diff --git a/controls/stig_slmicro5.yml b/controls/stig_slmicro5.yml index 14e3ba5e66a..c98339e791f 100644 --- a/controls/stig_slmicro5.yml +++ b/controls/stig_slmicro5.yml @@ -1256,8 +1256,9 @@ controls: title: SLEM 5 must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM). - rules: [] - status: pending + rules: + - smartcard_pam_enabled + status: automated - id: SLEM-05-612020 levels: @@ -1355,7 +1356,7 @@ controls: Advanced Intrusion Detection Environment (AIDE) must verify the baseline SLEM 5 configuration at least weekly. rules: - - aide_periodic_cron_checking + - aide_periodic_checking_systemd_timer status: automated - id: SLEM-05-651035 @@ -1365,8 +1366,9 @@ controls: SLEM 5 must notify the system administrator (SA) when Advanced Intrusion Detection Environment (AIDE) discovers anomalies in the operation of any security functions. - rules: [] - status: pending + rules: + - aide_scan_notification + status: automated - id: SLEM-05-652010 levels: @@ -1399,8 +1401,9 @@ controls: levels: - medium title: The audit-audispd-plugins package must be installed on SLEM 5. - rules: [] - status: pending + rules: + - package_audit-audispd-plugins_installed + status: automated - id: SLEM-05-653025 levels: @@ -1410,7 +1413,6 @@ controls: week of audit records when audit records are not immediately sent to a central audit record storage facility. rules: - - package_audit-audispd-plugins_installed - auditd_audispd_configure_sufficiently_large_partition status: automated diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml index 30f35d2e02f..25c60eb44e5 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/ansible/shared.yml @@ -1,18 +1,14 @@ -# platform = multi_platform_sle,Ubuntu 20.04 +# platform = multi_platform_sle,multi_platform_slmicro,Ubuntu 20.04 # reboot = false # strategy = restrict # complexity = low # disruption = low -{{%- if 'sle' in product %}} +{{%- if 'sle' in product or 'slmicro' in product %}} {{%- set pam_package = "pam_pkcs11" %}} -{{%- else %}} - {{%- set pam_package = "libpam-pkcs11" %}} -{{% endif %}} - -{{%- if 'sle' in product %}} {{%- set pam_pkcs11_control_flag = "sufficient" %}} {{%- else %}} + {{%- set pam_package = "libpam-pkcs11" %}} {{%- set pam_pkcs11_control_flag = "\u005Bsuccess=2 default=ignore\u005D" %}} {{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh index 2e796f6bc2c..248946795c2 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = multi_platform_sle,Ubuntu 20.04 +# platform = multi_platform_sle,multi_platform_slmicro,Ubuntu 20.04 {{% if 'ubuntu' in product %}} {{{ bash_ensure_pam_module_option('/etc/pam.d/common-auth', 'auth', '[success=2 default=ignore]', 'pam_pkcs11.so', '', '', '# here are the per-package modules') }}} {{% else %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml index 8a82e9e4d24..2b812b097d2 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/rule.yml @@ -53,6 +53,7 @@ severity: medium identifiers: cce@sle12: CCE-83208-9 cce@sle15: CCE-85556-9 + cce@slmicro5: CCE-93800-1 references: disa: CCI-000765,CCI-000766,CCI-000767,CCI-000768,CCI-000187,CCI-001948,CCI-001953,CCI-001954,CCI-004047 diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh index 3750cac24ac..91934ecd5b3 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/commented.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 {{% if 'ubuntu' in product %}} sed -i '/^auth.*pam_unix.so/i # auth [success=2 default=ignore] pam_pkcs11.so' /etc/pam.d/common-auth diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh index 37f5fff8eca..517c970aa92 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/correct.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 {{% if 'ubuntu' in product %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh index d57f93ef014..df8aa9695b4 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/nothing.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 echo "auth [success=1 default=ignore] pam_unix.so nullok" > /etc/pam.d/common-auth diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh index 4773c829ed6..67fa5d22551 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_pam_enabled/tests/substring.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu,multi_platform_sle +# platform = multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu # packages = libpam-pkcs11 {{% if 'ubuntu' in product %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml index 24569ec1f4a..a6c54db1837 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml @@ -22,6 +22,7 @@ severity: medium identifiers: cce@sle12: CCE-92366-4 cce@sle15: CCE-92516-4 + cce@slmicro5: CCE-93721-9 references: cis-csc: 1,11,12,13,14,15,16,2,3,5,7,8,9 diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh index 9114988a2b4..dfa5c1b6c89 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro +# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle {{{ bash_package_install("aide") }}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml index 6544d5d94ca..d486ed81786 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml @@ -12,7 +12,7 @@ with_items: - aide -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} - name: "{{{ rule_title }}} check service" ansible.builtin.blockinfile: create: yes diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh index c3a4301f91c..972a4813cfb 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh @@ -3,7 +3,7 @@ {{{ bash_package_install("aide") }}} {{{ bash_instantiate_variables("var_aide_scan_notification_email") }}} -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} # create unit file for periodic aide database check cat > /etc/systemd/system/aidecheck.service < -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} @@ -52,7 +52,7 @@ ^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$ 1 -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} @@ -61,7 +61,7 @@ /etc/systemd/system/aidecheck.service - ^ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$ + ^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$ 1 /etc/systemd/system/aidecheck.service - ^Before\=.*aidecheck-notify.service$ + ^.*Before\=.*aidecheck-notify.service.*$ 1 /etc/systemd/system/aidecheck.service - ^Wants\=.*aidecheck-notify.service.*$ + ^.*Wants\=.*aidecheck-notify.service.*$ 1 {{% endif %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml index d786e13096f..028e6dc2f8d 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml @@ -32,6 +32,7 @@ identifiers: cce@rhel10: CCE-90177-7 cce@sle12: CCE-83048-9 cce@sle15: CCE-91214-7 + cce@slmicro5: CCE-93722-7 references: cis-csc: 1,11,12,13,15,16,2,3,5,7,8,9 @@ -54,7 +55,7 @@ ocil_clause: 'AIDE has not been configured or has not been configured to notify ocil: |- To determine that periodic AIDE execution has been scheduled, run the following command: -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} 
$ sudo systemctl status  aidecheck-notify|grep loaded
The output should return that the service is loaded. Also we should make sure that notification service is started by the check: @@ -73,7 +74,7 @@ fixtext: |- The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. -{{% if product in ["sle15"] %}} +{{% if product in ["sle15", "slmicro5"] %}} $ cat > /etc/systemd/system/aidecheck-notify.service <