essay: differentiate redhat/debian, add extra conditions #44

juju4 · 2016-09-18T20:43:33Z

differentiate test for redhat and debian
Trying to add some test dependent on environment variable to handle context
add tests: entropy, rsyslog, auditd

some tests should be able to handle multiple acceptable results like sysctl or syslog server (rsyslog here but could be syslog-ng or else)
Some maybe dependent on environment like auditd is not possible inside a container (docker or lxc) but it does not seem trivial to have node context (http://jakshi.com/blog/2014/05/12/accessing-chef-attributes-in-serverspec-tests/; test-kitchen/test-kitchen#174)

Feel free to had comment.
Also have a hardening profile like https://github.com/juju4/ansible-harden

…r ENV dependent test

atomic111 · 2016-10-06T15:59:40Z

@juju4 thanks for your PR. at first we have to fix the testing issue or maybe you want to fix this

juju4 · 2016-10-10T21:29:17Z

at this point, checking seems to fail to dependency on higher ruby release.
It's not something that I change so don't see why it fails.

I'm more looking into a way to have different group of acceptable conditions first (some sysctl or rsyslog/syslog-ng)

juju4 · 2016-12-19T07:47:10Z

from rvm/rvm#3583, seems a rubygems issue
updating seems the way to go: https://stackoverflow.com/questions/35103008/error-while-installing-rack
tried that and also pin rack for ruby<=2.2.2 but travis still fails.
on my ruby 2.3 test box, it's ok.

can you have a look?

Thanks

atomic111 · 2016-12-19T07:49:35Z

@juju4 thank you for the great work. you can remove the ruby 1.9.3 support. have a look at https://github.com/dev-sec/tests-ssh-hardening/blob/master/Gemfile. then it should work as you mentioned,

…onal

juju4 · 2016-12-19T09:30:04Z

Thanks for the hint. still unrelated issue
https://travis-ci.org/juju4/tests-os-hardening/jobs/185094285#L227

$ bundle exec rake
rake aborted!
NoMethodError: undefined method `last_comment' for #<Rake::Application:0x00000002bede38>
/home/travis/build/juju4/tests-os-hardening/vendor/bundle/ruby/2.3.0/gems/rubocop-0.36.0/lib/rubocop/rake_task.rb:24:in `initialize'

atomic111 · 2016-12-19T12:13:00Z

@juju4 i tested the stuff and got the following gemfile

# encoding: utf-8

source 'https://rubygems.org'

gem 'rack', '~> 1.6.4'
gem 'rake'
gem 'inspec', '~> 1'
gem 'rubocop', '~> 0.44.0'
gem 'highline', '~> 1.6.0'

group :tools do
  gem 'github_changelog_generator', '~> 1.12.0'
end

now it is working and got pretty much rubocop errors. can you fix this, please

juju4 · 2016-12-19T13:44:05Z

with lighter Gemfile, got expected rubocop warning with ruby 2.3
https://travis-ci.org/juju4/tests-os-hardening/jobs/185148546#L214

but same error on rack for older ruby
https://travis-ci.org/juju4/tests-os-hardening/jobs/185148545#L176

I don't understand why so much difference with https://github.com/dev-sec/ssh-baseline (name change today?)

atomic111 · 2016-12-20T13:53:09Z

@juju4 i will tests this in the next days

chris-rock

Hi @juju4 thank you for all the work and the help to make our profile better. We are following best practices and I would like to see some references for additional security like bettercrypto.org etc.

In addition I would like to understand why the profile has not worked for you for debian or redhat. We are testing it continuously with our Chef/Ansible/Puppet implementation.

Could you please also share the difficulties with container environments. I'd like to understand the issues a little bit better.

chris-rock · 2016-12-21T09:58:46Z

controls/os_spec.rb

@@ -18,6 +18,27 @@
 # author: Dominik Richter
 # author: Patrick Muench

+if ENV['login_defs_umask']


@juju4 we should use InSpec attributes here:

val_user = attribute('user', default: 'alice', description: 'An identification for the user') val_password = attribute('password', description: 'A value for the password')

See http://inspec.io/docs/reference/profiles/

I think that the docs/code are new since the time I tried. great addition!

chris-rock · 2016-12-21T10:02:36Z

controls/os_spec.rb

    it { should_not be_readable.by('other') }
  end
+  describe file('/etc/shadow'), :if => os.family == 'redhat' do


InSpec does not support the Serverspec/RSpec if conditions :if => os.family == 'redhat'. Instead I would prefer to set a variable before and validate the value eg.

if os.redhat? shadow_group = 'root' else if os.debian? shadow_group = 'shadow' end

ok. will review that

chris-rock · 2016-12-21T10:02:56Z

controls/os_spec.rb

+  end
+  describe file('/etc/shadow'), :if => os.family == 'debian' do
+    its('group') { should eq 'shadow' }
+    it { should be_readable.by('group') }


Can please reference the debian hardening guide where you got this from?

I think it's more my testing experience on Ubuntu...
also see here https://help.ubuntu.com/community/FilePermissions

chris-rock · 2016-12-21T10:03:24Z

controls/os_spec.rb

    it { should be_readable.by('owner') }
    it { should be_readable.by('group') }
    it { should be_readable.by('other') }
  end
+  describe file('/etc/login.defs'), :if => os.family == 'redhat' do


Why should this checked on redhat only?

because unless you are not using different values, they are default and not needed/present in login.defs of ubuntu
http://manpages.ubuntu.com/manpages/trusty/man5/login.defs.5.html

SYS_UID_MAX (number), SYS_UID_MIN (number)
Range of user IDs used for the creation of system users by useradd
or newusers.

The default value for SYS_UID_MIN (resp. SYS_UID_MAX) is 101 (resp. UID_MIN-1).

which results in the same range 101-999 (except 100)

that something that is valid for other config files like ssh.
when the value is default, do we want to push it also?
issues

clutter config files

default can change depending on version (especially true with ssh)

more explicit

chris-rock · 2016-12-21T10:04:35Z

controls/os_spec.rb

  end
+#  describe login_defs, :if => os.family == 'debian' do


Could you explain this step please?

chris-rock · 2016-12-21T10:05:06Z

controls/os_spec.rb

@@ -142,9 +179,24 @@
    '/usr/lib/pt_chown',                                          # pseudo-tty, needed?
    '/usr/lib/eject/dmcrypt-get-device',
    '/usr/lib/mc/cons.saver' # midnight commander screensaver
+#    # from Ubuntu xenial


Could you please explain why those are commented out?

want more testings/comments

chris-rock · 2016-12-21T10:06:00Z

controls/os_spec.rb

  ]

-  output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' -print 2>/dev/null | grep -v \'^find:\'')
+  output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' ! -path \'/var/lib/lxd/containers/*\' -print 2>/dev/null | grep -v \'^find:\'')


What happens with lxc here?

this directory contains root of the multiple lxc containers active on the system = will repeat totally or not usual system

example

# find / -perm -4000 -o -perm -2000 -type f ! -path '/proc/*' -print 2>/dev/null | grep -v '^find:' /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/ssh-agent /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/expiry /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/mlocate /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/screen /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/bsd-write /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/chage /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/wall /var/lib/lxd/containers/default-ubuntu-1604-1481820784/rootfs/usr/bin/crontab ...

ideally an option depending on what's your perspective on container: audit them from host with the host, from host with separate config, or inside the container.

chris-rock · 2016-12-21T10:07:28Z

controls/package_spec.rb

@@ -65,3 +65,38 @@
    it { should_not be_installed }
  end
 end
+
+## can also be syslog-ng...
+control 'package-07' do


I am not sure why we should enforce a specific logging environment. Syslog is only one way to achieve logging

Can you please reference the hardening guide, where this is specified?

clearly I don't want enforce a specific solution but on the contrary, have a control validated if other tools are used

default is rsyslog

syslog-ng should be possible
or an option to disable the control or an attribute. will do the latter

should probably include auditd (already done) and systemd-journald for recent systems.

chris-rock · 2016-12-21T10:09:57Z

controls/sysctl_spec.rb

+    describe kernel_parameter('net.ipv4.conf.all.forwarding') do
+      its(:value) { should eq 0 }
+    end
+#  end


we can add a only_if condition to the control block for servers where forwarding is required:

control 'sysctl-01' do impact 1.0 title 'IPv4 Forwarding' desc "If you're not intending for your system to forward traffic between interfaces, or if you only have a single interface, the forwarding function must be disable." describe kernel_parameter('net.ipv4.ip_forward') do its(:value) { should eq 0 } end describe kernel_parameter('net.ipv4.conf.all.forwarding') do its(:value) { should eq 0 } end only_if { sysctl_forwarding == true } end

chris-rock · 2016-12-21T11:08:13Z

@juju4 cool project https://github.com/juju4/ansible-harden Thanks for mentioning it

chris-rock · 2016-12-21T19:40:31Z

@juju4 Please rebase on latest master, that fixes the test issues.

juju4 · 2016-12-21T20:28:51Z

rubocop offenses left but does not seem different from upstream.

chris-rock · 2016-12-21T20:44:40Z

@juju4 latest master is all green: https://travis-ci.org/dev-sec/linux-baseline

juju4 · 2016-12-22T10:00:26Z

done with rubocop...
while I'm 100% for good conventions, I find some a bit unusual, strange or not very clear messages like discussed there
houndci/hound#310
rubocop/rubocop#1730
rubocop/rubocop#1708

atomic111 · 2017-02-08T20:07:23Z

@juju4 thanks for adding all the stuff. great work!!!

chris-rock · 2017-03-13T10:49:39Z

@artem-sidorenko put up a PR to implement this in #52

artem-sidorenko · 2017-03-17T20:21:23Z

@chris-rock @atomic111 as soon as we get chef-os-hardening fully running with CI tests, I would wish that we run each PR of linux-baseline with chef-os-hardening (manually?)

And/or another suggestion, what about having in the CI of linux-baseline a job with master branch of chef-os-hardenung? (and maybe a similar thing for ssh-baseline/chef-ssh-hardening). Via this way we would have a cross testing, so problems with some changes like in this PR would be visible directly

chris-rock · 2017-03-17T20:22:53Z

I like that idea. We should just make sure that this will be an optional cross check. A failure does not mean it cannot be merged. Lets open another ticket for that

in order to match the defaults of all mainstream distros Some of settings are removed, as the defaults of distros are different, based on the intention of author [1] they are also not really important here [1]: dev-sec#44 (comment)

in order to match the defaults of all mainstream distros Some of settings are removed, as the defaults of distros are different, based on the intention of author [1] they are also not really important here [1]: dev-sec#44 (comment) Signed-off-by: Artem Sidorenko <[email protected]>

differentiate redhat/debian test, add extra conditions like entropy o…

790371c

…r ENV dependent test

juju4 added 6 commits December 18, 2016 14:40

README add travis build status

68bc615

travis: force rubygems update

80eb435

travis: force rubygems update before_install

0f0070a

travis: force rubygems update without bundle

34940bb

pin rack in Gemfile

932f810

quotes

f9e29c3

juju4 added 2 commits December 19, 2016 03:25

add travis test for ruby 2.3.1 + remove 1.9.3, remove Gemfile conditi…

7dd6045

…onal

typo

3275939

try Gemfile cleanup

e7b6c36

chris-rock reviewed Dec 21, 2016

View reviewed changes

use attributes, include PR feedback

cdcc9f7

juju4 added 2 commits December 21, 2016 15:19

rebase upstream

3fc52ec

+travis.yml

7878a04

juju4 added 4 commits December 22, 2016 04:09

fix rubocop Warning and most Conventions

e297ff2

fix rubocop Conventions

b2cd7ee

fix rubocop Conventions

4b029d7

fix rubocop Conventions

e62cb3f

juju4 added 6 commits December 22, 2016 04:34

fix rubocop Conventions

f207161

fix rubocop Conventions

1726723

fix rubocop Conventions

50abb79

fix rubocop Conventions

c27fc05

fix rubocop Conventions

ed00917

fix rubocop Conventions

1ec817f

Merge branch 'master' into master

f5f905d

atomic111 approved these changes Feb 8, 2017

View reviewed changes

atomic111 merged commit 50e28b5 into dev-sec:master Feb 8, 2017

artem-sidorenko mentioned this pull request Mar 17, 2017

CI: run linux-baseline with master branch of chef-os-hardening #55

Open

artem-sidorenko mentioned this pull request May 22, 2017

Proper permissions for shadow on debian family dev-sec/chef-os-hardening#162

Merged

essay: differentiate redhat/debian, add extra conditions #44

essay: differentiate redhat/debian, add extra conditions #44

Conversation

juju4 commented Sep 18, 2016

atomic111 commented Oct 6, 2016

juju4 commented Oct 10, 2016

juju4 commented Dec 19, 2016

atomic111 commented Dec 19, 2016

juju4 commented Dec 19, 2016

atomic111 commented Dec 19, 2016 • edited Loading

juju4 commented Dec 19, 2016

atomic111 commented Dec 20, 2016

chris-rock left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chris-rock commented Dec 21, 2016

chris-rock commented Dec 21, 2016

juju4 commented Dec 21, 2016

chris-rock commented Dec 21, 2016

juju4 commented Dec 22, 2016

atomic111 commented Feb 8, 2017

chris-rock commented Mar 13, 2017

artem-sidorenko commented Mar 17, 2017

chris-rock commented Mar 17, 2017

atomic111 commented Dec 19, 2016 •

edited

Loading