Deprecated tests & Adding missing tests from RHEL7 STIG v2r4

attributes.yml

@@ -4,6 +4,20 @@
 # Controls that are known to consistently have long run times can be disabled with this attribute
 disable_slow_controls: false
 
+# Skips test that have been deprecated and removed from the STIG. 
+# Currently the following have been removed from the Latest STIG RHEL7 V2R4
+#    V-71895 - The operating system must set the idle delay setting for all connection types.
+#    V-71981 - The operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of packages without verification of the repository metadata.
+#    V-72143 - The operating system must generate audit records for all successful/unsuccessful account access count events.
+#    V-72169 - All uses of the sudoedit command must be audited.
+#    V-72181 - All uses of the pt_chown command must be audited.
+#    V-72193 - All uses of the rmmod command must be audited
+#    V-72195 - All uses of the modprobe command must be audited.
+#    V-72215 - The system must update the virus scan program every seven days or more frequently
+#    V-72435 - The operating system must implement smart card logons for multifactor authentication for access to privileged accounts.
+#    V-78995 - The operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.
+skip_deprecated_test: true
+
 # V-72081 - 'monitor_kernel_log', (bool)
 # Set this to false if your system availability concern is not documented or
 # there is no monitoring of the kernel log

controls/V-71849.rb

@@ -1,17 +1,8 @@
 # encoding: utf-8
 #
 # Support for passed in Atrributes
-disable_slow_controls = input(
-  'disable_slow_controls',
-  value: false,
-  description: 'If enabled, this attribute disables this control and other
-                controls that consistently take a long time to complete.'
-)
-rpm_verify_perms_except = input(
-  'rpm_verify_perms_except',
-  value: [],
-  description: 'This is a list of system files that should be allowed to change
-                permission attributes from an rpm verify point of view.')
+disable_slow_controls = input('disable_slow_controls')
+rpm_verify_perms_except = input('rpm_verify_perms_except')
 
 control "V-71849" do
   title "The file permissions, ownership, and group membership of system files and commands must match the vendor" \

controls/V-71855.rb

@@ -1,16 +1,8 @@
 # encoding: utf-8
 #
-disable_slow_controls = input(
-  'disable_slow_controls',
-  value: false,
-  description: 'If enabled, this attribute disables this control and other
-                controls that consistently take a long time to complete.')
+disable_slow_controls = input('disable_slow_controls')
 
-rpm_verify_integrity_except = input(
-  'rpm_verify_integrity_except',
-  value: [],
-  description: 'This is a list of system files that should be allowed to change
-                from an rpm verify point of view.')
+rpm_verify_integrity_except = input('rpm_verify_integrity_except')
 
 control "V-71855" do
   title "The cryptographic hash of system files and commands must match vendor

controls/V-71859.rb

@@ -1,15 +1,9 @@
 # encoding: utf-8
 #
 
-banner_message_enabled = input('banner_message_enabled', value: "true",
-  description: 'The banner message must display the Standard Mandatory DoD notice
-  before granting access.')
-
-dconf_user = input(
-  'dconf_user',
-  value: nil,
-  description: "User to use to check dconf settings"
-)
+banner_message_enabled = input('banner_message_enabled')
+
+dconf_user = input('dconf_user')
 
 control "V-71859" do
   title "The operating system must display the Standard Mandatory DoD Notice

controls/V-71861.rb

@@ -1,30 +1,8 @@
 # encoding: utf-8
 #
-banner_message_text_gui = input('banner_message_text_gui',
-value:
-"You are accessing a U.S. Government (USG) Information System (IS) that is \
-provided for USG-authorized use only. By using this IS (which includes any \
-device attached to this IS), you consent to the following conditions: -The USG \
-routinely intercepts and monitors communications on this IS for purposes \
-including, but not limited to, penetration testing, COMSEC monitoring, network \
-operations and defense, personnel misconduct (PM), law enforcement (LE), and \
-counterintelligence (CI) investigations. -At any time, the USG may inspect and \
-seize data stored on this IS. -Communications using, or data stored on, this \
-IS are not private, are subject to routine monitoring, interception, and \
-search, and may be disclosed or used for any USG-authorized purpose. -This IS \
-includes security measures (e.g., authentication and access controls) to \
-protect USG interests--not for your personal benefit or privacy. \
--Notwithstanding the above, using this IS does not constitute consent to PM, \
-LE or CI investigative searching or monitoring of the content of privileged \
-communications, or work product, related to personal representation or \
-services by attorneys, psychotherapists, or clergy, and their assistants. Such \
-communications and work product are private and confidential. See User \
-Agreement for details.",
-description: 'The banner message must display the designated banner before granting access.')
-
-banner_message_text_gui_limited = input('banner_message_text_gui_limited',
-value: "I've read & consent to terms in IS user agreem't.",
-description: 'The banner message must display the designated banner before granting access.')
+banner_message_text_gui = input('banner_message_text_gui')
+
+banner_message_text_gui_limited = input('banner_message_text_gui_limited')
 
 control "V-71861" do
   title "The operating system must display the approved Standard Mandatory DoD

controls/V-71863.rb

@@ -3,31 +3,9 @@
 
 #TODO: Make sure this is actually an onlyif on the GUI - ssh banner, ftp banner also use /etc/issue
 
-banner_message_text_cli = input('banner_message_text_cli',
-value:
-"You are accessing a U.S. Government (USG) Information System (IS) that is \
-provided for USG-authorized use only. By using this IS (which includes any \
-device attached to this IS), you consent to the following conditions: -The USG \
-routinely intercepts and monitors communications on this IS for purposes \
-including, but not limited to, penetration testing, COMSEC monitoring, network \
-operations and defense, personnel misconduct (PM), law enforcement (LE), and \
-counterintelligence (CI) investigations. -At any time, the USG may inspect and \
-seize data stored on this IS. -Communications using, or data stored on, this \
-IS are not private, are subject to routine monitoring, interception, and \
-search, and may be disclosed or used for any USG-authorized purpose. -This IS \
-includes security measures (e.g., authentication and access controls) to \
-protect USG interests--not for your personal benefit or privacy. \
--Notwithstanding the above, using this IS does not constitute consent to PM, \
-LE or CI investigative searching or monitoring of the content of privileged \
-communications, or work product, related to personal representation or \
-services by attorneys, psychotherapists, or clergy, and their assistants. Such \
-communications and work product are private and confidential. See User \
-Agreement for details.",
-description: 'The banner message must display the designated banner before granting access.')
-
-banner_message_text_cli_limited = input('banner_message_text_cli_limited',
-value: "I've read & consent to terms in IS user agreem't.",
-description: 'The banner message must display the designated banner before granting access.')
+banner_message_text_cli = input('banner_message_text_cli')
+
+banner_message_text_cli_limited = input('banner_message_text_cli_limited')
 
 control "V-71863" do
   title "The operating system must display the Standard Mandatory DoD Notice

controls/V-71895.rb

@@ -1,24 +1,6 @@
 # encoding: utf-8
 #
-=begin
------------------
-Benchmark: Red Hat Enterprise Linux 7 Security Technical Implementation Guide
-Status: Accepted
-
-This Security Technical Implementation Guide is published as a tool to improve
-the security of Department of Defense (DoD) information systems. The
-requirements are derived from the National Institute of Standards and
-Technology (NIST) 800-53 and related documents. Comments or proposed revisions
-to this document should be sent via email to the following address:
-[email protected].
-
-Release Date: 2017-03-08
-Version: 1
-Publisher: DISA
-Source: STIG.DOD.MIL
-uri: http://iase.disa.mil
------------------
-=end
+skip_deprecated_test = input('skip_deprecated_test')
 
 control "V-71895" do
   title "The operating system must set the idle delay setting for all connection
@@ -82,9 +64,16 @@
 
 /org/gnome/desktop/screensaver/idle-delay"
 
-  describe command("grep -i idle-delay /etc/dconf/db/*/locks/*") do
-    its('stdout.strip') { should_not cmp "" }
-    its('stderr') { should_not match /.*No such file or directory\n?$/ }
+
+  if skip_deprecated_test
+    describe "This control has been deprecated out of the RHEL7 STIG. It will not be run because 'skip_deprecated_test' is set to True" do
+      skip "This control has been deprecated out of the RHEL7 STIG. It will not be run because 'skip_deprecated_test' is set to True"
+    end
+  else
+    describe command("grep -i idle-delay /etc/dconf/db/*/locks/*") do
+      its('stdout.strip') { should_not cmp "" }
+      its('stderr') { should_not match /.*No such file or directory\n?$/ }
+    end
+    only_if { package('gnome-desktop3').installed? }
   end
-  only_if { package('gnome-desktop3').installed? }
 end

controls/V-71901.rb

@@ -1,10 +1,7 @@
 # encoding: utf-8
 #
 
-lock_delay = input('lock_delay',
-value: 5,
-description: 'The scereensaver lock-delay must be less than or equal to the
-specified value.')
+lock_delay = input('lock_delay')
 
 control "V-71901" do
   title "The operating system must initiate a session lock for graphical user

controls/V-71911.rb

@@ -1,9 +1,7 @@
 # encoding: utf-8
 #
 
-difok = input('difok', value: 8, description: 'The acceptable range of
-values for difok which specifies the maximum number of characters that must
-change when a password is changed.')
+difok = input('difok')
 
 control "V-71911" do
   title "When passwords are changed a minimum of eight of the total number of

controls/V-71933.rb

@@ -5,9 +5,7 @@
 # TODO this can happen if `authconfig` has not been run on the system yet and
 # TODO the system is still using the `non-ac` versions of the files yet.
 
-min_reuse_generations = input('min_reuse_generations', value: 5,
-description: 'The minimum number of generations before a password can be
-reused.')
+min_reuse_generations = input('min_reuse_generations')
 
 control "V-71933" do
   title "Passwords must be prohibited from reuse for a minimum of five

controls/V-71935.rb

@@ -4,8 +4,7 @@
 # TODO update attrib to use the same `style` as the other PAM/PASSWD attributes
 # TODO we should also have a PAM_PWQUALITY_PATH attrib I think
 
-min_len = input('min_len', value: 15,
-description: 'The minimum number of characters for passwords.')
+min_len = input('min_len')
 
 control "V-71935" do
   title "Passwords must be a minimum of 15 characters in length."

controls/V-71941.rb

@@ -1,8 +1,7 @@
 # encoding: utf-8
 #
 
-days_of_inactivity = input('days_of_inactivity', value: 0, description: 'The
-number of days of inactivity before an account is disabled.')
+days_of_inactivity = input('days_of_inactivity')
 
 control "V-71941" do
   title "The operating system must disable account identifiers (individuals,

controls/V-71943.rb

@@ -1,16 +1,9 @@
 # encoding: utf-8
 #
 
-unsuccessful_attempts = input('unsuccessful_attempts', value: 3,
-description: 'The account is denied access after the specified number of
-consecutive failed logon attempts.')
-fail_interval = input('fail_interval', value: 900,
-description: 'The interval of time in which the consecutive failed logon
-attempts must occur in order for the account to be locked out (in seconds).')
-lockout_time = input('lockout_time', value: 604800,
-description: 'The minimum amount of time that an account must be locked out
-after the specified number of unsuccessful logon attempts (in seconds).
-This attribute should never be set greater than 604800.')
+unsuccessful_attempts = input('unsuccessful_attempts')
+fail_interval = input('fail_interval')
+lockout_time = input('lockout_time')
 
 control "V-71943" do
   title "Accounts subject to three unsuccessful logon attempts within 15

controls/V-71961.rb

@@ -1,20 +1,8 @@
 # encoding: utf-8
 #
-grub_superuser = input(
-  'grub_superuser',
-  description: 'superusers for grub boot ( array )',
-  value: ['root']
-)
-grub_user_boot_files = input(
- 'grub_user_boot_files',
- description: 'grub boot config files',
- value: ['/boot/grub2/user.cfg']
-)
-grub_main_cfg = input(
- 'grub_main_cfg',
- description: 'main grub boot config file',
- value: '/boot/grub2/grub.cfg'
-)
+grub_superuser = input('grub_superuser')
+grub_user_boot_files = input('grub_user_boot_files')
+grub_main_cfg = input('grub_main_cfg')
 
 control "V-71961" do
   title "Systems with a Basic Input/Output System (BIOS) must require

controls/V-71963.rb

@@ -1,21 +1,9 @@
 # encoding: utf-8
 #
 
-efi_superusers = input(
-  'efi_superusers',
-  description: 'superusers for efi boot ( array )',
-  value: ['root']
-)
-efi_user_boot_files = input(
- 'efi_user_boot_files',
- description: 'efi boot config files',
- value: ['/boot/efi/EFI/redhat/user.cfg']
-)
-efi_main_cfg = input(
- 'efi_main_cfg',
- description: 'main efi boot config file',
- value: '/boot/efi/EFI/redhat/grub.cfg'
-)
+efi_superusers = input('efi_superusers')
+efi_user_boot_files = input('efi_user_boot_files')
+efi_main_cfg = input('efi_main_cfg')
 
 control "V-71963" do
   title "Systems using Unified Extensible Firmware Interface (UEFI) must

controls/V-71965.rb

@@ -8,11 +8,7 @@
 # users may be unable to log into the system.
 #
 
-smart_card_status = input(
-  'smart_card_status',
-  value: 'enabled', # values(enabled|disabled)
-  description: 'Smart Card Status'
-)
+smart_card_status = input('smart_card_status')
 
 control "V-71965" do
   title "The operating system must uniquely identify and must authenticate

controls/V-71971.rb

@@ -1,11 +1,7 @@
 # encoding: utf-8
 #
 # Will need to be changed to reflect list of authorized system accounts
-admin_logins = input(
-  'admin_logins',
-  value: [],
-  description: "System accounts that support approved system activities."
-)
+admin_logins = input('admin_logins')
 
 # TODO we really do need an `semanage` resource.
 

controls/V-71981.rb

@@ -1,5 +1,7 @@
 # encoding: utf-8
 #
+skip_deprecated_test = input('skip_deprecated_test')
+
 control "V-71981" do
   title "The operating system must prevent the installation of software,
 patches, service packs, device drivers, or operating system components of
@@ -52,15 +54,25 @@
 repo_gpgcheck=1"
   tag "fix_id": "F-78333r1_fix"
 
-  yum_conf = '/etc/yum.conf'
-
-  if ((f = file(yum_conf)).exist?)
-    describe ini(yum_conf) do
-      its('main.repo_gpgcheck') { cmp 1 }
+  if skip_deprecated_test
+    describe "This control has been deprecated out of the RHEL7 STIG. It will not be run because 'skip_deprecated_test' is set to True" do
+      skip "This control has been deprecated out of the RHEL7 STIG. It will not be run because 'skip_deprecated_test' is set to True"
     end
   else
-    describe f do
-      it { should exist }
+    yum_conf = file('/etc/yum.conf')
+
+    describe yum_conf.path do
+      context yum_conf do
+        it { should exist }
+      end
+
+      if yum_conf.exist?
+        context '[main]' do
+          context 'repo_gpgcheck' do
+            it { expect( ini(yum_conf.path)['main'][subject] ).to cmp 1 }
+          end
+        end
+      end
     end
-  end
+  end  
 end