From e7f1e45f0b3172b5b5a35a1822865fddbca6d9f0 Mon Sep 17 00:00:00 2001 From: wangqingsan Date: Wed, 19 Jun 2024 13:27:03 +0800 Subject: [PATCH] fix bug for oe --- .../oval/shared.xml | 2 +- .../oval/shared.xml | 2 +- .../sshd_set_max_auth_tries/oval/shared.xml | 14 ++++++++++++ .../accounts_umask_etc_bashrc/oval/shared.xml | 4 ++-- .../oval/shared.xml | 13 ++++++----- .../rsyslog_files_permissions_oe/rule.yml | 22 +++++++++++++++++++ .../service_ip6tables_enabled/rule.yml | 2 +- openeuler2203/profiles/standard.profile | 4 ++-- 8 files changed, 51 insertions(+), 12 deletions(-) create mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions_oe/rule.yml diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml index e6c1a0e..494e255 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_concurrent_unauthenticated_connections/oval/shared.xml @@ -19,7 +19,7 @@ /etc/ssh/sshd_config - ^maxstartups\s+\d+:\d+:\d+$ + ^MaxStartups\s*[0-9]*:[0-9]*:[0-9]*[0-9] 1 \ No newline at end of file diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml index fb79aff..30bc3c4 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_configure_correct_LoginGraceTime/oval/shared.xml @@ -19,7 +19,7 @@ /etc/ssh/sshd_config - ^LoginGraceTime\s+\d+$ + ^LoginGraceTime\s(\d*)[smhdw]*$ 1 \ No newline at end of file diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/oval/shared.xml index a8eaabd..ae811c7 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/oval/shared.xml @@ -8,14 +8,28 @@ The SSH MaxAuthTries should be set to an appropriate value. + {{% if product in ['openeuler2203'] %}} + + + + + {{% else %}} + {{% endif %}} + + + + diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml index 0bd0ac1..ec4197a 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/oval/shared.xml @@ -95,7 +95,7 @@ /etc/bashrc - [\s]*umask[\s]*0077[\s]* + ^umask[\s]*0*7*$ 1 @@ -104,7 +104,7 @@ ^/home/.*\.bashrc$ - [\s]*umask[\s]*0077[\s]* + ^umask[\s]*0*7*$ 1 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_install_and_remove/oval/shared.xml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_install_and_remove/oval/shared.xml index 92b2667..372e175 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_install_and_remove/oval/shared.xml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_install_and_remove/oval/shared.xml @@ -8,12 +8,15 @@ The audit rules should be configured to log information about kernel module installing and removing. - - - + + + + + + @@ -22,7 +25,7 @@ ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ + ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*.*$ 1 @@ -31,7 +34,7 @@ ^/etc/audit/rules\.d/.*\.rules$ - ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ + ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*.*$ 1 diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions_oe/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions_oe/rule.yml new file mode 100644 index 0000000..93fd68f --- /dev/null +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions_oe/rule.yml @@ -0,0 +1,22 @@ +documentation_complete: true + +title: 'Ensure System Log Files Have Correct Permissions' + +description: |- +

Log files record system operations. The log tool rsyslog can record logs + to specified files. When the specified log file does not exist in the system, + rsyslog can create a new log file. You can set the permission on new log files + in the rsyslog configuration file. You can set the default file permission to + ensure that new log files have proper and secure permissions.

+

Run the following command to manually check whether the log permission is properly set:

+ 
$ ls -l LOGFILE
+

If the permissions are not 600 or more restrictive, run the following + command to correct this:

+ 
$ sudo chmod 0600 LOGFILE
" + +rationale: |- + Log files can contain valuable information regarding system + configuration. If the system log files are not protected unauthorized + users could change the logged data, eliminating their forensic value. + +severity: low diff --git a/linux_os/guide/system/network/network-iptables/iptables_activation/service_ip6tables_enabled/rule.yml b/linux_os/guide/system/network/network-iptables/iptables_activation/service_ip6tables_enabled/rule.yml index d533940..a8ce14a 100644 --- a/linux_os/guide/system/network/network-iptables/iptables_activation/service_ip6tables_enabled/rule.yml +++ b/linux_os/guide/system/network/network-iptables/iptables_activation/service_ip6tables_enabled/rule.yml @@ -34,6 +34,6 @@ template: name: service_enabled vars: servicename: ip6tables - packagename: iptables-ipv6 + packagename: iptables platform: machine diff --git a/openeuler2203/profiles/standard.profile b/openeuler2203/profiles/standard.profile index 76fe4dd..4ae7a01 100644 --- a/openeuler2203/profiles/standard.profile +++ b/openeuler2203/profiles/standard.profile @@ -376,8 +376,8 @@ selections: - audit_rules_admin_privilege.severity=low - recorded_authentication_related_event - recorded_authentication_related_event.severity=high - - rsyslog_files_permissions - - rsyslog_files_permissions.severity=low + - rsyslog_files_permissions_oe + - rsyslog_files_permissions_oe.severity=low - partitions_manage_hard_drive_data - partitions_manage_hard_drive_data.severity=low - uninstall_debugging_tools -- 2.36.1