diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/bash/shared.sh index 3e3132fa5740..d9d9f68d565b 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/bash/shared.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/bash/shared.sh @@ -15,7 +15,7 @@ function add_audit_rule() local PRIV_CMD="$1" local OTHER_FILTERS="-F path=$PRIV_CMD -F perm=x" # Perform the remediation for both possible tools: 'auditctl' and 'augenrules' -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} [ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64") for ARCH in "${RULE_ARCHS[@]}" ; do ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH" diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_extra_rules_configured.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_extra_rules_configured.pass.sh index 4f991c60a85d..b093b103d42f 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_extra_rules_configured.pass.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_extra_rules_configured.pass.sh @@ -3,7 +3,7 @@ # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8,multi_platform_ubuntu ./generate_privileged_commands_rule.sh {{{ uid_min }}} privileged /etc/audit/rules.d/privileged.rules -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path=/usr/bin/notrelevant -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules echo "-a always,exit -F arch=b64 -F path=/usr/bin/notrelevant -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules {{% else %}} diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_one_rule.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_one_rule.fail.sh index 6e197e75a561..27b589c781fa 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_one_rule.fail.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_one_rule.fail.sh @@ -1,7 +1,7 @@ #!/bin/bash # packages = audit # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8,multi_platform_ubuntu -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path=/usr/bin/sudo -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules echo "-a always,exit -F arch=b64 -F path=/usr/bin/sudo -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules {{% else %}} diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_two_rules_sep_files.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_two_rules_sep_files.fail.sh index 6bba4a1c089c..54627a7136e5 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_two_rules_sep_files.fail.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_two_rules_sep_files.fail.sh @@ -2,7 +2,7 @@ # packages = audit # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8,multi_platform_ubuntu -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/priv.rules echo "-a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/priv.rules echo "-a always,exit -F arch=b32 -F path=/usr/bin/notrelevant -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/priv.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/generate_privileged_commands_rule.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/generate_privileged_commands_rule.sh index 51fe6dc630d4..6de0147b8310 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/generate_privileged_commands_rule.sh +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/tests/generate_privileged_commands_rule.sh @@ -4,7 +4,7 @@ AUID=$1 KEY=$2 RULEPATH=$3 for file in $(find / -not \( -fstype afs -o -fstype autofs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2> /dev/null); do -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} [ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64") for ARCH in "${RULE_ARCHS[@]}" ; do echo "-a always,exit -F arch=$ARCH -F path=$file -F perm=x -F auid>=$AUID -F auid!=unset -k $KEY" >> $RULEPATH diff --git a/linux_os/guide/services/ssh/sshd_approved_macs.var b/linux_os/guide/services/ssh/sshd_approved_macs.var index 957ab19dbff8..783f99ee1220 100644 --- a/linux_os/guide/services/ssh/sshd_approved_macs.var +++ b/linux_os/guide/services/ssh/sshd_approved_macs.var @@ -14,6 +14,7 @@ options: stig: hmac-sha2-512,hmac-sha2-256 stig_extended: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 stig_rhel9: hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 + stig_al2023: hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com default: hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com cis_sle12: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 cis_sle15: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 diff --git a/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml index 5af2141145d7..b00b080db5ac 100644 --- a/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml +++ b/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml @@ -33,11 +33,11 @@ references: ocil_clause: 'the package is not installed' {{% if 'sle' not in product %}} -{{{ complete_ocil_entry_package(package="rsyslog-gnutls") }}} +{{{ complete_ocil_entry_package_installed(package="rsyslog-gnutls") }}} {{% elif 'amzn' in families %}} -{{{ complete_ocil_entry_package(package="rsyslog-openssl") }}} +{{{ complete_ocil_entry_package_installed(package="rsyslog-openssl") }}} {{% else %}} -{{{ complete_ocil_entry_package(package="rsyslog-module-gtls") }}} +{{{ complete_ocil_entry_package_installed(package="rsyslog-module-gtls") }}} {{% endif %}} template: diff --git a/products/al2023/CMakeLists.txt b/products/al2023/CMakeLists.txt index 563634d47002..185cc8d9ea61 100644 --- a/products/al2023/CMakeLists.txt +++ b/products/al2023/CMakeLists.txt @@ -17,3 +17,4 @@ ssg_build_html_srgmap_tables(${PRODUCT}) ssg_build_html_stig_tables(${PRODUCT}) ssg_build_html_stig_tables_per_profile(${PRODUCT} "stig") + diff --git a/products/al2023/profiles/stig.profile b/products/al2023/profiles/stig.profile index 11836a4f0929..dace6507e64e 100644 --- a/products/al2023/profiles/stig.profile +++ b/products/al2023/profiles/stig.profile @@ -55,4 +55,6 @@ selections: - grub2_audit_argument - file_permissions_var_log_audit - rsyslog_logging_configured - + # Variable refine-values + - sshd_approved_macs=stig_al2023 + diff --git a/products/al2023/transforms/constants.xslt b/products/al2023/transforms/constants.xslt deleted file mode 100644 index 6b8ec3fe0c1b..000000000000 --- a/products/al2023/transforms/constants.xslt +++ /dev/null @@ -1,13 +0,0 @@ - - - - -Amazon Linux 2023 -AL2023 -AL_STIG -al2023 - -https://www.cisecurity.org/benchmark/amazon_linux/ - - - diff --git a/products/al2023/transforms/xccdf-apply-overlay-stig.xslt b/products/al2023/transforms/xccdf-apply-overlay-stig.xslt deleted file mode 100644 index 4789419b80a5..000000000000 --- a/products/al2023/transforms/xccdf-apply-overlay-stig.xslt +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - diff --git a/products/al2023/transforms/xccdf2table-profileccirefs.xslt b/products/al2023/transforms/xccdf2table-profileccirefs.xslt deleted file mode 100644 index 9d8d3e5faf1f..000000000000 --- a/products/al2023/transforms/xccdf2table-profileccirefs.xslt +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - diff --git a/shared/templates/audit_rules_privileged_commands/ansible.template b/shared/templates/audit_rules_privileged_commands/ansible.template index ebeb329cf5bf..681e28042f97 100644 --- a/shared/templates/audit_rules_privileged_commands/ansible.template +++ b/shared/templates/audit_rules_privileged_commands/ansible.template @@ -7,7 +7,7 @@ # complexity = low # disruption = low -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} - name: {{{ rule_title }}} - Set architecture for audit {{{ PATH }}} ansible.builtin.set_fact: audit_arch: "b64" diff --git a/shared/templates/audit_rules_privileged_commands/bash.template b/shared/templates/audit_rules_privileged_commands/bash.template index a50275b04c96..f453082c8eba 100644 --- a/shared/templates/audit_rules_privileged_commands/bash.template +++ b/shared/templates/audit_rules_privileged_commands/bash.template @@ -10,7 +10,7 @@ SYSCALL="" KEY="privileged" SYSCALL_GROUPING="{{{ SYSCALL_GROUPING }}}" -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} [ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64") for ARCH in "${RULE_ARCHS[@]}" do diff --git a/shared/templates/audit_rules_privileged_commands/kubernetes.template b/shared/templates/audit_rules_privileged_commands/kubernetes.template index 90116821a074..ca29a104e119 100644 --- a/shared/templates/audit_rules_privileged_commands/kubernetes.template +++ b/shared/templates/audit_rules_privileged_commands/kubernetes.template @@ -17,7 +17,7 @@ spec: storage: files: - contents: -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-F%20path%3D{{{ PATH }}}{{{ perm_x }}}%20-F%20auid%3E%3D{{{ auid }}}%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-F%20path%3D{{{ PATH }}}{{{ perm_x }}}%20-F%20auid%3E%3D{{{ auid }}}%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A {{% else %}} source: data:,-a%20always%2Cexit%20-F%20path%3D{{{ PATH }}}{{{ perm_x }}}%20-F%20auid%3E%3D{{{ auid }}}%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A diff --git a/shared/templates/audit_rules_privileged_commands/oval.template b/shared/templates/audit_rules_privileged_commands/oval.template index 8a72e13358cb..4528ba8e7ec1 100644 --- a/shared/templates/audit_rules_privileged_commands/oval.template +++ b/shared/templates/audit_rules_privileged_commands/oval.template @@ -1,4 +1,4 @@ -{{%- if product in ["al2023", "almalinux9", "al2023", "debian12", "debian13", "fedora", "ol7", "ol8", "ol9", "ol10", "rhel8", "rhel9", "rhel10", "sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}} +{{%- if product in ["al2023", "almalinux9", "debian12", "debian13", "fedora", "ol7", "ol8", "ol9", "ol10", "rhel8", "rhel9", "rhel10", "sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}} {{%- set perm_x="(?:[\s]+-F[\s]+perm=x)" %}} {{%- endif %}} @@ -10,7 +10,7 @@ -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} @@ -49,7 +49,7 @@ {{% endmacro %}} {{% for audit_tool in ["augenrules", "auditctl"] %}} -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} {{{ arpc_tftst(audit_tool, "32") }}} {{{ arpc_tftst(audit_tool, "64") }}} {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh b/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh index dfabe8464930..338fab08b14e 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh @@ -4,7 +4,7 @@ source common.sh {{{ setup_auditctl_environment() }}} -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/auditctl_missing_perm_x.fail.sh b/shared/templates/audit_rules_privileged_commands/tests/auditctl_missing_perm_x.fail.sh index 1c858d719bcc..f7da6ddc723e 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/auditctl_missing_perm_x.fail.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/auditctl_missing_perm_x.fail.sh @@ -6,7 +6,7 @@ source common.sh {{{ setup_auditctl_environment() }}} -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/augenrules_comented_value.fail.sh b/shared/templates/audit_rules_privileged_commands/tests/augenrules_comented_value.fail.sh index e75b9702916a..877874107486 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/augenrules_comented_value.fail.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/augenrules_comented_value.fail.sh @@ -2,7 +2,7 @@ source common.sh -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "# -a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules echo "# -a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh b/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh index 3fbe8d15f7c4..6330a553c52f 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh @@ -2,7 +2,7 @@ source common.sh -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules {{% else %}} diff --git a/shared/templates/audit_rules_privileged_commands/tests/augenrules_missing_auid.fail.sh b/shared/templates/audit_rules_privileged_commands/tests/augenrules_missing_auid.fail.sh index e61a5f979b74..310228d9dec7 100644 --- a/shared/templates/audit_rules_privileged_commands/tests/augenrules_missing_auid.fail.sh +++ b/shared/templates/audit_rules_privileged_commands/tests/augenrules_missing_auid.fail.sh @@ -2,7 +2,7 @@ source common.sh -{{% if product in ["fedora", "rhel10"] %}} +{{% if product in ["al2023", "fedora", "rhel10"] %}} echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules {{% else %}}