Sanity/ansible-machine-hardening: remove test. Replaced by Contest /hardening/host-os/ansible
This commit is contained in:
Milan Lysonek
parent
5cff2011ea
commit
2f0fe6eada
12 changed files with 0 additions and 282 deletions
|
|
@ -1,9 +0,0 @@
|
|||
environment:
|
||||
PROFILE: anssi_bp28_high
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening ANSSI BP-028 (high)
|
||||
adjust+:
|
||||
- enabled: false
|
||||
when: distro <= rhel-7
|
||||
continue: false
|
||||
extra-nitrate: TC#0614505
|
||||
id: bff3e388-4f6a-4cbb-adcf-50ee0934dd4e
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: cis
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening CIS Server Level 2
|
||||
extra-nitrate: TC#0614506
|
||||
id: c477ef74-bb4f-4913-b4ad-76bcbbb2758e
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: cis_workstation_l2
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening CIS Workstation Level 2
|
||||
extra-nitrate: TC#0615306
|
||||
id: fbb6f999-68f9-47f8-82ef-e73645d898be
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: cui
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening CUI
|
||||
extra-nitrate: TC#0615307
|
||||
id: ee19e1ac-6ec4-4988-90f6-6183f6d699b3
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: e8
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening E8
|
||||
extra-nitrate: TC#0615308
|
||||
id: e8cb4e6b-74f2-4deb-a57c-ba1908dc3385
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: hipaa
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening HIPAA
|
||||
extra-nitrate: TC#0615309
|
||||
id: e2ebf136-1261-4d3b-98f6-76e09b175ed0
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
environment:
|
||||
PROFILE: ism_o
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening ISM
|
||||
adjust+:
|
||||
- enabled: false
|
||||
when: distro <= rhel-7
|
||||
continue: false
|
||||
extra-nitrate: TC#0615310
|
||||
id: a27ab79b-2d2f-4eae-a769-2844ff2c4f69
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
summary: Scan machine hardened with Ansible playbook
|
||||
description: |
|
||||
Hardens a machine using Ansible playbook to a selected SCAP profile,
|
||||
reboots and then performs scan to verify the hardening.
|
||||
|
||||
Note: Test disables FIPS mode in the cleanup phase in order to not break
|
||||
package installation/removal from the beaker-tasks repository which is
|
||||
needed by the errata/cleanup task. One more reboot is required after
|
||||
disabling FIPS.
|
||||
contact: Milan Lysonek <mlysonek@redhat.com>
|
||||
component:
|
||||
- scap-security-guide
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
recommend:
|
||||
- scap-security-guide
|
||||
- openscap
|
||||
- openscap-utils
|
||||
- wget
|
||||
- sos
|
||||
require:
|
||||
- url: https://src.fedoraproject.org/tests/scap-security-guide.git
|
||||
name: /Library/scap-results
|
||||
nick: scap-results-lib
|
||||
duration: 90m
|
||||
enabled: true
|
||||
tag:
|
||||
- destructive
|
||||
extra-task: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening
|
||||
extra-hardware: |
|
||||
hostrequire = memory>=4096
|
||||
adjust:
|
||||
- enabled: false
|
||||
when: distro == fedora
|
||||
continue: false
|
||||
- enabled: false
|
||||
when: distro == rhel-7 and arch == ppc64, s390x
|
||||
continue: false
|
||||
order: 310
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: ospp
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening OSPP
|
||||
extra-nitrate: TC#0614430
|
||||
id: 9e934f5a-187d-4498-8f6c-c8b113452b74
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: pci-dss
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening PCI-DSS
|
||||
extra-nitrate: TC#0615311
|
||||
id: 819d8cbf-6fda-4c8b-99a3-185ffec179cf
|
||||
|
|
@ -1,185 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="scap-security-guide"
|
||||
PROFILE=${PROFILE:-"stig"}
|
||||
PROFILE_ID="xccdf_org.ssgproject.content_profile_${PROFILE}"
|
||||
DS_UNSELECT="ds_unselect_rules.sh"
|
||||
DS_UNSELECT_LINK="https://raw.githubusercontent.com/ComplianceAsCode/content/master/tests/${DS_UNSELECT}"
|
||||
UNSELECT_LIST="unselect_rules_list"
|
||||
UNSELECT_LIST_LINK="https://raw.githubusercontent.com/ComplianceAsCode/content/master/tests/${UNSELECT_LIST}"
|
||||
|
||||
REBOOT_FLAG="/test_reboot_flag"
|
||||
REBOOT_COUNT=0
|
||||
TIMESTAMP_FILE="/test_timestamp"
|
||||
|
||||
# The nfs-utils and gssproxy packages are beakerlib dependencies and cannot be
|
||||
# removed. The accounts_password_set_max_life_existing rule requires password
|
||||
# change after hardening, skip it unselect mount_option as we can't remediate it.
|
||||
# Rsync is required by tmt, don't remove it from machine.
|
||||
# rpcbind is required by beakerlib.
|
||||
# World writable files are created after reboot by beakerlib - remove when https://github.com/beakerlib/beakerlib/issues/149 is fixed.
|
||||
EXTENDED_LIST="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed
|
||||
xccdf_org.ssgproject.content_rule_package_gssproxy_removed
|
||||
xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
|
||||
xccdf_org.ssgproject.content_rule_mount_option_.*
|
||||
xccdf_org.ssgproject.content_rule_package_rsync_removed
|
||||
xccdf_org.ssgproject.content_rule_package_rpcbind_removed
|
||||
xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
|
||||
xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable"
|
||||
|
||||
# On CentOS, exclude rules that check if OS is FIPS certified
|
||||
if rlIsCentOS; then
|
||||
EXTENDED_LIST="$EXTENDED_LIST
|
||||
xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
|
||||
xccdf_org.ssgproject.content_rule_sshd_use_approved_macs
|
||||
xccdf_org.ssgproject.content_rule_sshd_use_approved_kex_ordered_stig
|
||||
xccdf_org.ssgproject.content_rule_package_dracut-fips_installed
|
||||
xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode
|
||||
xccdf_org.ssgproject.content_rule_aide_use_fips_hashes"
|
||||
fi
|
||||
# Following rules are unselected because ansible-playbook v2.9 crashes on them
|
||||
if rlIsRHEL 8 && rlIsRHEL "<=8.4"; then
|
||||
EXTENDED_LIST="$EXTENDED_LIST
|
||||
xccdf_org.ssgproject.content_configure_bashrc_tmux
|
||||
xccdf_org.ssgproject.content_configure_bashrc_exec_tmux
|
||||
xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing"
|
||||
fi
|
||||
|
||||
|
||||
function dsUnselectBadRules() {
|
||||
local ds=$1
|
||||
|
||||
rlRun "wget $DS_UNSELECT_LINK"
|
||||
rlRun "wget $UNSELECT_LIST_LINK"
|
||||
rlRun "echo \"$EXTENDED_LIST\" >> $UNSELECT_LIST" \
|
||||
0 "Extend $UNSELECT_LIST with additional rules which break test env"
|
||||
rlRun "cat $UNSELECT_LIST" 0 "Listing all rules which will be unselected"
|
||||
rlRun "bash $DS_UNSELECT $ds $UNSELECT_LIST" \
|
||||
0 "Unselecting rules which might break test environment from $ds"
|
||||
rlRun "mv /tmp/$(basename $ds) /"
|
||||
SKIP_TAGS="$(cat $UNSELECT_LIST | sed "s/^xccdf_org.ssgproject.content_rule_//" | tr '\n' ',')"
|
||||
rlRun "rm -f $DS_UNSELECT $UNSELECT_LIST"
|
||||
}
|
||||
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
if [ -f "$REBOOT_FLAG" ]; then
|
||||
REBOOT_COUNT=$(cat "$REBOOT_FLAG")
|
||||
else
|
||||
touch "$REBOOT_FLAG"
|
||||
fi
|
||||
echo $(( REBOOT_COUNT + 1 )) > "$REBOOT_FLAG"
|
||||
|
||||
if [ $REBOOT_COUNT -le 1 ]; then
|
||||
rlImport "scap-results-lib/scap-results" || rlDie "Failed to import scap-results library"
|
||||
if [ $REBOOT_COUNT -eq 0 ]; then
|
||||
scapCommonInstallAnsible || rlDie "Failed to install required Ansible packages"
|
||||
fi
|
||||
rlAssertRpm "$PACKAGE"
|
||||
rlAssertRpm "openscap-scanner"
|
||||
# On CentOS images, NetworkManager and firewalld is not installed by default
|
||||
rlRun "yum install -y NetworkManager firewalld"
|
||||
rlRun "rlServiceEnable NetworkManager"
|
||||
rlRun "rlServiceStart NetworkManager"
|
||||
|
||||
PLAYBOOK="/usr/share/scap-security-guide/ansible/${scapCommonDISTRO}-playbook-${PROFILE}.yml"
|
||||
|
||||
rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
|
||||
rlRun "pushd $tmp"
|
||||
|
||||
# Remove when CentOS repos use at least 3072b RSA key
|
||||
if rlIsCentOS ">=8" && [ "$PROFILE" == "ospp" ]; then
|
||||
rlRun "echo sslverify=0 >> /etc/yum.conf" 0 "Workaround for FIPS:OSPP crypto policy"
|
||||
rlRun "sed -i '/^\s*hosts: all.*/a \ module_defaults:\n package:\n sslverify: false' $PLAYBOOK" \
|
||||
0 "Workaround for FIPS:OSPP crypto policy in ansible-playbook"
|
||||
fi
|
||||
|
||||
if [ $REBOOT_COUNT -eq 0 ]; then
|
||||
TIMESTAMP=$(date +%Y%m%d%H%M%S)
|
||||
echo "$TIMESTAMP" > "$TIMESTAMP_FILE"
|
||||
rlLog "Setting TIMESTAMP before hardening: $TIMESTAMP"
|
||||
dsUnselectBadRules "$scapCommonDS"
|
||||
else
|
||||
TIMESTAMP=$(cat "$TIMESTAMP_FILE")
|
||||
rlLog "Using TIMESTAMP: $TIMESTAMP"
|
||||
fi
|
||||
DS="/$(basename $scapCommonDS)"
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
if [ "$REBOOT_COUNT" -eq 0 ]; then
|
||||
rlPhaseStartTest "Ansible hardening with $PROFILE profile"
|
||||
rlRun -s "ansible-playbook -i \"localhost,\" -c local --skip-tags \"$SKIP_TAGS\" $PLAYBOOK" \
|
||||
0 "Harden system to $PROFILE profile using Ansible playbook"
|
||||
rlRun "rhts-reboot" 0 "Reboot the machine"
|
||||
rlPhaseEnd
|
||||
elif [ "$REBOOT_COUNT" -eq 1 ]; then
|
||||
rlPhaseStartTest "Scan $PROFILE hardened machine after reboot"
|
||||
FINAL_REPORT="${PROFILE}.html"
|
||||
rlRun -s "oscap xccdf eval --progress --profile ${PROFILE_ID} --results ${PROFILE}-xccdf-results.xml --report ${FINAL_REPORT} $DS" \
|
||||
0,2 "Final $PROFILE profile scan"
|
||||
|
||||
rlRun "sed -i '/Function pcre_exec() failed to match a regular expression with return code -10/d' $rlRun_LOG" 0 "Remove known problem caused by non-utf8 character in CentOS image logs"
|
||||
rlRun "sed -i '/xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions:error/d' $rlRun_LOG" 0 "Remove erroring rule caused by failed regular expression"
|
||||
rlAssertNotGrep ":error$" "$rlRun_LOG" -i
|
||||
rlAssertNotGrep ":unknown$" "$rlRun_LOG" -i
|
||||
if rlIsRHEL 7; then
|
||||
rlRun "sed -i '/E: probe_file: Failed to check available memory/d' $rlRun_LOG" 0 "Waiving because of https://github.com/OpenSCAP/openscap/issues/1867"
|
||||
fi
|
||||
rlAssertNotGrep "(^E:|^openscap error:)" "$rlRun_LOG" -iE
|
||||
filtered_results=$(scapResPrintResults "${PROFILE}-xccdf-results.xml" "$DS" "$scapCommonDISTRO" "$PROFILE" "fail" "" "ansible")
|
||||
if [ -z "$filtered_results" ]; then
|
||||
rlPass "There are no fail results after remediation"
|
||||
else
|
||||
rlFail "Rules not passing after remediation:\n$filtered_results"
|
||||
rlRun "sos report -z xz --tmp-dir . --batch --skip-plugins cloud_init,i18n,jars,oddjob,soundcard,xen --since $TIMESTAMP &>sos_report.log" \
|
||||
0 "Collecting system information with sos report"
|
||||
if [ $? -ne 0 ]; then
|
||||
SOS_REPORT="sos_report.log"
|
||||
else
|
||||
SOS_REPORT=$(ls -1 | grep "tar\.xz$" | head -n1 )
|
||||
if [ ! -f "$SOS_REPORT" ]; then
|
||||
rlFail "Archive with sos report not found"
|
||||
SOS_REPORT="sos_report.log"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add read permission to make the report accessible in Testing Farm
|
||||
rlRun "chmod 0644 ${REMEDIATE_REPORT} ${FINAL_REPORT}" 0 "Add read permission to reports"
|
||||
rlRun "chmod a-t /var/tmp" 0 "Get rid of sticky bit to keep permissions for file submit"
|
||||
rlRun "umask 0000" 0 "Remove mode mask"
|
||||
rlFileSubmit "$FINAL_REPORT" "$FINAL_REPORT"
|
||||
if [ -f "$SOS_REPORT" ]; then
|
||||
rlRun "chmod 0644 $SOS_REPORT" 0 "Add read permission to $SOS_REPORT"
|
||||
rlFileSubmit "$SOS_REPORT" "$SOS_REPORT"
|
||||
fi
|
||||
rlRun "rm -f $REMEDIATE_REPORT $SOS_REPORT"
|
||||
rlPhaseEnd
|
||||
fi
|
||||
|
||||
rlPhaseStartCleanup
|
||||
if [ $REBOOT_COUNT -le 1 ]; then
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $tmp" 0 "Remove tmp directory"
|
||||
fi
|
||||
if [ $REBOOT_COUNT -eq 1 ]; then
|
||||
if rlIsRHEL 7 || rlIsCentOS 7; then
|
||||
# Follows https://access.redhat.com/solutions/2422061
|
||||
rlLogInfo "Disable FIPS mode to not interfere with package installation/removal from beaker-tasks repo"
|
||||
rlRun "yum remove -y dracut-fips\*"
|
||||
rlRun "rm -f /boot/initramfs-$(uname -r).img"
|
||||
rlRun "dracut"
|
||||
rlRun "grubby --update-kernel=ALL --remove-args=fips=1"
|
||||
[[ -f /etc/default/grub ]] && rlRun "sed -i 's/ fips=1//' /etc/default/grub"
|
||||
else
|
||||
rlRun "fips-mode-setup --disable" \
|
||||
0 "Disable FIPS mode to not interfere with package installation/removal from beaker-tasks repo"
|
||||
fi
|
||||
rlRun "rhts-reboot" 0 "Reboot the machine"
|
||||
fi
|
||||
rlPhaseEnd
|
||||
rlJournalEnd
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
environment:
|
||||
PROFILE: stig
|
||||
extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening STIG
|
||||
extra-nitrate: TC#0614431
|
||||
id: 4ff71a2e-cc4a-4c1d-8930-67a52b9b11d7
|
||||
Loading…
Add table
Add a link
Reference in a new issue