Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix ansible remediation for audispd plugin UBTU-20-010216 #12293

Merged
merged 1 commit into from
Aug 21, 2024
Merged

Fix ansible remediation for audispd plugin UBTU-20-010216 #12293

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 22 additions & 3 deletions ...configure_auditd_data_retention/auditd_audispd_configure_remote_server/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,32 @@
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro
# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
{{{ ansible_instantiate_variables("var_audispd_remote_server") }}}
{{% set audisp_config_file_path = audisp_conf_path + "/audisp-remote.conf" %}}

- name: Make sure that a remote server is configured for Audispd
lineinfile:
{{% if 'ubuntu' in product %}}
{{% set audisp_config_plugin_path = audisp_conf_path + "/plugins.d/au-remote.conf" %}}
- name: "{{{ rule_title }}} - Uncomment active for offloading to remote server"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_plugin_path }}}"
regexp: ^(#.*)(active\s*=)
line: \2
backrefs: true

- name: "{{{ rule_title }}} - Set active to true for offloading to remote server"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_plugin_path }}}"
regexp: ^(.*)(active\s*=)(?!.*yes)
line: \2 yes
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test scenarios for this rule, eg. ubuntu_correct.pass.sh, use a capital A in Active, however, this remediation and the rule description use small a in `active. The OVAL seems to correctly use a case-insensitive regex modifier. Could you investigate this discrepancy about the A case?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! Thanks for the feedback, I will take a look at this

Copy link
Author

@ghost ghost Aug 12, 2024 •
edited by ghost
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure how you would like to proceed since the STIG and man page seem to use active over Active. Though, I don't think this would matter as it is case insensitive. The bash remediation is also active instead of capital A.

Not sure if this is helpful, but I found these related docs:

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for confirming that these options are case insensitive. Based on that, I think that:

  • in the rule description we can use whatever we want, ie. it can stay lowercase
  • in the OVAL we should use case-insentive check, which we already have
  • the Ansible and Bash remediations should be able to set the correct option value regardless of the case used in the file (it can change it to lowercase during the remediation if that's convenient for us)
  • the test scenarios should be testing multiple different letter cases.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the bash remediation makes use of set_config_file macro which has a insensitive parameter. Perhaps ansible needs the same parameter, as ansible_set_config_file doesn't have one.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good idea, I'll work on adding the insensitive capabilities for ansible_set_config_file. Should this change be here or should I open up a new PR?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dodys excellent idea!

@yunimoo If the change of the macro would be large it would be better to have it as a separate PR.

create: true
state: present
backrefs: true
{{% endif %}}

- name: "{{{ rule_title }}} - Make sure that a remote server is configured for Audispd"
ansible.builtin.lineinfile:
path: "{{{ audisp_config_file_path }}}"
line: "remote_server = {{ var_audispd_remote_server }}"
regexp: '^\s*remote_server\s*=.*$'
Expand Down
Loading