Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feb 24 updates #455

Merged
merged 3 commits into from
Mar 6, 2024
Merged

Feb 24 updates #455

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
540b8ed
issue #452 addressed
uk-bolly Mar 5, 2024
853f882
issue #453 addressed
uk-bolly Mar 5, 2024
e234b70
updated for galaxy_ng reqs
uk-bolly Mar 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,3 +220,7 @@ pre-commit run
## Credits

This repo originated from work done by [Sam Doran](https://github.com/samdoran/ansible-role-stig)

Massive thanks to the fantastic community and all its members.
This includes a huge thanks and credit to the original authors and maintainers.
Josh Springer, Daniel Shepherd, Bas Meijeri, James Cassell, Mike Renfro, DFed, George Nalen, Mark Bolwell
4 changes: 2 additions & 2 deletions meta/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
galaxy_info:
author: "Sam Doran, Josh Springer, Daniel Shepherd, James Cassell, Mike Renfro, DFed, George Nalen, Mark Bolwell"
author: "MindPoint Group"
description: "Apply the DISA RHEL 7 STIG"
company: "MindPoint Group"
license: MIT
Expand All @@ -10,7 +10,7 @@ galaxy_info:
platforms:
- name: EL
versions:
- 7
- '7'
galaxy_tags:
- system
- security
Expand Down
80 changes: 40 additions & 40 deletions templates/audit/99_auditd.rules.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,41 +8,41 @@
{% endif %}

{% if rhel_07_030370 %}
-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k perm_mod
{% endif %}

{% if rhel_07_030410 %}
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k perm_mod
{% endif %}

{% if rhel_07_030440 %}
-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k perm_mod
-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k perm_mod
{% endif %}

{% if rhel_07_030510 %}
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k access
{% endif %}

{% if rhel_07_030560 %}
-a always,exit -F path=/usr/sbin/semanage -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030570 %}
-a always,exit -F path=/usr/sbin/setsebool -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030580 %}
-a always,exit -F path=/usr/bin/chcon -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030590 %}
-a always,exit -F path=/usr/sbin/setfiles -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030610 %}
Expand All @@ -54,31 +54,31 @@
{% endif %}

{% if rhel_07_030630 %}
-a always,exit -F path=/usr/bin/passwd -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-passwd
-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-passwd
{% endif %}

{% if rhel_07_030640 %}
-a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-passwd
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-passwd
{% endif %}

{% if rhel_07_030650 %}
-a always,exit -F path=/usr/bin/gpasswd -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-passwd
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-passwd
{% endif %}

{% if rhel_07_030660 %}
-a always,exit -F path=/usr/bin/chage -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-passwd
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-passwd
{% endif %}

{% if rhel_07_030670 %}
-a always,exit -F path=/usr/sbin/userhelper -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-passwd
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-passwd
{% endif %}

{% if rhel_07_030680 %}
-a always,exit -F path=/usr/bin/su -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030690 %}
-a always,exit -F path=/usr/bin/sudo -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030700 %}
Expand All @@ -87,56 +87,56 @@
{% endif %}

{% if rhel_07_030710 %}
-a always,exit -F path=/usr/bin/newgrp -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030720 %}
-a always,exit -F path=/usr/bin/chsh -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-priv_change
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-priv_change
{% endif %}

{% if rhel_07_030740 %}
-a always,exit -F arch=b32 -S mount -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-mount
-a always,exit -F arch=b64 -S mount -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-mount
-a always,exit -F path=/usr/bin/mount -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-mount
-a always,exit -F arch=b32 -S mount -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-mount
-a always,exit -F arch=b64 -S mount -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-mount
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-mount
{% endif %}

{% if rhel_07_030750 %}
-a always,exit -F path=/usr/bin/umount -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-mount
-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-mount
{% endif %}

{% if rhel_07_030760 %}
-a always,exit -F path=/usr/sbin/postdrop -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-postfix
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-postfix
{% endif %}

{% if rhel_07_030770 %}
-a always,exit -F path=/usr/sbin/postqueue -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-postfix
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-postfix
{% endif %}

{% if rhel_07_030780 %}
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-ssh
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-ssh
{% endif %}

{% if rhel_07_030800 %}
-a always,exit -F path=/usr/bin/crontab -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-cron
-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-cron
{% endif %}

{% if rhel_07_030810 %}
-a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k privileged-pam
-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k privileged-pam
{% endif %}

{% if rhel_07_030819 %}
-a always,exit -F arch=b32 -S create_module -k module-change
-a always,exit -F arch=b64 -S create_module -k module-change
-a always,exit -F arch=b32 -S create_module -F auid>={{ rhel7stig_interactive_uid_start }} -k module-change
-a always,exit -F arch=b64 -S create_module -F auid>={{ rhel7stig_interactive_uid_start }} -k module-change
{% endif %}

{% if rhel_07_030820 %}
-a always,exit -F arch=b32 -S init_module,finit_module -k modulechange
-a always,exit -F arch=b64 -S init_module,finit_module -k modulechange
-a always,exit -F arch=b32 -S init_module,finit_module -F auid>={{ rhel7stig_interactive_uid_start }} -k modulechange
-a always,exit -F arch=b64 -S init_module,finit_module -F auid>={{ rhel7stig_interactive_uid_start }} -k modulechange
{% endif %}

{% if rhel_07_030830 %}
-a always,exit -F arch=b32 -S delete_module -k module-change
-a always,exit -F arch=b64 -S delete_module -k module-change
-a always,exit -F arch=b32 -S delete_module -F auid>={{ rhel7stig_interactive_uid_start }} -k module-change
-a always,exit -F arch=b64 -S delete_module -F auid>={{ rhel7stig_interactive_uid_start }} -k module-change
{% endif %}

{% if rhel_07_030840 %}
Expand Down Expand Up @@ -164,6 +164,6 @@
{% endif %}

{% if rhel_07_030910 %}
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>={{ rhel7stig_min_uid.stdout}} -F auid!=unset -k delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat,rmdir -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k delete
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat,rmdir -F auid>={{ rhel7stig_interactive_uid_start}} -F auid!=unset -k delete
{% endif %}