Running PR for Profile review and Fix

Review.md

@@ -23,4 +23,5 @@
 
 Another tip is to cat all the controls into a single file so you don't have to open every individaul file and try to keep track of where you are and which one is next.
 
+
 *** A completion date is entered in a row when all non-enhancement issues are resolved for that review row.

controls/V-81845.rb

@@ -39,86 +39,7 @@
   tag "documentable": false
   tag "severity_override_guidance": false
 
-  a = []
-  dbnames = []
-
-  if input('mongo_use_pki') == 'true'
-    get_databases = command("sudo mongo --ssl --sslPEMKeyFile #{input('mongod_client_pem')} --sslCAFile #{input('mongod_cafile')} \
-    --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509 --host #{input('mongod_hostname')} \
-    --quiet --eval 'JSON.stringify(db.adminCommand( { listDatabases: 1, nameOnly: true}))'").stdout.strip.split('"name":"')
-  else
-    get_databases = command("mongo -u '#{input('user')}' -p '#{input('password')}' --quiet --eval \
-    'JSON.stringify(db.adminCommand( { listDatabases: 1, nameOnly: true}))'").stdout.strip.split('"name":"')
+  describe 'A manual review is required to determine the required levels of protection for DBMS server securables by type of login.' do
+    skip 'A manual review is required to determine the required levels of protection for DBMS server securables by type of login.'
   end
-
-  if get_databases.grep(/error/).empty? == false
-    describe 'Verify the correct credentials or a valid client certificate is used to execute the query.' do
-      skip 'Verify the correct credentials or a valid client certificate is used to execute the query.'
-    end
-  else
-    get_databases.each do |db|
-      if db.include? 'databases'
-
-        a.push(db)
-        get_databases.delete(db)
-      end
-    end
-
-    get_databases.each do |db|
-
-      loc_colon = db.index('"')
-      names = db[0, loc_colon]
-      dbnames.push(names)
-    end
-
-    if dbnames.empty?
-      describe 'There are no mongo databases, therefore for this control is NA' do
-        skip 'There are no mongo databases, therefore for this control is NA'
-      end
-    end
-
-    if !dbnames.empty?
-      dbnames.each do |dbs|
-        if input('mongo_use_pki') == 'true'
-          users = command("sudo mongo admin --ssl --sslPEMKeyFile #{input('mongod_client_pem')} --sslCAFile #{input('mongod_cafile')} \
-          --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509 --host #{input('mongod_hostname')} \
-          --quiet --eval 'db.system.users.find({db: \"#{dbs}\"}, {user: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-        else
-          users = command("mongo admin -u '#{input('user')}' -p '#{input('password')}' --quiet --eval \
-          'db.system.users.find({db: \"#{dbs}\"}, {user: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-        end 
-
-        users.each do |t|
-
-          loc_colon = t.index(':')
-
-          user = t[loc_colon+3..-1]
-
-          loc_quote = user.index('"')
-
-          username = user[0, loc_quote]
-
-          if input('mongo_use_pki') == 'true'
-            getdb_roles = command("sudo mongo admin --ssl --sslPEMKeyFile #{input('mongod_client_pem')} --sslCAFile #{input('mongod_cafile')} \
-            --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509 --host #{input('mongod_hostname')} \
-            --quiet --eval 'db.system.users.find({db: \"#{dbs}\", user: \"#{username}\"}, {roles: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-          else
-            getdb_roles = command("mongo admin -u '#{input('user')}' -p '#{input('password')}' --quiet --eval \
-            'db.system.users.find({db: \"#{dbs}\", user: \"#{username}\"}, {roles: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-          end
-
-          getdb_roles.each do |r|
-            remove_role = r.index('[')
-            rr = r[remove_role..-1]
-
-            allowed_role = username
-            describe "The database role for user: #{username}" do
-              subject { rr }
-              it { should be_in input("#{allowed_role}_allowed_role") }
-            end
-          end
-        end
-      end
-    end
-  end 
 end

controls/V-81849.rb

@@ -101,18 +101,22 @@
   tag "documentable": false
   tag "severity_override_guidance": false
 
-  if file(input('mongod_auditlog')).exist?
-    mongodb_auditlog_dir = command("dirname #{input('mongod_auditlog')}").stdout.strip
-    describe file(mongodb_auditlog_dir) do
-      it { should_not be_more_permissive_than('0700') } 
-      its('owner') { should be_in input('mongodb_service_account') }
-      its('group') { should be_in input('mongodb_service_group') }
-    end
-  else
-    describe file('/var/log') do
-      it { should_not be_more_permissive_than('0755') } 
-      its('owner') { should eq 'root' }
-      its('group') { should eq 'root' }
-    end
+  mongodb_auditlog_dir = yaml(input('mongod_conf'))['auditLog', 'path']
+  mongodb_service_account = input('mongodb_service_account')
+  mongodb_service_group = input('mongodb_service_group')
+
+  describe file(mongodb_auditlog_dir) do
+    it { should exist }
+  end
+
+  describe file(mongodb_auditlog_dir) do
+    it { should_not be_more_permissive_than('0700') } 
+    its('owner') { should be_in mongodb_service_account }
+    its('group') { should be_in mongodb_service_group }
   end
+
+  describe command("dirname #{mongodb_auditlog_dir}") do
+    it { should cmp '/var/lib/mongo'}
+  end
+
 end

controls/V-81851.rb

@@ -67,10 +67,13 @@
   tag "nist": ["AU-9"]
   tag "documentable": false
   tag "severity_override_guidance": false
+
+  mongodb_service_account = input('mongodb_service_account')
+  mongodb_service_group = input('mongodb_service_group')
 
   describe file(input('mongod_conf')) do
     it { should_not be_more_permissive_than('0700') } 
-    its('owner') { should be_in input('mongodb_service_account') }
-    its('group') { should be_in input('mongodb_service_group') }
+    its('owner') { should be_in mongodb_service_account }
+    its('group') { should be_in mongodb_service_group }
   end
 end

controls/V-81855.rb

@@ -47,12 +47,9 @@
   tag "documentable": false
   tag "severity_override_guidance": false
 
-  if input('is_docker') == 'true'
-    describe "The MongoDB is installed within a Docker container so it is 
-    separate from the host OS, therefore this is not a finding." do
-      subject { virtualization.system }
-      it {should cmp 'docker'}
-    end
+  if virtualization.system.eql?('docker')
+    impact 0.0
+    desc 'caveat', 'This is Not Applicable since the MongoDB is installed within a Docker container so it is separate from the host OS'
   else
     describe "This test requires a Manual Review: Ensure all database software, 
     including DBMS configuration files, is stored in dedicated directories, or 

controls/V-81857.rb

@@ -58,87 +58,7 @@
   tag "documentable": false
   tag "severity_override_guidance": false
 
-  a = []
-  dbnames = []
-
-  if input('mongo_use_pki') == 'true'
-    get_databases = command("sudo mongo --ssl --sslPEMKeyFile #{input('mongod_client_pem')} --sslCAFile #{input('mongod_cafile')} \
-    --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509 --host #{input('mongod_hostname')} \
-    --quiet --eval 'JSON.stringify(db.adminCommand( { listDatabases: 1, nameOnly: true}))'").stdout.strip.split('"name":"')
-  else
-    get_databases = command("mongo -u '#{input('user')}' -p '#{input('password')}' \
-    --quiet --eval 'JSON.stringify(db.adminCommand( { listDatabases: 1, nameOnly: true}))'").stdout.strip.split('"name":"')
-  end 
-
-  if get_databases.grep(/error/).empty? == false
-    describe 'Verify the correct credentials or a valid client certificate is used to execute the query.' do
-      skip 'Verify the correct credentials or a valid client certificate is used to execute the query.'
-    end
-  else
-    get_databases.each do |db|
-      if db.include? 'databases'
-
-        a.push(db)
-        get_databases.delete(db)
-      end
-    end
-
-    get_databases.each do |db|
-
-      loc_colon = db.index('"')
-      names = db[0, loc_colon]
-      dbnames.push(names)
-    end
-
-    if dbnames.empty?
-      describe 'There are no mongo databases, therefore for this control is NA' do
-        skip 'There are no mongo databases, therefore for this control is NA'
-      end
-    end
-
-    if !dbnames.empty?
-      dbnames.each do |dbs|
-
-        if input('mongo_use_pki') == 'true'
-          users = command("sudo mongo admin --ssl --sslPEMKeyFile #{input('mongod_client_pem')} --sslCAFile #{input('mongod_cafile')} \
-          --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509 --host #{input('mongod_hostname')} \
-          --quiet --eval 'db.system.users.find({db: \"#{dbs}\"}, {user: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-        else
-          users = command("mongo admin -u '#{input('user')}' -p '#{input('password')}' \
-          --quiet --eval 'db.system.users.find({db: \"#{dbs}\"}, {user: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-        end 
-
-        users.each do |t|
-
-          loc_colon = t.index(':')
-
-          user = t[loc_colon+3..-1]
-
-          loc_quote = user.index('"')
-
-          username = user[0, loc_quote]
-
-          if input('mongo_use_pki') == 'true'
-            getdb_roles = command("sudo mongo admin --ssl --sslPEMKeyFile #{input('mongod_client_pem')} --sslCAFile #{input('mongod_cafile')} \
-            --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509 --host #{input('mongod_hostname')} \
-            --quiet --eval 'db.system.users.find({db: \"#{dbs}\", user: \"#{username}\"}, {roles: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-          else
-            getdb_roles = command("mongo admin -u '#{input('user')}' -p '#{input('password')}' \
-            --quiet --eval 'db.system.users.find({db: \"#{dbs}\", user: \"#{username}\"}, {roles: 1, _id: false, distinct: 1})'").stdout.strip.split("\n")
-          end
-
-          getdb_roles.each do |r|
-            remove_role = r.index('[')
-            rr = r[remove_role..-1]
-
-            allowed_role = username
-            describe "The database role for user: #{username}" do
-              subject { rr }
-              it { should be_in input("#{allowed_role}_allowed_role") }
-            end
-          end
-        end
-      end
-    end
+  describe 'A manual review is required to determine if any roles or users have unauthorized access' do
+    skip 'A manual review is required to determine if any roles or users have unauthorized access'
   end
 end

controls/V-81859.rb

@@ -46,36 +46,21 @@
   tag "nist": ["CM-7 a"]
   tag "documentable": false
   tag "severity_override_guidance": false
-
-  if os.debian?
-    dpkg_packages = command("dpkg --get-selections | grep mongodb").stdout.split("\n")
-    if dpkg_packages.empty?
-      describe 'There are no mongo database packages installed, therefore for this control is NA' do
-        skip 'There are no mongo database packages installed, therefore for this control is NA'
-      end
-    else
-      dpkg_packages.each do |package|
-        package = command("echo #{package} | sed 's/ hold$//'").stdout.split
-        describe "The installed mongodb package: #{package}" do
-          subject { package }
-          it { should be_in input('mongodb_debian_packages') }
-        end
-      end
+
+
+  approved_mongo_packages = input('approved_mongo_packages')
+
+  dpkg_packages = packages(/mongodb/).names
+  if dpkg_packages.empty?
+    describe 'There are no mongo database packages installed, therefore for this control is NA' do
+      skip 'There are no mongo database packages installed, therefore for this control is NA'
     end
-  elsif os.redhat?
-    rpm_packages = command("rpm -qa | grep mongodb").stdout.split("\n")
-    if rpm_packages.empty?
-      describe 'There are no mongo database packages installed, therefore for this control is NA' do
-        skip 'There are no mongo database packages installed, therefore for this control is NA'
-      end
-    else
-      rpm_packages.each do |package|
-        package = command("echo #{package} | sed 's/.x86.*//'").stdout.split
-        describe "The installed mongodb package: #{package}" do
-          subject { package }
-          it { should be_in input('mongodb_redhat_packages') }
-        end
+  else
+    dpkg_packages.each do |package|
+      describe "The installed mongodb package: #{package}" do
+        subject { package }
+        it { should be_in approved_mongo_packages }
       end
     end
   end
-end
+end

controls/V-81861.rb

@@ -57,30 +57,30 @@
   tag "documentable": false
   tag "severity_override_guidance": false
 
-  mongo_conf_file = input('mongod_conf')
+  mongo_conf_file = input('mongod_conf').to_s
   describe.one do
-    describe yaml(mongo_conf_file.to_s) do
+    describe yaml(mongo_conf_file) do
       its(%w{net http enabled}) { should cmp 'false' }
     end
-    describe yaml(mongo_conf_file.to_s) do
+    describe yaml(mongo_conf_file) do
       its(%w{net http enabled}) { should be_nil }
     end
   end
 
   describe.one do
-    describe yaml(mongo_conf_file.to_s) do
+    describe yaml(mongo_conf_file) do
       its(%w{net http JSONPEnabled}) { should cmp 'false' }
     end
-    describe yaml(mongo_conf_file.to_s) do
+    describe yaml(mongo_conf_file) do
       its(%w{net http JSONPEnabled}) { should be_nil }
     end
   end
 
   describe.one do
-    describe yaml(mongo_conf_file.to_s) do
+    describe yaml(mongo_conf_file) do
       its(%w{net http RESTInterfaceEnabled}) { should cmp 'false' }
     end
-    describe yaml(mongo_conf_file.to_s) do
+    describe yaml(mongo_conf_file) do
       its(%w{net http RESTInterfaceEnabled}) { should be_nil }
     end
   end

controls/V-81869.rb

@@ -60,8 +60,13 @@
   tag "documentable": false
   tag "severity_override_guidance": false
 
-  describe yaml(input('mongod_conf')) do
-    its(%w{net ssl allowInvalidCertificates}) { should be nil }
+  describe.one do
+    describe yaml(input('mongod_conf')) do
+      its(%w{net ssl allowInvalidCertificates}) { should be nil }
+    end
+    describe yaml(input('mongod_conf')) do
+      its(%w{net ssl allowInvalidCertificates}) { should be false }
+    end
   end
   describe yaml(input('mongod_conf')) do
     its(%w{net ssl mode}) { should cmp 'requireSSL' }