From 7b0881b9a945669d36a871b5ec00962e75baa767 Mon Sep 17 00:00:00 2001 From: Sergey Cherevko Date: Mon, 23 Sep 2024 12:11:59 +0300 Subject: [PATCH] fixup! fixup! Added rule for tracking user sessions and locking screen when status changes --- SOURCES/0001-Add-session-monitor-rule.patch | 61 ++++++++++++--------- SPECS/scap-security-guide.spec | 5 +- 2 files changed, 40 insertions(+), 26 deletions(-) diff --git a/SOURCES/0001-Add-session-monitor-rule.patch b/SOURCES/0001-Add-session-monitor-rule.patch index 85f43bd..1339502 100644 --- a/SOURCES/0001-Add-session-monitor-rule.patch +++ b/SOURCES/0001-Add-session-monitor-rule.patch @@ -1,19 +1,19 @@ -From 8b98419853a53dc399b4cf9415c22b3303793d95 Mon Sep 17 00:00:00 2001 +From 6bd2cb26d40246bf7645355018e4b8154018d1e4 Mon Sep 17 00:00:00 2001 From: Sergey Cherevko -Date: Tue, 17 Sep 2024 17:45:27 +0300 +Date: Mon, 23 Sep 2024 11:56:30 +0300 Subject: [PATCH] Add session-monitor rule --- CMakeLists.txt | 5 + build_product | 1 + components/session-monitor.yml | 6 + - .../rule.yml | 36 ++++++ + .../rule.yml | 27 +++++ .../service_session-monitor_enabled/rule.yml | 40 +++++++ products/msvsphere9/CMakeLists.txt | 8 ++ .../cpe/msvsphere9-cpe-dictionary.xml | 10 ++ .../ssg-msvsphere9-session-monitor-ks.cfg | 112 ++++++++++++++++++ products/msvsphere9/product.yml | 26 ++++ - .../profiles/session-monitor.profile | 13 ++ + .../profiles/session-monitor.profile | 33 ++++++ products/msvsphere9/transforms/constants.xslt | 16 +++ .../msvsphere9/transforms/table-style.xslt | 5 + .../transforms/xccdf-apply-overlay-stig.xslt | 8 ++ @@ -21,10 +21,10 @@ Subject: [PATCH] Add session-monitor rule .../xccdf2table-profileccirefs.xslt | 9 ++ .../oval/installed_OS_is_msvsphere9.xml | 34 ++++++ ssg/constants.py | 6 +- - 17 files changed, 343 insertions(+), 1 deletion(-) + 17 files changed, 354 insertions(+), 1 deletion(-) create mode 100644 components/session-monitor.yml - create mode 100644 linux_os/guide/services/base/package_session-monitor_installed/rule.yml - create mode 100644 linux_os/guide/services/base/service_session-monitor_enabled/rule.yml + create mode 100644 linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml + create mode 100644 linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml create mode 100644 products/msvsphere9/CMakeLists.txt create mode 100644 products/msvsphere9/cpe/msvsphere9-cpe-dictionary.xml create mode 100644 products/msvsphere9/kickstart/ssg-msvsphere9-session-monitor-ks.cfg @@ -91,12 +91,12 @@ index 00000000..af38d9b3 +rules: +- package_session-monitor_installed +- service_session-monitor_enabled -diff --git a/linux_os/guide/services/base/package_session-monitor_installed/rule.yml b/linux_os/guide/services/base/package_session-monitor_installed/rule.yml +diff --git a/linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml new file mode 100644 -index 00000000..479c7a83 +index 00000000..c2b5f232 --- /dev/null -+++ b/linux_os/guide/services/base/package_session-monitor_installed/rule.yml -@@ -0,0 +1,36 @@ ++++ b/linux_os/guide/system/software/system-tools/package_session-monitor_installed/rule.yml +@@ -0,0 +1,27 @@ +documentation_complete: true + + @@ -110,21 +110,12 @@ index 00000000..479c7a83 +rationale: |- + Monitor user sessions and lock screen on state change + -+severity: low ++severity: high + +identifiers: + cce@rhel7: CCE-82403-7 + cce@rhel8: CCE-82404-5 + -+references: -+ cis-csc: 1,11,12,13,14,15,16,2,3,5,6,7,8,9 -+ cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,BAI03.05,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.03,DSS03.05,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.06,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01 -+ isa-62443-2009: 4.3.2.6.7,4.3.3.3.9,4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4 -+ isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.11,SR 1.12,SR 1.13,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.6,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.2,SR 2.3,SR 2.4,SR 2.5,SR 2.6,SR 2.7,SR 2.8,SR 2.9,SR 6.1,SR 6.2,SR 7.6' -+ iso27001-2013: A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.5.1,A.12.6.2,A.12.7.1,A.14.2.2,A.14.2.3,A.14.2.4,A.14.2.7,A.15.2.1,A.15.2.2,A.9.1.2 -+ nist: AU-12(a),CM-6(a) -+ nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.IP-1,PR.PT-1,PR.PT-3 -+ +ocil_clause: 'the package is not installed' + +ocil: '{{{ ocil_package(package="session-monitor") }}}' @@ -133,11 +124,11 @@ index 00000000..479c7a83 + name: package_installed + vars: + pkgname: session-monitor -diff --git a/linux_os/guide/services/base/service_session-monitor_enabled/rule.yml b/linux_os/guide/services/base/service_session-monitor_enabled/rule.yml +diff --git a/linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml b/linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml new file mode 100644 index 00000000..35942027 --- /dev/null -+++ b/linux_os/guide/services/base/service_session-monitor_enabled/rule.yml ++++ b/linux_os/guide/system/software/system-tools/service_session-monitor_enabled/rule.yml @@ -0,0 +1,40 @@ +documentation_complete: true + @@ -361,10 +352,10 @@ index 00000000..f2b7f0f0 + check_id: installed_OS_is_msvsphere9 diff --git a/products/msvsphere9/profiles/session-monitor.profile b/products/msvsphere9/profiles/session-monitor.profile new file mode 100644 -index 00000000..d261ebf5 +index 00000000..594d59bb --- /dev/null +++ b/products/msvsphere9/profiles/session-monitor.profile -@@ -0,0 +1,13 @@ +@@ -0,0 +1,33 @@ +documentation_complete: true + +title: 'Session-monitor profile for MSVSphere 9' @@ -376,6 +367,26 @@ index 00000000..d261ebf5 + +selections: + - accounts_password_minlen_login_defs ++ - file_groupowner_etc_group ++ - file_groupowner_etc_gshadow ++ - file_groupowner_etc_passwd ++ - file_groupowner_etc_shadow ++ - file_owner_etc_group ++ - file_owner_etc_gshadow ++ - file_owner_etc_passwd ++ - file_owner_etc_shadow ++ - file_permissions_etc_group ++ - file_permissions_etc_gshadow ++ - file_permissions_etc_passwd ++ - file_permissions_etc_shadow ++ - no_empty_passwords ++ - sshd_disable_root_login ++ - sshd_disable_empty_passwords ++ - sshd_idle_timeout_value=5_minutes ++ - sshd_set_idle_timeout ++ - var_sshd_set_keepalive=0 ++ - sshd_set_keepalive_0 ++ - package_audit_installed + - package_session-monitor_installed + - service_session-monitor_enabled diff --git a/products/msvsphere9/transforms/constants.xslt b/products/msvsphere9/transforms/constants.xslt diff --git a/SPECS/scap-security-guide.spec b/SPECS/scap-security-guide.spec index a62fa18..a40e107 100644 --- a/SPECS/scap-security-guide.spec +++ b/SPECS/scap-security-guide.spec @@ -6,7 +6,7 @@ Name: scap-security-guide Version: 0.1.73 -Release: 1%{?dist}.inferit.3 +Release: 1%{?dist}.inferit.4 Summary: Security guidance and baselines in SCAP formats License: BSD-3-Clause URL: https://github.com/ComplianceAsCode/content/ @@ -105,6 +105,9 @@ rm %{buildroot}/%{_docdir}/%{name}/Contributors.md %endif %changelog +* Mon Sep 23 2024 Sergey Cherevko - 0.1.73-1.inferit.4 +- Try and bump version + * Tue Sep 17 2024 Sergey Cherevko - 0.1.73-1.inferit.3 - bump version