rpms
/
scap-security-guide
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixup! fixup! Added rule for tracking user sessions and locking screen when status changes

Browse Source
i9-inf1390 changed/i9-inf1390/scap-security-guide-0.1.73-1.el9_4.inferit.4
Sergey Cherevko 2 months ago
parent b4e2e1e3e7
commit 7b0881b9a9
Signed by: scherevko
GPG Key ID: D87CBBC16D2E4A72
2 changed files with 40 additions and 26 deletions
Show Stats Download Patch File Download Diff File

61
SOURCES/0001-Add-session-monitor-rule.patch
Unescape View File

@ -1,19 +1,19 @@
From 8b98419853a53dc399b4cf9415c22b3303793d95 Mon Sep 17 00:00:00 2001
From 6bd2cb26d40246bf7645355018e4b8154018d1e4 Mon Sep 17 00:00:00 2001
From: Sergey Cherevko <s.cherevko@msvsphere-os.ru>
Date: Tue, 17 Sep 2024 17:45:27 +0300
Date: Mon, 23 Sep 2024 11:56:30 +0300
Subject: [PATCH] Add session-monitor rule
---
CMakeLists.txt | 5 +
build_product | 1 +
components/session-monitor.yml | 6 +
.../rule.yml | 36 ++++++
.../rule.yml | 27 +++++
.../service_session-monitor_enabled/rule.yml | 40 +++++++
products/msvsphere9/CMakeLists.txt | 8 ++
.../cpe/msvsphere9-cpe-dictionary.xml | 10 ++
.../ssg-msvsphere9-session-monitor-ks.cfg | 112 ++++++++++++++++++
products/msvsphere9/product.yml | 26 ++++
.../profiles/session-monitor.profile | 13 ++
.../profiles/session-monitor.profile | 33 ++++++
products/msvsphere9/transforms/constants.xslt | 16 +++
.../msvsphere9/transforms/table-style.xslt | 5 +
.../transforms/xccdf-apply-overlay-stig.xslt | 8 ++
@ -21,10 +21,10 @@ Subject: [PATCH] Add session-monitor rule
.../xccdf2table-profileccirefs.xslt | 9 ++
.../oval/installed_OS_is_msvsphere9.xml | 34 ++++++
ssg/constants.py | 6 +-
17 files changed, 343 insertions(+), 1 deletion(-)
17 files changed, 354 insertions(+), 1 deletion(-)
create mode 100644 components/session-monitor.yml
create mode 100644 linux_os/guide/services/base/package_session-monitor_installed/rule.yml
create mode 100644 linux_os/guide/services/base/service_session-monitor_enabled/rule.yml
create mode 100644 linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml
create mode 100644 linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml
create mode 100644 products/msvsphere9/CMakeLists.txt
create mode 100644 products/msvsphere9/cpe/msvsphere9-cpe-dictionary.xml
create mode 100644 products/msvsphere9/kickstart/ssg-msvsphere9-session-monitor-ks.cfg
@ -91,12 +91,12 @@ index 00000000..af38d9b3
+rules:
+- package_session-monitor_installed
+- service_session-monitor_enabled
diff --git a/linux_os/guide/services/base/package_session-monitor_installed/rule.yml b/linux_os/guide/services/base/package_session-monitor_installed/rule.yml
diff --git a/linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml
new file mode 100644
index 00000000..479c7a83
index 00000000..c2b5f232
--- /dev/null
+++ b/linux_os/guide/services/base/package_session-monitor_installed/rule.yml
@@ -0,0 +1,36 @@
+++ b/linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml
@@ -0,0 +1,27 @@
+documentation_complete: true
+
+
@ -110,21 +110,12 @@ index 00000000..479c7a83
+rationale: |-
+ Monitor user sessions and lock screen on state change
+
+severity: low
+severity: high
+
+identifiers:
+ cce@rhel7: CCE-82403-7
+ cce@rhel8: CCE-82404-5
+
+references:
+ cis-csc: 1,11,12,13,14,15,16,2,3,5,6,7,8,9
+ cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,BAI03.05,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS03.05,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.06,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01
+ isa-62443-2009: 4.3.2.6.7,4.3.3.3.9,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4
+ isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 2.8,SR 2.9,SR 6.1,SR 6.2,SR 7.6'
+ iso27001-2013: A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.5.1,A.12.6.2,A.12.7.1,A.14.2.2,A.14.2.3,A.14.2.4,A.14.2.7,A.15.2.1,A.15.2.2,A.9.1.2
+ nist: AU-12(a),CM-6(a)
+ nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.IP-1,PR.PT-1,PR.PT-3
+
+ocil_clause: 'the package is not installed'
+
+ocil: '{{{ ocil_package(package="session-monitor") }}}'
@ -133,11 +124,11 @@ index 00000000..479c7a83
+ name: package_installed
+ vars:
+ pkgname: session-monitor
diff --git a/linux_os/guide/services/base/service_session-monitor_enabled/rule.yml b/linux_os/guide/services/base/service_session-monitor_enabled/rule.yml
diff --git a/linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml b/linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml
new file mode 100644
index 00000000..35942027
--- /dev/null
+++ b/linux_os/guide/services/base/service_session-monitor_enabled/rule.yml
+++ b/linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml
@@ -0,0 +1,40 @@
+documentation_complete: true
+
@ -361,10 +352,10 @@ index 00000000..f2b7f0f0
+ check_id: installed_OS_is_msvsphere9
diff --git a/products/msvsphere9/profiles/session-monitor.profile b/products/msvsphere9/profiles/session-monitor.profile
new file mode 100644
index 00000000..d261ebf5
index 00000000..594d59bb
--- /dev/null
+++ b/products/msvsphere9/profiles/session-monitor.profile
@@ -0,0 +1,13 @@
@@ -0,0 +1,33 @@
+documentation_complete: true
+
+title: 'Session-monitor profile for MSVSphere 9'
@ -376,6 +367,26 @@ index 00000000..d261ebf5
+
+selections:
+ - accounts_password_minlen_login_defs
+ - file_groupowner_etc_group
+ - file_groupowner_etc_gshadow
+ - file_groupowner_etc_passwd
+ - file_groupowner_etc_shadow
+ - file_owner_etc_group
+ - file_owner_etc_gshadow
+ - file_owner_etc_passwd
+ - file_owner_etc_shadow
+ - file_permissions_etc_group
+ - file_permissions_etc_gshadow
+ - file_permissions_etc_passwd
+ - file_permissions_etc_shadow
+ - no_empty_passwords
+ - sshd_disable_root_login
+ - sshd_disable_empty_passwords
+ - sshd_idle_timeout_value=5_minutes
+ - sshd_set_idle_timeout
+ - var_sshd_set_keepalive=0
+ - sshd_set_keepalive_0
+ - package_audit_installed
+ - package_session-monitor_installed
+ - service_session-monitor_enabled
diff --git a/products/msvsphere9/transforms/constants.xslt b/products/msvsphere9/transforms/constants.xslt

5
SPECS/scap-security-guide.spec
Unescape View File

@ -6,7 +6,7 @@
Name: scap-security-guide
Version: 0.1.73
Release: 1%{?dist}.inferit.3
Release: 1%{?dist}.inferit.4
Summary: Security guidance and baselines in SCAP formats
License: BSD-3-Clause
URL: https://github.com/ComplianceAsCode/content/
@ -105,6 +105,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md
%endif
%changelog
* Mon Sep 23 2024 Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 0.1.73-1.inferit.4
- Try and bump version
* Tue Sep 17 2024 Sergey Cherevko <s.cherevko@msvsphere-os.ru> - 0.1.73-1.inferit.3
- bump version

Write Preview
Loading…
Cancel
Save