.conf to require the use of a lowercase character in passwords.

Rationale:

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possble combinations that need to be tested before the password is compromised. Requiring a minimum number of lowercase characters makes password guessing attacks more difficult by ensuring a larger search space.

Severity:

medium

Identifiers and References

Identifiers: CCE-27345-8

References: RHEL-07-010130, SV-86529r5_rule, 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000193, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(b), IA-5(c), IA-5(1)(a), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000070-GPOS-00038, SRG-OS-000070-VMM-000370

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict


var_password_pam_lcredit="-1"
# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append '/etc/security/pwquality.conf' '^lcredit' $var_password_pam_lcredit 'CCE-27345-8' '%s = %s'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_password_pam_lcredit # promote to variable
  set_fact:
    var_password_pam_lcredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable lcredit is set accordingly

  lineinfile:
    create: yes
    dest: "/etc/security/pwquality.conf"
    regexp: '^#?\s*lcredit'
    line: "lcredit = {{ var_password_pam_lcredit }}"

  tags:
    - accounts_password_pam_lcredit
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27345-8
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-IA-5(1)(a)
    - PCI-DSS-Req-8.2.3
    - DISA-STIG-RHEL-07-010130

Rule Set Password Strength Minimum Uppercase Characters [ref]

The pam_pwquality module's ucredit= parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each uppercase character. Modify the ucredit setting in /etc/security/pwquality.conf to require the use of an uppercase character in passwords.

Rationale:

Use of a complex password helps to increase the time and resources reuiqred to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.

Severity:

medium

Identifiers and References

Identifiers: CCE-27200-5

References: RHEL-07-010120, SV-86527r3_rule, 6.3.2, 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000192, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(b), IA-5(c), IA-5(1)(a), PR.AC-1, PR.AC-6, PR.AC-7, FMT_MOF_EXT.1, Req-8.2.3, SRG-OS-000069-GPOS-00037, SRG-OS-000069-VMM-000360

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict


var_password_pam_ucredit="-1"
# Function to replace configuration setting in config file or add the configuration setting if
# it does not exist.
#
# Expects arguments:
#
# config_file:		Configuration file that will be modified
# key:			Configuration option to change
# value:		Value of the configuration option to change
# cce:			The CCE identifier or '@CCENUM@' if no CCE identifier exists
# format:		The printf-like format string that will be given stripped key and value as arguments,
#			so e.g. '%s=%s' will result in key=value subsitution (i.e. without spaces around =)
#
# Optional arugments:
#
# format:		Optional argument to specify the format of how key/value should be
# 			modified/appended in the configuration file. The default is key = value.
#
# Example Call(s):
#
#     With default format of 'key = value':
#     replace_or_append '/etc/sysctl.conf' '^kernel.randomize_va_space' '2' '@CCENUM@'
#
#     With custom key/value format:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' 'disabled' '@CCENUM@' '%s=%s'
#
#     With a variable:
#     replace_or_append '/etc/sysconfig/selinux' '^SELINUX=' $var_selinux_state '@CCENUM@' '%s=%s'
#
function replace_or_append {
  local default_format='%s = %s' case_insensitive_mode=yes sed_case_insensitive_option='' grep_case_insensitive_option=''
  local config_file=$1
  local key=$2
  local value=$3
  local cce=$4
  local format=$5

  if [ "$case_insensitive_mode" = yes ]; then
    sed_case_insensitive_option="i"
    grep_case_insensitive_option="-i"
  fi
  [ -n "$format" ] || format="$default_format"
  # Check sanity of the input
  [ $# -ge "3" ] || { echo "Usage: replace_or_append <config_file_location> <key_to_search> <new_value> [<CCE number or literal '@CCENUM@' if unknown>] [printf-like format, default is '$default_format']" >&2; exit 1; }

  # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
  # Otherwise, regular sed command will do.
  sed_command=('sed' '-i')
  if test -L "$config_file"; then
    sed_command+=('--follow-symlinks')
  fi

  # Test that the cce arg is not empty or does not equal @CCENUM@.
  # If @CCENUM@ exists, it means that there is no CCE assigned.
  if [ -n "$cce" ] && [ "$cce" != '@CCENUM@' ]; then
    cce="CCE-${cce}"
  else
    cce="CCE"
  fi

  # Strip any search characters in the key arg so that the key can be replaced without
  # adding any search characters to the config file.
  stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "$key")

  # shellcheck disable=SC2059
  printf -v formatted_output "$format" "$stripped_key" "$value"

  # If the key exists, change it. Otherwise, add it to the config_file.
  # We search for the key string followed by a word boundary (matched by \>),
  # so if we search for 'setting', 'setting2' won't match.
  if LC_ALL=C grep -q -m 1 $grep_case_insensitive_option -e "${key}\\>" "$config_file"; then
    "${sed_command[@]}" "s/${key}\\>.*/$formatted_output/g$sed_case_insensitive_option" "$config_file"
  else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$config_file" >> "$config_file"
    printf '%s\n' "$formatted_output" >> "$config_file"
  fi
}

replace_or_append '/etc/security/pwquality.conf' '^ucredit' $var_password_pam_ucredit 'CCE-27200-5' '%s = %s'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_password_pam_ucredit # promote to variable
  set_fact:
    var_password_pam_ucredit: !!str -1
  tags:
    - always

- name: Ensure PAM variable ucredit is set accordingly

  lineinfile:
    create: yes
    dest: "/etc/security/pwquality.conf"
    regexp: '^#?\s*ucredit'
    line: "ucredit = {{ var_password_pam_ucredit }}"

  tags:
    - accounts_password_pam_ucredit
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27200-5
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-IA-5(1)(a)
    - PCI-DSS-Req-8.2.3
    - DISA-STIG-RHEL-07-010120

Rule Prevent Login to Accounts With Empty Password [ref]

If an account is configured for password authentication but does not have an assigned password, it may be possible to log into the account without authentication. Remove any instances of the nullok option in /etc/pam.d/system-auth to prevent logins with empty passwords.

Rationale:

If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.

Severity:

high

Identifiers and References

Identifiers: CCE-27286-4

References: RHEL-07-010290, SV-86561r3_rule, 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-6, IA-5(b), IA-5(c), IA-5(1)(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_AFL.1, Req-8.2.3, SRG-OS-000480-GPOS-00227

Remediation Shell script: (show)

sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/system-auth
sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/password-auth

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Strategy:	configure

- name: "Prevent Log In to Accounts With Empty Password - system-auth"
  replace:
    dest: /etc/pam.d/system-auth
    follow: yes
    regexp: 'nullok'
  tags:
    - no_empty_passwords
    - high_severity
    - configure_strategy
    - low_complexity
    - medium_disruption
    - CCE-27286-4
    - NIST-800-53-AC-6
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - PCI-DSS-Req-8.2.3
    - CJIS-5.5.2
    - DISA-STIG-RHEL-07-010290
  

- name: "Prevent Log In to Accounts With Empty Password - password-auth"
  replace:
    dest: /etc/pam.d/password-auth
    follow: yes
    regexp: 'nullok'
  tags:
    - no_empty_passwords
    - high_severity
    - configure_strategy
    - low_complexity
    - medium_disruption
    - CCE-27286-4
    - NIST-800-53-AC-6
    - NIST-800-53-IA-5(b)
    - NIST-800-53-IA-5(c)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - PCI-DSS-Req-8.2.3
    - CJIS-5.5.2
    - DISA-STIG-RHEL-07-010290

Group 8.2.4 Group contains 2 groups and 1 rule

[ref] Change user

Group 8.2.4.a

[ref] For a sample of system components, inspect system

Group 8.2.4.b

[ref]

Rule Set Password Maximum Age [ref]

To specify password maximum age for new accounts, edit the file /etc/login.defs and add or correct the following line:

PASS_MAX_DAYS 90

A value of 180 days is sufficient for many environments. The DoD requirement is 60. The profile requirement is 90.

Rationale:

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.

Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise.

Severity:

medium

Identifiers and References

Identifiers: CCE-27051-2

References: RHEL-07-010250, SV-86553r2_rule, 5.4.1.1, 1, 12, 15, 16, 5, 5.6.2.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.6, CCI-000199, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(g), IA-5(1)(d), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.4, SRG-OS-000076-GPOS-00044

Remediation Shell script: (show)


var_accounts_maximum_age_login_defs="90"

grep -q ^PASS_MAX_DAYS /etc/login.defs && \
  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" >> /etc/login.defs
fi

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict

- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str 90
  tags:
    - always

- name: Set Password Maximum Age
  lineinfile:
    create: yes
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: "PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}"
  tags:
    - accounts_maximum_age_login_defs
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27051-2
    - NIST-800-53-IA-5(f)
    - NIST-800-53-IA-5(g)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-171-3.5.6
    - PCI-DSS-Req-8.2.4
    - CJIS-5.6.2.1
    - DISA-STIG-RHEL-07-010250

Group 8.2.5 Group contains 2 groups and 1 rule

[ref] Do not allow an individual to

Group 8.2.5.a

[ref] For a sample of system components, obtain and

Group 8.2.5.b

[ref]

Rule Limit Password Reuse [ref]

Do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_unix or pam_pwhistory PAM modules.

In the file /etc/pam.d/system-auth, append remember=4 to the line which refers to the pam_unix.so or pam_pwhistory.somodule, as shown below:

for the pam_unix.so case:

password sufficient pam_unix.so ...existing_options... remember=4

for the pam_pwhistory.so case:

password requisite pam_pwhistory.so ...existing_options... remember=4

The DoD STIG requirement is 5 passwords.

Rationale:

Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.

Severity:

medium

Identifiers and References

Identifiers: CCE-26923-3

References: RHEL-07-010270, SV-86557r3_rule, 5.3.3, 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, CCI-000200, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(e), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.5, SRG-OS-000077-GPOS-00045, SRG-OS-000077-VMM-000440

Remediation Shell script: (show)


var_password_pam_unix_remember="4"

AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pamFile in "${AUTH_FILES[@]}"
do
	if grep -q "remember=" $pamFile; then
		sed -i --follow-symlinks "s/\(^password.*sufficient.*pam_unix.so.*\)\(\(remember *= *\)[^ $]*\)/\1remember=$var_password_pam_unix_remember/" $pamFile
	else
		sed -i --follow-symlinks "/^password[[:space:]]\+sufficient[[:space:]]\+pam_unix.so/ s/$/ remember=$var_password_pam_unix_remember/" $pamFile
	fi
done

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	medium
Strategy:	configure

- name: XCCDF Value var_password_pam_unix_remember # promote to variable
  set_fact:
    var_password_pam_unix_remember: !!str 4
  tags:
    - always

- name: "Do not allow users to reuse recent passwords - system-auth (change)"
  replace:
    dest: /etc/pam.d/system-auth
    follow: yes
    regexp: '^(password\s+sufficient\s+pam_unix\.so\s.*remember\s*=\s*)(\S+)(.*)$'
    replace: '\g<1>{{ var_password_pam_unix_remember }}\g<3>'
  tags:
    - accounts_password_pam_unix_remember
    - medium_severity
    - configure_strategy
    - low_complexity
    - medium_disruption
    - CCE-26923-3
    - NIST-800-53-IA-5(f)
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-171-3.5.8
    - PCI-DSS-Req-8.2.5
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-07-010270
  

- name: "Do not allow users to reuse recent passwords - system-auth (add)"
  replace:
    dest: /etc/pam.d/system-auth
    follow: yes
    regexp: '^password\s+sufficient\s+pam_unix\.so\s(?!.*remember\s*=\s*).*$'
    replace: '\g<0> remember={{ var_password_pam_unix_remember }}'
  tags:
    - accounts_password_pam_unix_remember
    - medium_severity
    - configure_strategy
    - low_complexity
    - medium_disruption
    - CCE-26923-3
    - NIST-800-53-IA-5(f)
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-171-3.5.8
    - PCI-DSS-Req-8.2.5
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-07-010270

Group 8.2.6

[ref] Set passwords/phrases for first-

Group 8.3 Group contains 2 groups and 1 rule

[ref] Incorporate two-factor authentication

Group 8.3.a

[ref] Examine system configurations for remote access servers

Group 8.3.b

[ref] Observe a sample of personnel (for example, users and

Rule Enable Smart Card Login [ref]
To enable smart card authentication, consult the documentation at: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at: https://access.redhat.com/solutions/82273
Rationale:	Smart card login provides two-factor authentication stronger than that provided by a username and password combination. Smart cards leverage PKI (public key infrastructure) in order to provide and verify credentials.
Severity:	medium
Identifiers and References	Identifiers: CCE-80207-4 References: RHEL-07-010500, SV-86589r2_rule, 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000765, CCI-000766, CCI-000767, CCI-000768, CCI-000771, CCI-000772, CCI-000884, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-2(1), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.3, SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000108-GPOS-00057, SRG-OS-000108-GPOS-00058
Remediation Shell script: (show) # Install required packages # Function to install packages on RHEL, Fedora, Debian, and possibly other systems. # # Example Call(s): # # package_install aide # function package_install { # Load function arguments into local variables local package="$1" # Check sanity of the input if [ $# -ne "1" ] then echo "Usage: package_install 'package_name'" echo "Aborting." exit 1 fi if which dnf ; then if ! rpm -q --quiet "$package"; then dnf install -y "$package" fi elif which yum ; then if ! rpm -q --quiet "$package"; then yum install -y "$package" fi elif which apt-get ; then apt-get install -y "$package" else echo "Failed to detect available packaging system, tried dnf, yum and apt-get!" echo "Aborting." exit 1 fi } package_install esc package_install pam_pkcs11 # Enable pcscd.socket systemd activation socket # Function to enable/disable and start/stop services on RHEL and Fedora systems. # # Example Call(s): # # service_command enable bluetooth # service_command disable bluetooth.service # # Using xinetd: # service_command disable rsh.socket xinetd=rsh # function service_command { # Load function arguments into local variables local service_state=$1 local service=$2 local xinetd=$(echo $3 \| cut -d'=' -f2) # Check sanity of the input if [ $# -lt "2" ] then echo "Usage: service_command 'enable/disable' 'service_name.service'" echo echo "To enable or disable xinetd services add \'xinetd=service_name\'" echo "as the last argument" echo "Aborting." exit 1 fi # If systemctl is installed, use systemctl command; otherwise, use the service/chkconfig commands if [ -f "/usr/bin/systemctl" ] ; then service_util="/usr/bin/systemctl" else service_util="/sbin/service" chkconfig_util="/sbin/chkconfig" fi # If disable is not specified in arg1, set variables to enable services. # Otherwise, variables are to be set to disable services. if [ "$service_state" != 'disable' ] ; then service_state="enable" service_operation="start" chkconfig_state="on" else service_state="disable" service_operation="stop" chkconfig_state="off" fi # If chkconfig_util is not empty, use chkconfig/service commands. if [ "x$chkconfig_util" != x ] ; then $service_util $service $service_operation $chkconfig_util --level 0123456 $service $chkconfig_state else $service_util $service_operation $service $service_util $service_state $service # The service may not be running because it has been started and failed, # so let's reset the state so OVAL checks pass. # Service should be 'inactive', not 'failed' after reboot though. $service_util reset-failed $service fi # Test if local variable xinetd is empty using non-bashism. # If empty, then xinetd is not being used. if [ "x$xinetd" != x ] ; then grep -qi disable /etc/xinetd.d/$xinetd && \ if [ "$service_operation" = 'disable' ] ; then sed -i "s/disable./disable = no/gI" /etc/xinetd.d/$xinetd else sed -i "s/disable./disable = yes/gI" /etc/xinetd.d/$xinetd fi fi } service_command enable pcscd.socket # Configure the expected /etc/pam.d/system-auth{,-ac} settings directly # # The code below will configure system authentication in the way smart card # logins will be enabled, but also user login(s) via other method to be allowed # # NOTE: It is not possible to use the 'authconfig' command to perform the # remediation for us, because call of 'authconfig' would discard changes # for other remediations (see RH BZ#1357019 for details) # # Therefore we need to configure the necessary settings directly. # # Define system-auth config location SYSTEM_AUTH_CONF="/etc/pam.d/system-auth" # Define expected 'pam_env.so' row in $SYSTEM_AUTH_CONF PAM_ENV_SO="auth.required.pam_env.so" # Define 'pam_succeed_if.so' row to be appended past $PAM_ENV_SO row into $SYSTEM_AUTH_CONF SYSTEM_AUTH_PAM_SUCCEED="\ auth [success=1 default=ignore] pam_succeed_if.so service notin \ login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid" # Define 'pam_pkcs11.so' row to be appended past $SYSTEM_AUTH_PAM_SUCCEED # row into SYSTEM_AUTH_CONF file SYSTEM_AUTH_PAM_PKCS11="\ auth [success=done authinfo_unavail=ignore ignore=ignore default=die] \ pam_pkcs11.so nodebug" # Define smartcard-auth config location SMARTCARD_AUTH_CONF="/etc/pam.d/smartcard-auth" # Define 'pam_pkcs11.so' auth section to be appended past $PAM_ENV_SO into $SMARTCARD_AUTH_CONF SMARTCARD_AUTH_SECTION="\ auth [success=done ignore=ignore default=die] pam_pkcs11.so nodebug wait_for_card" # Define expected 'pam_permit.so' row in $SMARTCARD_AUTH_CONF PAM_PERMIT_SO="account.required.pam_permit.so" # Define 'pam_pkcs11.so' password section SMARTCARD_PASSWORD_SECTION="\ password required pam_pkcs11.so" # First Correct the SYSTEM_AUTH_CONF configuration if ! grep -q 'pam_pkcs11.so' "$SYSTEM_AUTH_CONF" then # Append (expected) pam_succeed_if.so row past the pam_env.so into SYSTEM_AUTH_CONF file # and append (expected) pam_pkcs11.so row right after the pam_succeed_if.so we just added # in SYSTEM_AUTH_CONF file # This will preserve any other already existing row equal to "$SYSTEM_AUTH_PAM_SUCCEED" echo "$(awk '/^'"$PAM_ENV_SO"'/{print $0 RS "'"$SYSTEM_AUTH_PAM_SUCCEED"'" RS "'"$SYSTEM_AUTH_PAM_PKCS11"'";next}1' "$SYSTEM_AUTH_CONF")" > "$SYSTEM_AUTH_CONF" fi # Then also correct the SMARTCARD_AUTH_CONF if ! grep -q 'pam_pkcs11.so' "$SMARTCARD_AUTH_CONF" then # Append (expected) SMARTCARD_AUTH_SECTION row past the pam_env.so into SMARTCARD_AUTH_CONF file sed -i --follow-symlinks -e '/^'"$PAM_ENV_SO"'/a '"$SMARTCARD_AUTH_SECTION" "$SMARTCARD_AUTH_CONF" # Append (expected) SMARTCARD_PASSWORD_SECTION row past the pam_permit.so into SMARTCARD_AUTH_CONF file sed -i --follow-symlinks -e '/^'"$PAM_PERMIT_SO"'/a '"$SMARTCARD_PASSWORD_SECTION" "$SMARTCARD_AUTH_CONF" fi # Perform /etc/pam_pkcs11/pam_pkcs11.conf settings below # Define selected constants for later reuse SP="[:space:]" PAM_PKCS11_CONF="/etc/pam_pkcs11/pam_pkcs11.conf" # Ensure OCSP is turned on in $PAM_PKCS11_CONF # 1) First replace any occurrence of 'none' value of 'cert_policy' key setting with the correct configuration sed -i "s/^[$SP]cert_policy[$SP]\+=[$SP]\+none;/\t\tcert_policy = ca, ocsp_on, signature;/g" "$PAM_PKCS11_CONF" # 2) Then append 'ocsp_on' value setting to each 'cert_policy' key in $PAM_PKCS11_CONF configuration line, # which does not contain it yet sed -i "/ocsp_on/! s/^[$SP]cert_policy[$SP]\+=[$SP]\+$.*$;/\t\tcert_policy = \1, ocsp_on;/" "$PAM_PKCS11_CONF" Remediation Anaconda snippet: (show) `package --add=pam_pkcs11 --add=esc`

Group 8.4

[ref] Document and communicate

Group 8.4.a

[ref] Examine

Group 8.4.b

[ref] Review authentication policies and procedures that are

Group 8.4.c

[ref] Interview a sample of users to verify that they are familiar

Group 8.5 Group contains 4 groups and 1 rule

[ref] Do not use group, shared, or generic

Group 8.5.1

[ref]

Group 8.5.a Group contains 1 rule

[ref] For a sample of system components, examine user ID lists

Rule All GIDs referenced in /etc/passwd must be defined in /etc/group [ref]
Add a group to the system for each GID referenced without a corresponding group.
Rationale:	If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group with the Gruop Identifier (GID) is subsequently created, the user may have unintended rights to any files associated with the group.
Severity:	low
Identifiers and References	Identifiers: CCE-27503-2 References: RHEL-07-020300, SV-86627r2_rule, 1, 12, 15, 16, 5, 5.5.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000764, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-2, PR.AC-1, PR.AC-6, PR.AC-7, Req-8.5.a, SRG-OS-000104-GPOS-00051

Group 8.5.b

[ref] Examine authentication policies and procedures to verify

Group 8.5.c

[ref] Interview system administrators to verify that group and

Group 8.6

[ref] Where other authentication

Group 8.6.a

[ref] Examine authentication policies and procedures to verify

Group 8.6.b

[ref] Interview security personnel to verify authentication

Group 8.6.c

[ref] Examine system configuration settings and/or physical

Group 8.7 Group contains 4 groups and 9 rules

[ref] All access to any database

Group 8.7.a

[ref] Review database and application configuration settings

Group 8.7.b

[ref] Examine database and application configuration settings to

Group 8.7.c Group contains 9 rules

[ref] Examine database access control settings and database

Rule Verify Permissions on shadow File [ref]

To properly set the permissions of /etc/shadow, run the command:

$ sudo chmod 0640 /etc/shadow

Rationale:

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Severity:

medium

Identifiers and References

Identifiers: CCE-27100-7

References: 6.1.3, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-6, PR.AC-4, PR.DS-5, Req-8.7.c

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chmod 0000 /etc/shadow

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  
- name: Ensure permission 0000 on /etc/shadow
  file:
    path: /etc/shadow
    mode: 0000
  when: file_exists.stat.exists and True
  tags:
    - file_permissions_etc_shadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-27100-7
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify User Who Owns shadow File [ref]

To properly set the owner of /etc/shadow, run the command:

$ sudo chown root /etc/shadow

Rationale:

Severity:

medium

Identifiers and References

Identifiers: CCE-26795-5

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chown 0 /etc/shadow

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists

- name: Ensure owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    owner: 0
  when: file_exists.stat.exists and True
  tags:
    - file_owner_etc_shadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26795-5
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify User Who Owns group File [ref]

To properly set the owner of /etc/group, run the command:

$ sudo chown root /etc/group

Rationale:

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-26933-2

References: 6.1.4, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-6, PR.AC-4, PR.DS-5, Req-8.7.c

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chown 0 /etc/group

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists

- name: Ensure owner 0 on /etc/group
  file:
    path: /etc/group
    owner: 0
  when: file_exists.stat.exists and True
  tags:
    - file_owner_etc_group
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26933-2
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify Permissions on group File [ref]

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

Rationale:

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-26949-8

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chmod 0644 /etc/group

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  
- name: Ensure permission 0644 on /etc/group
  file:
    path: /etc/group
    mode: 0644
  when: file_exists.stat.exists and True
  tags:
    - file_permissions_etc_group
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26949-8
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify Group Who Owns passwd File [ref]

To properly set the group owner of /etc/passwd, run the command:

$ sudo chgrp root /etc/passwd

Rationale:

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-26639-5

References: 6.1.2, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-6, PR.AC-4, PR.DS-5, Req-8.7.c

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chgrp 0 /etc/passwd

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists

- name: Ensure group owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    group: 0
  when: file_exists.stat.exists and True
  tags:
    - file_groupowner_etc_passwd
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26639-5
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify Group Who Owns shadow File [ref]

To properly set the group owner of /etc/shadow, run the command:

$ sudo chgrp root /etc/shadow

Rationale:

The /etc/shadow file stores password hashes. Protection of this file is critical for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-27125-4

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chgrp 0 /etc/shadow

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists

- name: Ensure group owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    group: 0
  when: file_exists.stat.exists and True
  tags:
    - file_groupowner_etc_shadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-27125-4
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify Group Who Owns group File [ref]

To properly set the group owner of /etc/group, run the command:

$ sudo chgrp root /etc/group

Rationale:

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-27037-1

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chgrp 0 /etc/group

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists

- name: Ensure group owner 0 on /etc/group
  file:
    path: /etc/group
    group: 0
  when: file_exists.stat.exists and True
  tags:
    - file_groupowner_etc_group
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-27037-1
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify User Who Owns passwd File [ref]

To properly set the owner of /etc/passwd, run the command:

$ sudo chown root /etc/passwd

Rationale:

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-27138-7

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chown 0 /etc/passwd

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists

- name: Ensure owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    owner: 0
  when: file_exists.stat.exists and True
  tags:
    - file_owner_etc_passwd
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-27138-7
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Rule Verify Permissions on passwd File [ref]

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

Rationale:

If the /etc/passwd file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

Severity:

medium

Identifiers and References

Identifiers: CCE-26887-0

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	configure


chmod 0644 /etc/passwd

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	configure

- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  
- name: Ensure permission 0644 on /etc/passwd
  file:
    path: /etc/passwd
    mode: 0644
  when: file_exists.stat.exists and True
  tags:
    - file_permissions_etc_passwd
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - CCE-26887-0
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Group 8.7.d

[ref] Examine database access control settings, database

Group 8.8

[ref] Ensure that security policies and

Group 10. Group contains 48 groups and 49 rules

[ref] Track and monitor all access to network resources and cardholder data

Group 10.1 Group contains 1 rule

[ref] Implement audit trails to link all

Rule Enable auditd Service [ref]

The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk. The auditd service can be enabled with the following command:

$ sudo systemctl enable auditd.service

Rationale:

Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.

Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Severity:

high

Identifiers and References

Identifiers: CCE-27407-6

References: RHEL-07-030000, SV-86703r3_rule, 4.1.2, 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000131, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AC-2(g), AU-3, AC-17(1), AU-1(b), AU-10, AU-12(a), AU-12(c), AU-14(1), IR-5, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.1, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310

Remediation Shell script: (show)

Complexity:	low
Disruption:	low
Strategy:	enable


SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" start 'auditd.service'
"$SYSTEMCTL_EXEC" enable 'auditd.service'

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	enable

- name: Enable service auditd
  service:
    name: auditd
    enabled: "yes"
    state: "started"
  tags:
    - service_auditd_enabled
    - high_severity
    - enable_strategy
    - low_complexity
    - low_disruption
    - CCE-27407-6
    - NIST-800-53-AC-2(g)
    - NIST-800-53-AU-3
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-1(b)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-14(1)
    - NIST-800-53-IR-5
    - NIST-800-171-3.3.1
    - NIST-800-171-3.3.2
    - NIST-800-171-3.3.6
    - PCI-DSS-Req-10.1
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-07-030000
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Group 10.2 Group contains 10 groups and 10 rules

[ref] Implement automated audit trails for

Group 10.2.1 Group contains 1 rule

[ref] All individual user accesses to

Rule Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful) [ref]
At a minimum the audit system should collect unauthorized file accesses for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file: -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access If the system is 64 bit then also add the following lines: -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access Warning: This rule checks for multiple syscalls related to unsuccessful file modification; it was written with DISA STIG in mind. Other policies should use a separate rule for each syscall that needs to be checked. For example: `audit_rules_unsuccessful_file_modification_open` `audit_rules_unsuccessful_file_modification_ftruncate` `audit_rules_unsuccessful_file_modification_creat`
Rationale:	Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
Severity:	medium
Identifiers and References	Identifiers: CCE-27347-4 References: 5.2.10, 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000172, CCI-002884, 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AC-17(7), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.4, Req-10.2.1
Remediation Shell script: (show) # Perform the remediation of the syscall rule # Retrieve hardware architecture of the underlying system [ $(getconf LONG_BIT) = "32" ] && RULE_ARCHS=("b32") \|\| RULE_ARCHS=("b32" "b64") for ARCH in "${RULE_ARCHS[@]}" do # First fix the -EACCES requirement PATTERN="-a always,exit -F arch=$ARCH -S .* -F exit=-EACCES -F auid>=1000 -F auid!=unset -k " # Use escaped BRE regex to specify rule group GROUP="$creat\\|open\\|truncate$" FULL_RULE="-a always,exit -F arch=$ARCH -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access" # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' # Function to fix syscall audit rule for given system call. It is # based on example audit syscall rule definitions as outlined in # /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit # package. It will combine multiple system calls belonging to the same # syscall group into one audit rule (rather than to create audit rule per # different system call) to avoid audit infrastructure performance penalty # in the case of 'one-audit-rule-definition-per-one-system-call'. See: # # https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html # # for further details. # # Expects five arguments (each of them is required) in the form of: # audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules # * audit rules' pattern audit rule skeleton for same syscall # * syscall group greatest common string this rule shares # with other rules from the same group # * architecture architecture this rule is intended for # * full form of new rule to add expected full form of audit rule as to be # added into audit.rules file # # Note: The 2-th up to 4-th arguments are used to determine how many existing # audit rules will be inspected for resemblance with the new audit rule # (5-th argument) the function is going to add. The rule's similarity check # is performed to optimize audit.rules definition (merge syscalls of the same # group into one rule) to avoid the "single-syscall-per-audit-rule" performance # penalty. # # Example call: # # See e.g. 'audit_rules_file_deletion_events.sh' remediation script # function fix_audit_syscall_rule { # Load function arguments into local variables local tool="$1" local pattern="$2" local group="$3" local arch="$4" local full_rule="$5" # Check sanity of the input if [ $# -ne "5" ] then echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- # declare -a files_to_inspect retval=0 # First check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" return 1 # If audit tool is 'auditctl', then add '/etc/audit/audit.rules' # file to the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules' ) # If audit tool is 'augenrules', then check if the audit rule is defined # If rule is defined, add '/etc/audit/rules.d/.rules' to the list for inspection # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection elif [ "$tool" == 'augenrules' ] then # Extract audit $key from audit rule so we can use it later key=$(expr "$full_rule" : '.-k[[:space:]]$[^[:space:]]\+$' '\|' "$full_rule" : '.-F[[:space:]]key=$[^[:space:]]\+$') IFS_BKP="$IFS" # Check if particular audit rule is already defined IFS=$'\n' matches=($(sed -s -n -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/.rules)) if [ $? -ne 0 ] then retval=1 fi # Reset IFS back to default IFS="$IFS_BKP" for match in "${matches[@]}" do files_to_inspect=("${files_to_inspect[@]}" "${match}") done # Case when particular rule isn't defined in /etc/audit/rules.d/.rules yet if [ ${#files_to_inspect[@]} -eq "0" ] then files_to_inspect="/etc/audit/rules.d/$key.rules" if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # # Indicator that we want to append $full_rule into $audit_file by default local append_expected_rule=0 for audit_file in "${files_to_inspect[@]}" do IFS_BKP="$IFS" # Filter existing $audit_file rules' definitions to select those that: # follow the rule pattern, and # * meet the hardware architecture requirement, and # * are current syscall group specific IFS=$'\n' existing_rules=($(sed -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d" "$audit_file")) if [ $? -ne 0 ] then retval=1 fi # Reset IFS back to default IFS="$IFS_BKP" # Process rules found case-by-case for rule in "${existing_rules[@]}" do # Found rule is for same arch & key, but differs (e.g. in count of -S arguments) if [ "${rule}" != "${full_rule}" ] then # If so, isolate just '(-S \w)+' substring of that rule rule_syscalls=$(echo $rule \| grep -o -P '(-S \w+ )+') # Check if list of '-S syscall' arguments of that rule is subset # of '-S syscall' list of expected $full_rule if grep -q -- "$rule_syscalls" <<< "$full_rule" then # Rule is covered (i.e. the list of -S syscalls for this rule is # subset of -S syscalls of $full_rule => existing rule can be deleted # Thus delete the rule from audit.rules & our array sed -i -e "\;${rule};d" "$audit_file" if [ $? -ne 0 ] then retval=1 fi existing_rules=("${existing_rules[@]//$rule/}") else # Rule isn't covered by $full_rule - it besides -S syscall arguments # for this group contains also -S syscall arguments for other syscall # group. Example: '-S lchown -S fchmod -S fchownat' => group='chown' # since 'lchown' & 'fchownat' share 'chown' substring # Therefore: # * 1) delete the original rule from audit.rules # (original '-S lchown -S fchmod -S fchownat' rule would be deleted) # * 2) delete the -S syscall arguments for this syscall group, but # keep those not belonging to this syscall group # (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod' # * 3) append the modified (filtered) rule again into audit.rules # if the same rule not already present # # 1) Delete the original rule sed -i -e "\;${rule};d" "$audit_file" if [ $? -ne 0 ] then retval=1 fi IFS_BKP="$IFS" # 2) Delete syscalls for this group, but keep those from other groups # Convert current rule syscall's string into array splitting by '-S' delimiter IFS=$'-S' read -a rule_syscalls_as_array <<< "$rule_syscalls" # Reset IFS back to default IFS="$IFS_BKP" # Declare new empty string to hold '-S syscall' arguments from other groups new_syscalls_for_rule='' # Walk through existing '-S syscall' arguments for syscall_arg in "${rule_syscalls_as_array[@]}" do # Skip empty $syscall_arg values if [ "$syscall_arg" == '' ] then continue fi # If the '-S syscall' doesn't belong to current group add it to the new list # (together with adding '-S' delimiter back for each of such item found) if grep -q -v -- "$group" <<< "$syscall_arg" then new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg" fi done # Replace original '-S syscall' list with the new one for this rule updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule} # Squeeze repeated whitespace characters in rule definition (if any) into one updated_rule=$(echo "$updated_rule" \| tr -s '[:space:]') # 3) Append the modified / filtered rule again into audit.rules # (but only in case it's not present yet to prevent duplicate definitions) if ! grep -q -- "$updated_rule" "$audit_file" then echo "$updated_rule" >> "$audit_file" fi fi else # $audit_file already contains the expected rule form for this # architecture & key => don't insert it second time append_expected_rule=1 fi done # We deleted all rules that were subset of the expected one for this arch & key. # Also isolated rules containing system calls not from this system calls group. # Now append the expected rule if it's not present in $audit_file yet if [[ ${append_expected_rule} -eq "0" ]] then echo "$full_rule" >> "$audit_file" fi done return $retval } fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE" fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE" # Then fix the -EPERM requirement PATTERN="-a always,exit -F arch=$ARCH -S .* -F exit=-EPERM -F auid>=1000 -F auid!=unset -k " # No need to change content of $GROUP variable - it's the same as for -EACCES case above FULL_RULE="-a always,exit -F arch=$ARCH -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access" # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' # Function to fix syscall audit rule for given system call. It is # based on example audit syscall rule definitions as outlined in # /usr/share/doc/audit-2.3.7/stig.rules file provided with the audit # package. It will combine multiple system calls belonging to the same # syscall group into one audit rule (rather than to create audit rule per # different system call) to avoid audit infrastructure performance penalty # in the case of 'one-audit-rule-definition-per-one-system-call'. See: # # https://www.redhat.com/archives/linux-audit/2014-November/msg00009.html # # for further details. # # Expects five arguments (each of them is required) in the form of: # audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules # * audit rules' pattern audit rule skeleton for same syscall # * syscall group greatest common string this rule shares # with other rules from the same group # * architecture architecture this rule is intended for # * full form of new rule to add expected full form of audit rule as to be # added into audit.rules file # # Note: The 2-th up to 4-th arguments are used to determine how many existing # audit rules will be inspected for resemblance with the new audit rule # (5-th argument) the function is going to add. The rule's similarity check # is performed to optimize audit.rules definition (merge syscalls of the same # group into one rule) to avoid the "single-syscall-per-audit-rule" performance # penalty. # # Example call: # # See e.g. 'audit_rules_file_deletion_events.sh' remediation script # function fix_audit_syscall_rule { # Load function arguments into local variables local tool="$1" local pattern="$2" local group="$3" local arch="$4" local full_rule="$5" # Check sanity of the input if [ $# -ne "5" ] then echo "Usage: fix_audit_syscall_rule 'tool' 'pattern' 'group' 'arch' 'full rule'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- # declare -a files_to_inspect retval=0 # First check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" return 1 # If audit tool is 'auditctl', then add '/etc/audit/audit.rules' # file to the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules' ) # If audit tool is 'augenrules', then check if the audit rule is defined # If rule is defined, add '/etc/audit/rules.d/.rules' to the list for inspection # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection elif [ "$tool" == 'augenrules' ] then # Extract audit $key from audit rule so we can use it later key=$(expr "$full_rule" : '.-k[[:space:]]$[^[:space:]]\+$' '\|' "$full_rule" : '.-F[[:space:]]key=$[^[:space:]]\+$') IFS_BKP="$IFS" # Check if particular audit rule is already defined IFS=$'\n' matches=($(sed -s -n -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d;F" /etc/audit/rules.d/.rules)) if [ $? -ne 0 ] then retval=1 fi # Reset IFS back to default IFS="$IFS_BKP" for match in "${matches[@]}" do files_to_inspect=("${files_to_inspect[@]}" "${match}") done # Case when particular rule isn't defined in /etc/audit/rules.d/.rules yet if [ ${#files_to_inspect[@]} -eq "0" ] then files_to_inspect="/etc/audit/rules.d/$key.rules" if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # # Indicator that we want to append $full_rule into $audit_file by default local append_expected_rule=0 for audit_file in "${files_to_inspect[@]}" do IFS_BKP="$IFS" # Filter existing $audit_file rules' definitions to select those that: # follow the rule pattern, and # * meet the hardware architecture requirement, and # * are current syscall group specific IFS=$'\n' existing_rules=($(sed -e "\;${pattern};!d" -e "/${arch}/!d" -e "/${group}/!d" "$audit_file")) if [ $? -ne 0 ] then retval=1 fi # Reset IFS back to default IFS="$IFS_BKP" # Process rules found case-by-case for rule in "${existing_rules[@]}" do # Found rule is for same arch & key, but differs (e.g. in count of -S arguments) if [ "${rule}" != "${full_rule}" ] then # If so, isolate just '(-S \w)+' substring of that rule rule_syscalls=$(echo $rule \| grep -o -P '(-S \w+ )+') # Check if list of '-S syscall' arguments of that rule is subset # of '-S syscall' list of expected $full_rule if grep -q -- "$rule_syscalls" <<< "$full_rule" then # Rule is covered (i.e. the list of -S syscalls for this rule is # subset of -S syscalls of $full_rule => existing rule can be deleted # Thus delete the rule from audit.rules & our array sed -i -e "\;${rule};d" "$audit_file" if [ $? -ne 0 ] then retval=1 fi existing_rules=("${existing_rules[@]//$rule/}") else # Rule isn't covered by $full_rule - it besides -S syscall arguments # for this group contains also -S syscall arguments for other syscall # group. Example: '-S lchown -S fchmod -S fchownat' => group='chown' # since 'lchown' & 'fchownat' share 'chown' substring # Therefore: # * 1) delete the original rule from audit.rules # (original '-S lchown -S fchmod -S fchownat' rule would be deleted) # * 2) delete the -S syscall arguments for this syscall group, but # keep those not belonging to this syscall group # (original '-S lchown -S fchmod -S fchownat' would become '-S fchmod' # * 3) append the modified (filtered) rule again into audit.rules # if the same rule not already present # # 1) Delete the original rule sed -i -e "\;${rule};d" "$audit_file" if [ $? -ne 0 ] then retval=1 fi IFS_BKP="$IFS" # 2) Delete syscalls for this group, but keep those from other groups # Convert current rule syscall's string into array splitting by '-S' delimiter IFS=$'-S' read -a rule_syscalls_as_array <<< "$rule_syscalls" # Reset IFS back to default IFS="$IFS_BKP" # Declare new empty string to hold '-S syscall' arguments from other groups new_syscalls_for_rule='' # Walk through existing '-S syscall' arguments for syscall_arg in "${rule_syscalls_as_array[@]}" do # Skip empty $syscall_arg values if [ "$syscall_arg" == '' ] then continue fi # If the '-S syscall' doesn't belong to current group add it to the new list # (together with adding '-S' delimiter back for each of such item found) if grep -q -v -- "$group" <<< "$syscall_arg" then new_syscalls_for_rule="$new_syscalls_for_rule -S $syscall_arg" fi done # Replace original '-S syscall' list with the new one for this rule updated_rule=${rule//$rule_syscalls/$new_syscalls_for_rule} # Squeeze repeated whitespace characters in rule definition (if any) into one updated_rule=$(echo "$updated_rule" \| tr -s '[:space:]') # 3) Append the modified / filtered rule again into audit.rules # (but only in case it's not present yet to prevent duplicate definitions) if ! grep -q -- "$updated_rule" "$audit_file" then echo "$updated_rule" >> "$audit_file" fi fi else # $audit_file already contains the expected rule form for this # architecture & key => don't insert it second time append_expected_rule=1 fi done # We deleted all rules that were subset of the expected one for this arch & key. # Also isolated rules containing system calls not from this system calls group. # Now append the expected rule if it's not present in $audit_file yet if [[ ${append_expected_rule} -eq "0" ]] then echo "$full_rule" >> "$audit_file" fi done return $retval } fix_audit_syscall_rule "auditctl" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE" fix_audit_syscall_rule "augenrules" "$PATTERN" "$GROUP" "$ARCH" "$FULL_RULE" done

Group 10.2.2 Group contains 2 rules

[ref] All actions taken by any

Rule Ensure auditd Collects Information on the Use of Privileged Commands [ref]

At a minimum, the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid / setgid programs, run the following command for each local partition PART:

$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null

If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add a line of the following form to a file with suffix .rules in the directory /etc/audit/rules.d for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:

-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add a line of the following form to /etc/audit/audit.rules for each setuid / setgid program on the system, replacing the SETUID_PROG_PATH part with the full path of that setuid / setgid program in the list:

-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

Warning: This rule checks for multiple syscalls related to privileged commands; it was written with DISA STIG in mind. Other policies should use a separate rule for each syscall that needs to be checked. For example:

audit_rules_privileged_commands_su
audit_rules_privileged_commands_umount
audit_rules_privileged_commands_passwd

Rationale:

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider and advanced persistent threast.

Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity.

Severity:

medium

Identifiers and References

Identifiers: CCE-27437-3

References: RHEL-07-030360, SV-86719r6_rule, 5.2.10, 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO08.04, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.05, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-002234, 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.5, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.3.4.5.9, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 3.9, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.1, A.16.1.2, A.16.1.3, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.3, A.6.2.1, A.6.2.2, AC-17(7), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-2(4), AU-6(9), AU-12(a), AU-12(c), IR-5, DE.AE-2, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, DE.DP-4, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, RS.CO-2, Req-10.2.2, SRG-OS-000327-GPOS-00127

Remediation Shell script: (show)



# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Function to perform remediation for 'audit_rules_privileged_commands' rule
#
# Expects two arguments:
#
# audit_tool		tool used to load audit rules
# 			One of 'auditctl' or 'augenrules'
#
# min_auid		Minimum original ID the user logged in with
# 			'500' for RHEL-6 and before, '1000' for RHEL-7 and after.
#
# Example Call(s):
#
#      perform_audit_rules_privileged_commands_remediation "auditctl" "500"
#      perform_audit_rules_privileged_commands_remediation "augenrules"	"1000"
#
function perform_audit_rules_privileged_commands_remediation {
#
# Load function arguments into local variables
local tool="$1"
local min_auid="$2"

# Backup IFS value
IFS_BKP="$IFS"

# Check sanity of the input
if [ $# -ne "2" ]
then
	echo "Usage: perform_audit_rules_privileged_commands_remediation 'auditctl | augenrules' '500 | 1000'"
	echo "Aborting."
	exit 1
fi

declare -a files_to_inspect=()

# Check sanity of the specified audit tool
if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ]
then
	echo "Unknown audit rules loading tool: $1. Aborting."
	echo "Use either 'auditctl' or 'augenrules'!"
	exit 1
# If the audit tool is 'auditctl', then:
# * add '/etc/audit/audit.rules'to the list of files to be inspected,
# * specify '/etc/audit/audit.rules' as the output audit file, where
#   missing rules should be inserted
elif [ "$tool" == 'auditctl' ]
then
	files_to_inspect=("/etc/audit/audit.rules")
	output_audit_file="/etc/audit/audit.rules"
#
# If the audit tool is 'augenrules', then:
# * add '/etc/audit/rules.d/*.rules' to the list of files to be inspected
#   (split by newline),
# * specify /etc/audit/rules.d/privileged.rules' as the output file, where
#   missing rules should be inserted
elif [ "$tool" == 'augenrules' ]
then
	IFS=$'\n'
	files_to_inspect=($(find /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -print))
	output_audit_file="/etc/audit/rules.d/privileged.rules"
fi

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
IFS=$'\n'
privileged_binaries=($(find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null))

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
declare -a sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

	# Check if this sbinary wasn't already handled in some of the previous iterations
	# Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
	if [[ $(sed -ne "\|${sbinary}|p" <<< "${sbinaries_to_skip[*]}") ]]
	then
		# If so, don't process it second time & go to process next sbinary
		continue
	fi

	# Reset the counter of inspected files when starting to check
	# presence of existing audit rule for new sbinary
	local count_of_inspected_files=0

	# Define expected rule form for this binary
	expected_rule="-a always,exit -F path=${sbinary} -F perm=x -F auid>=${min_auid} -F auid!=unset -k privileged"

	# If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
	if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
		echo "$expected_rule" >> "$output_audit_file"
		continue
	fi

	# Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
	sbinary_esc=${sbinary//$'/'/$'\/'}

	# For each audit rules file from the list of files to be inspected
	for afile in "${files_to_inspect[@]}"
	do

		# Search current audit rules file's content for match. Match criteria:
		# * existing rule is for the same SUID/SGID binary we are currently processing (but
		#   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
		# * existing rule contains all arguments from expected rule form (though can contain
		#   them in arbitrary order)
	
		base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'/!d'		\
				-e '/-F path=[^[:space:]]\+/!d'   -e '/-F perm=.*/!d'						\
				-e '/-F auid>='"${min_auid}"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
				-e '/-k \|-F key=/!d' "$afile")

		# Increase the count of inspected files for this sbinary
		count_of_inspected_files=$((count_of_inspected_files + 1))

		# Require execute access type to be set for existing audit rule
		exec_access='x'

		# Search current audit rules file's content for presence of rule pattern for this sbinary
		if [[ $base_search ]]
		then

			# Current audit rules file already contains rule for this binary =>
			# Store the exact form of found rule for this binary for further processing
			concrete_rule=$base_search

			# Select all other SUID/SGID binaries possibly also present in the found rule
			IFS=$'\n'
			handled_sbinaries=($(grep -o -e "-F path=[^[:space:]]\+" <<< "$concrete_rule"))
			IFS=$' '
			handled_sbinaries=(${handled_sbinaries[@]//-F path=/})

			# Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
			sbinaries_to_skip=($(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du))

			# Separate concrete_rule into three sections using hash '#'
			# sign as a delimiter around rule's permission section borders
			concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\)\+/\1#\2#/p")"

			# Split concrete_rule into head, perm, and tail sections using hash '#' delimiter
			IFS=$'#'
			read -r rule_head rule_perm rule_tail <<<  "$concrete_rule"

			# Extract already present exact access type [r|w|x|a] from rule's permission section
			access_type=${rule_perm//-F perm=/}

			# Verify current permission access type(s) for rule contain 'x' (execute) permission
			if ! grep -q "$exec_access" <<< "$access_type"
			then

				# If not, append the 'x' (execute) permission to the existing access type bits
				access_type="$access_type$exec_access"
				# Reconstruct the permissions section for the rule
				new_rule_perm="-F perm=$access_type"
				# Update existing rule in current audit rules file with the new permission section
				sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${new_rule_perm}${rule_tail}#" "$afile"

			fi

		# If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
		#
		# * in the "auditctl" mode of operation insert particular rule each time
		#   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
		#
		# * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
		#   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
		#   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
		#
		elif [ "$tool" == "auditctl" ] || [[ "$tool" == "augenrules" && $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
		then

			# Current audit rules file's content doesn't contain expected rule for this
			# SUID/SGID binary yet => append it
			echo "$expected_rule" >> "$output_audit_file"
			continue
		fi

	done

done

# Reset IFS back to default
IFS="$IFS_BKP"
}

perform_audit_rules_privileged_commands_remediation "auditctl" "1000"
perform_audit_rules_privileged_commands_remediation "augenrules" "1000"

Remediation Ansible snippet: (show)

Complexity:	low
Disruption:	low
Strategy:	restrict


- name: Search for privileged commands
  shell: "find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null | cat"
  check_mode: no
  register: find_result
  tags:
    - audit_rules_privileged_commands
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27437-3
    - NIST-800-53-AC-17(7)
    - NIST-800-53-AU-1(b)
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-2(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-2(4)
    - NIST-800-53-AU-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-IR-5
    - NIST-800-171-3.1.7
    - PCI-DSS-Req-10.2.2
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-07-030360
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

# Inserts/replaces the rule in /etc/audit/rules.d

- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: "/etc/audit/rules.d"
    recurse: no
    contains: "^.*path={{ item }} .*$"
    patterns: "*.rules"
  with_items:
    - "{{ find_result.stdout_lines }}"
  register: files_result
  tags:
    - audit_rules_privileged_commands
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27437-3
    - NIST-800-53-AC-17(7)
    - NIST-800-53-AU-1(b)
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-2(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-2(4)
    - NIST-800-53-AU-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-IR-5
    - NIST-800-171-3.1.7
    - PCI-DSS-Req-10.2.2
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-07-030360
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

- name: Overwrites the rule in rules.d
  lineinfile:
    path: "{{ item.1.path }}"
    line: '-a always,exit -F path={{ item.0.item }} -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'
    create: no
    regexp: "^.*path={{ item.0.item }} .*$"
  with_subelements:
    - "{{ files_result.results }}"
    - files
  tags:
    - audit_rules_privileged_commands
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27437-3
    - NIST-800-53-AC-17(7)
    - NIST-800-53-AU-1(b)
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-2(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-2(4)
    - NIST-800-53-AU-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-IR-5
    - NIST-800-171-3.1.7
    - PCI-DSS-Req-10.2.2
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-07-030360
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

- name: Adds the rule in rules.d
  lineinfile:
    path: /etc/audit/rules.d/privileged.rules
    line: '-a always,exit -F path={{ item.item }} -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'
    create: yes
  with_items:
    - "{{ files_result.results }}"
  when: item.matched == 0 and (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")
  tags:
    - audit_rules_privileged_commands
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27437-3
    - NIST-800-53-AC-17(7)
    - NIST-800-53-AU-1(b)
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-2(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-2(4)
    - NIST-800-53-AU-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-IR-5
    - NIST-800-171-3.1.7
    - PCI-DSS-Req-10.2.2
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-07-030360

# Adds/overwrites the rule in /etc/audit/audit.rules

- name: Inserts/replaces the rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: '-a always,exit -F path={{ item.item }} -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'
    create: yes
    regexp: "^.*path={{ item.item }} .*$"
  with_items:
    - "{{ files_result.results }}"
  tags:
    - audit_rules_privileged_commands
    - medium_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27437-3
    - NIST-800-53-AC-17(7)
    - NIST-800-53-AU-1(b)
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-2(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-2(4)
    - NIST-800-53-AU-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-IR-5
    - NIST-800-171-3.1.7
    - PCI-DSS-Req-10.2.2
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-07-030360
  when:  # Bare-metal/VM task, not applicable for containers
    - (ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker")

Rule Ensure auditd Collects System Administrator Actions [ref]
At a minimum, the audit system should collect administrator actions for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following line to a file with suffix `.rules` in the directory `/etc/audit/rules.d`: -w /etc/sudoers -p wa -k actions -w /etc/sudoers.d/ -p wa -k actions If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following line to `/etc/audit/audit.rules` file: -w /etc/sudoers -p wa -k actions -w /etc/sudoers.d/ -p wa -k actions
Rationale:	The actions taken by system administrators should be audited to keep a record of what was executed on the system, as well as, for accountability purposes.
Severity:	medium
Identifiers and References	Identifiers: CCE-27461-3 References: RHEL-07-030700, SV-86787r5_rule, 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000126, CCI-000130, CCI-000135, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-2(7)(b), AC-17(7), AU-1(b), AU-2(a), AU-2(c), AU-2(d), iAU-3(1), AU-12(a), AU-12(c), IR-5, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.2, Req-10.2.5.b, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215
Remediation Shell script: (show) # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' # Function to fix audit file system object watch rule for given path: # * if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/etc/sudoers" "wa" "actions" fix_audit_watch_rule "augenrules" "/etc/sudoers" "wa" "actions" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.*$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/etc/sudoers.d" "wa" "actions" fix_audit_watch_rule "augenrules" "/etc/sudoers.d" "wa" "actions"

Group 10.2.3 Group contains 2 rules

[ref] Access to all audit trails

Rule Record Attempts to Alter Logon and Logout Events [ref]
The audit system already collects login information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing logon events: -w /var/log/tallylog -p wa -k logins -w /var/run/faillock -p wa -k logins -w /var/log/lastlog -p wa -k logins If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for unattempted manual edits of files involved in storing logon events: -w /var/log/tallylog -p wa -k logins -w /var/run/faillock -p wa -k logins -w /var/log/lastlog -p wa -k logins Warning: This rule checks for multiple syscalls related to login events; it was written with DISA STIG in mind. Other policies should use a separate rule for each syscall that needs to be checked. For example: `audit_rules_login_events_tallylog` `audit_rules_login_events_faillock` `audit_rules_login_events_lastlog`
Rationale:	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
Severity:	medium
Identifiers and References	Identifiers: CCE-27204-7 References: 5.2.8, 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000172, CCI-002884, 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AC-17(7), AU-1(b), AU-12(a), AU-12(c), IR-5, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.3
Remediation Shell script: (show) # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' # Function to fix audit file system object watch rule for given path: # * if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/var/log/tallylog" "wa" "logins" fix_audit_watch_rule "augenrules" "/var/log/tallylog" "wa" "logins" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/var/run/faillock/" "wa" "logins" fix_audit_watch_rule "augenrules" "/var/run/faillock/" "wa" "logins" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.*$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/var/log/lastlog" "wa" "logins" fix_audit_watch_rule "augenrules" "/var/log/lastlog" "wa" "logins"

Rule Record Attempts to Alter Process and Session Initiation Information [ref]
The audit system already collects process information for all users and root. If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d` in order to watch for attempted manual edits of files involved in storing such process information: -w /var/run/utmp -p wa -k session -w /var/log/btmp -p wa -k session -w /var/log/wtmp -p wa -k session If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file in order to watch for attempted manual edits of files involved in storing such process information: -w /var/run/utmp -p wa -k session -w /var/log/btmp -p wa -k session -w /var/log/wtmp -p wa -k session
Rationale:	Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
Severity:	medium
Identifiers and References	Identifiers: CCE-27301-1 References: 5.2.9, 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AC-17(7), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.3
Remediation Shell script: (show) # Perform the remediation # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' # Function to fix audit file system object watch rule for given path: # * if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/var/run/utmp" "wa" "session" fix_audit_watch_rule "augenrules" "/var/run/utmp" "wa" "session" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/var/log/btmp" "wa" "session" fix_audit_watch_rule "augenrules" "/var/log/btmp" "wa" "session" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.*$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/var/log/wtmp" "wa" "session" fix_audit_watch_rule "augenrules" "/var/log/wtmp" "wa" "session"

Group 10.2.4 Group contains 1 rule

[ref] Invalid logical access attempts

Rule Set Last Logon/Access Notification [ref]
To configure the system to notify users of last logon/access using `pam_lastlog`, add or correct the `pam_lastlog` settings in `/etc/pam.d/postlogin` to read as follows: session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet session [default=1] pam_lastlog.so nowtmp showfailed session optional pam_lastlog.so silent noupdate showfailed
Rationale:	Users need to be aware of activity that occurs regarding their account. Providing users with information regarding the number of unsuccessful attempts that were made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators.
Severity:	low
Identifiers and References	Identifiers: CCE-27275-7 References: RHEL-07-040530, SV-86899r3_rule, 1, 12, 15, 16, 5.5.2, DSS05.04, DSS05.10, DSS06.10, CCI-000366, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-9, PR.AC-7, Req-10.2.4, SRG-OS-000480-GPOS-00227
Remediation Shell script: (show) `if $(grep -q "^session.*pam_lastlog.so" /etc/pam.d/postlogin) ; then sed -i --follow-symlinks "/pam_lastlog.so/d" /etc/pam.d/postlogin fi echo "session [default=1] pam_lastlog.so nowtmp showfailed" >> /etc/pam.d/postlogin echo "session optional pam_lastlog.so silent noupdate showfailed" >> /etc/pam.d/postlogin`

Group 10.2.5 Group contains 3 groups and 1 rule

[ref] Use of and changes to

Group 10.2.5.a

[ref] Verify use of identification and authentication

Group 10.2.5.b

[ref] Verify all elevation of privileges is logged.

Group 10.2.5.c

[ref] Verify all changes, additions, or deletions to any account

Rule Record Events that Modify User/Group Information [ref]
If the `auditd` daemon is configured to use the `augenrules` program to read audit rules during daemon startup (the default), add the following lines to a file with suffix `.rules` in the directory `/etc/audit/rules.d`, in order to capture events that modify account changes: -w /etc/group -p wa -k audit_rules_usergroup_modification -w /etc/passwd -p wa -k audit_rules_usergroup_modification -w /etc/gshadow -p wa -k audit_rules_usergroup_modification -w /etc/shadow -p wa -k audit_rules_usergroup_modification -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification If the `auditd` daemon is configured to use the `auditctl` utility to read audit rules during daemon startup, add the following lines to `/etc/audit/audit.rules` file, in order to capture events that modify account changes: -w /etc/group -p wa -k audit_rules_usergroup_modification -w /etc/passwd -p wa -k audit_rules_usergroup_modification -w /etc/gshadow -p wa -k audit_rules_usergroup_modification -w /etc/shadow -p wa -k audit_rules_usergroup_modification -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification Warning: This rule checks for multiple syscalls related to account changes; it was written with DISA STIG in mind. Other policies should use a separate rule for each syscall that needs to be checked. For example: `audit_rules_usergroup_modification_group` `audit_rules_usergroup_modification_gshadow` `audit_rules_usergroup_modification_passwd`
Rationale:	In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications should be investigated for legitimacy.
Severity:	medium
Identifiers and References	Identifiers: CCE-27192-4 References: RHEL-07-030710, SV-86789r4_rule, 5.2.5, 1, 11, 12, 13, 14, 15, 16, 18, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000018, CCI-000172, CCI-001403, CCI-002130, 4.2.3.10, 4.3.2.6.7, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.8, 4.3.3.6.6, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-2(4), AC-17(7), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5, DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-6, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.2.5, SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000241-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221
Remediation Shell script: (show) # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' # Function to fix audit file system object watch rule for given path: # * if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/etc/group" "wa" "audit_rules_usergroup_modification" fix_audit_watch_rule "augenrules" "/etc/group" "wa" "audit_rules_usergroup_modification" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/etc/passwd" "wa" "audit_rules_usergroup_modification" fix_audit_watch_rule "augenrules" "/etc/passwd" "wa" "audit_rules_usergroup_modification" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.$/\1$current_access_bits\3/" "$audit_rules_file" else # Rule isn't present yet. Append it at the end of $audit_rules_file file # with proper key echo "-w $path -p $required_access_bits -k $key" >> "$audit_rules_file" fi done } fix_audit_watch_rule "auditctl" "/etc/gshadow" "wa" "audit_rules_usergroup_modification" fix_audit_watch_rule "augenrules" "/etc/gshadow" "wa" "audit_rules_usergroup_modification" # Function to fix audit file system object watch rule for given path: # if rule exists, also verifies the -w bits match the requirements # * if rule doesn't exist yet, appends expected rule form to $files_to_inspect # audit rules file, depending on the tool which was used to load audit rules # # Expects four arguments (each of them is required) in the form of: # * audit tool tool used to load audit rules, # either 'auditctl', or 'augenrules' # * path value of -w audit rule's argument # * required access bits value of -p audit rule's argument # * key value of -k audit rule's argument # # Example call: # # fix_audit_watch_rule "auditctl" "/etc/localtime" "wa" "audit_time_rules" # function fix_audit_watch_rule { # Load function arguments into local variables local tool="$1" local path="$2" local required_access_bits="$3" local key="$4" # Check sanity of the input if [ $# -ne "4" ] then echo "Usage: fix_audit_watch_rule 'tool' 'path' 'bits' 'key'" echo "Aborting." exit 1 fi # Create a list of audit .rules files that should be inspected for presence and correctness # of a particular audit rule. The scheme is as follows: # # ----------------------------------------------------------------------------------------- # Tool used to load audit rules \| Rule already defined \| Audit rules file to inspect \| # ----------------------------------------------------------------------------------------- # auditctl \| Doesn't matter \| /etc/audit/audit.rules \| # ----------------------------------------------------------------------------------------- # augenrules \| Yes \| /etc/audit/rules.d/.rules \| # augenrules \| No \| /etc/audit/rules.d/$key.rules \| # ----------------------------------------------------------------------------------------- declare -a files_to_inspect # Check sanity of the specified audit tool if [ "$tool" != 'auditctl' ] && [ "$tool" != 'augenrules' ] then echo "Unknown audit rules loading tool: $1. Aborting." echo "Use either 'auditctl' or 'augenrules'!" exit 1 # If the audit tool is 'auditctl', then add '/etc/audit/audit.rules' # into the list of files to be inspected elif [ "$tool" == 'auditctl' ] then files_to_inspect=("${files_to_inspect[@]}" '/etc/audit/audit.rules') # If the audit is 'augenrules', then check if rule is already defined # If rule is defined, add '/etc/audit/rules.d/.rules' to list of files for inspection. # If rule isn't defined, add '/etc/audit/rules.d/$key.rules' to list of files for inspection. elif [ "$tool" == 'augenrules' ] then # Backup IFS value IFS_BKP="$IFS" # Case when particular audit rule is already defined in some of /etc/audit/rules.d/.rules file # Get pair -- filepath : matching_row into @matches array IFS=$'\n' matches=($(grep -P "[\s]-w[\s]+$path" /etc/audit/rules.d/.rules)) # Reset IFS back to default IFS="$IFS_BKP" # For each of the matched entries for match in "${matches[@]}" do # Extract filepath from the match rulesd_audit_file=$(echo $match \| cut -f1 -d ':') # Append that path into list of files for inspection files_to_inspect=("${files_to_inspect[@]}" "$rulesd_audit_file") done # Case when particular audit rule isn't defined yet if [ ${#files_to_inspect[@]} -eq "0" ] then # Append '/etc/audit/rules.d/$key.rules' into list of files for inspection files_to_inspect="/etc/audit/rules.d/$key.rules" # If the $key.rules file doesn't exist yet, create it with correct permissions if [ ! -e "$files_to_inspect" ] then touch "$files_to_inspect" chmod 0640 "$files_to_inspect" fi fi fi # Finally perform the inspection and possible subsequent audit rule # correction for each of the files previously identified for inspection for audit_rules_file in "${files_to_inspect[@]}" do # Check if audit watch file system object rule for given path already present if grep -q -P -- "[\s]-w[\s]+$path" "$audit_rules_file" then # Rule is found => verify yet if existing rule definition contains # all of the required access type bits # Escape slashes in path for use in sed pattern below local esc_path=${path//$'/'/$'\/'} # Define BRE whitespace class shortcut local sp="[[:space:]]" # Extract current permission access types (e.g. -p [r\|w\|x\|a] values) from audit rule current_access_bits=$(sed -ne "s/$sp-w$sp\+$esc_path$sp\+-p$sp\+$[rxwa]\{1,4\}$./\1/p" "$audit_rules_file") # Split required access bits string into characters array # (to check bit's presence for one bit at a time) for access_bit in $(echo "$required_access_bits" \| grep -o .) do # For each from the required access bits (e.g. 'w', 'a') check # if they are already present in current access bits for rule. # If not, append that bit at the end if ! grep -q "$access_bit" <<< "$current_access_bits" then # Concatenate the existing mask with the missing bit current_access_bits="$current_access_bits$access_bit" fi done # Propagate the updated rule's access bits (original + the required # ones) back into the /etc/audit/audit.rules file for that rule sed -i "s/$$sp-w$sp\+$esc_path$sp\+-p$sp\+$$[rxwa]\{1,4\}$$.*$/\1$