From 2f0fe6eadaf46b9e2dc6e642dacfc7aa2191a498 Mon Sep 17 00:00:00 2001 From: Milan Lysonek Date: Tue, 2 Jul 2024 11:15:37 +0200 Subject: [PATCH] Sanity/ansible-machine-hardening: remove test. Replaced by Contest /hardening/host-os/ansible --- .../anssi_bp28_high.fmf | 9 - Sanity/ansible-machine-hardening/cis.fmf | 5 - .../cis_workstation_l2.fmf | 5 - Sanity/ansible-machine-hardening/cui.fmf | 5 - Sanity/ansible-machine-hardening/e8.fmf | 5 - Sanity/ansible-machine-hardening/hipaa.fmf | 5 - Sanity/ansible-machine-hardening/ism_o.fmf | 9 - Sanity/ansible-machine-hardening/main.fmf | 39 ---- Sanity/ansible-machine-hardening/ospp.fmf | 5 - Sanity/ansible-machine-hardening/pci-dss.fmf | 5 - Sanity/ansible-machine-hardening/runtest.sh | 185 ------------------ Sanity/ansible-machine-hardening/stig.fmf | 5 - 12 files changed, 282 deletions(-) delete mode 100644 Sanity/ansible-machine-hardening/anssi_bp28_high.fmf delete mode 100644 Sanity/ansible-machine-hardening/cis.fmf delete mode 100644 Sanity/ansible-machine-hardening/cis_workstation_l2.fmf delete mode 100644 Sanity/ansible-machine-hardening/cui.fmf delete mode 100644 Sanity/ansible-machine-hardening/e8.fmf delete mode 100644 Sanity/ansible-machine-hardening/hipaa.fmf delete mode 100644 Sanity/ansible-machine-hardening/ism_o.fmf delete mode 100644 Sanity/ansible-machine-hardening/main.fmf delete mode 100644 Sanity/ansible-machine-hardening/ospp.fmf delete mode 100644 Sanity/ansible-machine-hardening/pci-dss.fmf delete mode 100755 Sanity/ansible-machine-hardening/runtest.sh delete mode 100644 Sanity/ansible-machine-hardening/stig.fmf diff --git a/Sanity/ansible-machine-hardening/anssi_bp28_high.fmf b/Sanity/ansible-machine-hardening/anssi_bp28_high.fmf deleted file mode 100644 index 9fd231b..0000000 --- a/Sanity/ansible-machine-hardening/anssi_bp28_high.fmf +++ /dev/null @@ -1,9 +0,0 @@ -environment: - PROFILE: anssi_bp28_high -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening ANSSI BP-028 (high) -adjust+: -- enabled: false - when: distro <= rhel-7 - continue: false -extra-nitrate: TC#0614505 -id: bff3e388-4f6a-4cbb-adcf-50ee0934dd4e diff --git a/Sanity/ansible-machine-hardening/cis.fmf b/Sanity/ansible-machine-hardening/cis.fmf deleted file mode 100644 index 4d1509f..0000000 --- a/Sanity/ansible-machine-hardening/cis.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: cis -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening CIS Server Level 2 -extra-nitrate: TC#0614506 -id: c477ef74-bb4f-4913-b4ad-76bcbbb2758e diff --git a/Sanity/ansible-machine-hardening/cis_workstation_l2.fmf b/Sanity/ansible-machine-hardening/cis_workstation_l2.fmf deleted file mode 100644 index 9496d96..0000000 --- a/Sanity/ansible-machine-hardening/cis_workstation_l2.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: cis_workstation_l2 -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening CIS Workstation Level 2 -extra-nitrate: TC#0615306 -id: fbb6f999-68f9-47f8-82ef-e73645d898be diff --git a/Sanity/ansible-machine-hardening/cui.fmf b/Sanity/ansible-machine-hardening/cui.fmf deleted file mode 100644 index 9011198..0000000 --- a/Sanity/ansible-machine-hardening/cui.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: cui -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening CUI -extra-nitrate: TC#0615307 -id: ee19e1ac-6ec4-4988-90f6-6183f6d699b3 diff --git a/Sanity/ansible-machine-hardening/e8.fmf b/Sanity/ansible-machine-hardening/e8.fmf deleted file mode 100644 index 5203b22..0000000 --- a/Sanity/ansible-machine-hardening/e8.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: e8 -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening E8 -extra-nitrate: TC#0615308 -id: e8cb4e6b-74f2-4deb-a57c-ba1908dc3385 diff --git a/Sanity/ansible-machine-hardening/hipaa.fmf b/Sanity/ansible-machine-hardening/hipaa.fmf deleted file mode 100644 index f0433d1..0000000 --- a/Sanity/ansible-machine-hardening/hipaa.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: hipaa -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening HIPAA -extra-nitrate: TC#0615309 -id: e2ebf136-1261-4d3b-98f6-76e09b175ed0 diff --git a/Sanity/ansible-machine-hardening/ism_o.fmf b/Sanity/ansible-machine-hardening/ism_o.fmf deleted file mode 100644 index 406ef0e..0000000 --- a/Sanity/ansible-machine-hardening/ism_o.fmf +++ /dev/null @@ -1,9 +0,0 @@ -environment: - PROFILE: ism_o -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening ISM -adjust+: -- enabled: false - when: distro <= rhel-7 - continue: false -extra-nitrate: TC#0615310 -id: a27ab79b-2d2f-4eae-a769-2844ff2c4f69 diff --git a/Sanity/ansible-machine-hardening/main.fmf b/Sanity/ansible-machine-hardening/main.fmf deleted file mode 100644 index 6cac1d0..0000000 --- a/Sanity/ansible-machine-hardening/main.fmf +++ /dev/null @@ -1,39 +0,0 @@ -summary: Scan machine hardened with Ansible playbook -description: | - Hardens a machine using Ansible playbook to a selected SCAP profile, - reboots and then performs scan to verify the hardening. - - Note: Test disables FIPS mode in the cleanup phase in order to not break - package installation/removal from the beaker-tasks repository which is - needed by the errata/cleanup task. One more reboot is required after - disabling FIPS. -contact: Milan Lysonek -component: -- scap-security-guide -test: ./runtest.sh -framework: beakerlib -recommend: -- scap-security-guide -- openscap -- openscap-utils -- wget -- sos -require: -- url: https://src.fedoraproject.org/tests/scap-security-guide.git - name: /Library/scap-results - nick: scap-results-lib -duration: 90m -enabled: true -tag: -- destructive -extra-task: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening -extra-hardware: | - hostrequire = memory>=4096 -adjust: -- enabled: false - when: distro == fedora - continue: false -- enabled: false - when: distro == rhel-7 and arch == ppc64, s390x - continue: false -order: 310 diff --git a/Sanity/ansible-machine-hardening/ospp.fmf b/Sanity/ansible-machine-hardening/ospp.fmf deleted file mode 100644 index c427edd..0000000 --- a/Sanity/ansible-machine-hardening/ospp.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: ospp -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening OSPP -extra-nitrate: TC#0614430 -id: 9e934f5a-187d-4498-8f6c-c8b113452b74 diff --git a/Sanity/ansible-machine-hardening/pci-dss.fmf b/Sanity/ansible-machine-hardening/pci-dss.fmf deleted file mode 100644 index 44764fe..0000000 --- a/Sanity/ansible-machine-hardening/pci-dss.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: pci-dss -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening PCI-DSS -extra-nitrate: TC#0615311 -id: 819d8cbf-6fda-4c8b-99a3-185ffec179cf diff --git a/Sanity/ansible-machine-hardening/runtest.sh b/Sanity/ansible-machine-hardening/runtest.sh deleted file mode 100755 index 1004ae6..0000000 --- a/Sanity/ansible-machine-hardening/runtest.sh +++ /dev/null @@ -1,185 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="scap-security-guide" -PROFILE=${PROFILE:-"stig"} -PROFILE_ID="xccdf_org.ssgproject.content_profile_${PROFILE}" -DS_UNSELECT="ds_unselect_rules.sh" -DS_UNSELECT_LINK="https://raw.githubusercontent.com/ComplianceAsCode/content/master/tests/${DS_UNSELECT}" -UNSELECT_LIST="unselect_rules_list" -UNSELECT_LIST_LINK="https://raw.githubusercontent.com/ComplianceAsCode/content/master/tests/${UNSELECT_LIST}" - -REBOOT_FLAG="/test_reboot_flag" -REBOOT_COUNT=0 -TIMESTAMP_FILE="/test_timestamp" - -# The nfs-utils and gssproxy packages are beakerlib dependencies and cannot be -# removed. The accounts_password_set_max_life_existing rule requires password -# change after hardening, skip it unselect mount_option as we can't remediate it. -# Rsync is required by tmt, don't remove it from machine. -# rpcbind is required by beakerlib. -# World writable files are created after reboot by beakerlib - remove when https://github.com/beakerlib/beakerlib/issues/149 is fixed. -EXTENDED_LIST="xccdf_org.ssgproject.content_rule_package_nfs-utils_removed -xccdf_org.ssgproject.content_rule_package_gssproxy_removed -xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing -xccdf_org.ssgproject.content_rule_mount_option_.* -xccdf_org.ssgproject.content_rule_package_rsync_removed -xccdf_org.ssgproject.content_rule_package_rpcbind_removed -xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits -xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" - -# On CentOS, exclude rules that check if OS is FIPS certified -if rlIsCentOS; then - EXTENDED_LIST="$EXTENDED_LIST -xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers -xccdf_org.ssgproject.content_rule_sshd_use_approved_macs -xccdf_org.ssgproject.content_rule_sshd_use_approved_kex_ordered_stig -xccdf_org.ssgproject.content_rule_package_dracut-fips_installed -xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode -xccdf_org.ssgproject.content_rule_aide_use_fips_hashes" -fi -# Following rules are unselected because ansible-playbook v2.9 crashes on them -if rlIsRHEL 8 && rlIsRHEL "<=8.4"; then - EXTENDED_LIST="$EXTENDED_LIST -xccdf_org.ssgproject.content_configure_bashrc_tmux -xccdf_org.ssgproject.content_configure_bashrc_exec_tmux -xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" -fi - - -function dsUnselectBadRules() { - local ds=$1 - - rlRun "wget $DS_UNSELECT_LINK" - rlRun "wget $UNSELECT_LIST_LINK" - rlRun "echo \"$EXTENDED_LIST\" >> $UNSELECT_LIST" \ - 0 "Extend $UNSELECT_LIST with additional rules which break test env" - rlRun "cat $UNSELECT_LIST" 0 "Listing all rules which will be unselected" - rlRun "bash $DS_UNSELECT $ds $UNSELECT_LIST" \ - 0 "Unselecting rules which might break test environment from $ds" - rlRun "mv /tmp/$(basename $ds) /" - SKIP_TAGS="$(cat $UNSELECT_LIST | sed "s/^xccdf_org.ssgproject.content_rule_//" | tr '\n' ',')" - rlRun "rm -f $DS_UNSELECT $UNSELECT_LIST" -} - - -rlJournalStart - rlPhaseStartSetup - if [ -f "$REBOOT_FLAG" ]; then - REBOOT_COUNT=$(cat "$REBOOT_FLAG") - else - touch "$REBOOT_FLAG" - fi - echo $(( REBOOT_COUNT + 1 )) > "$REBOOT_FLAG" - - if [ $REBOOT_COUNT -le 1 ]; then - rlImport "scap-results-lib/scap-results" || rlDie "Failed to import scap-results library" - if [ $REBOOT_COUNT -eq 0 ]; then - scapCommonInstallAnsible || rlDie "Failed to install required Ansible packages" - fi - rlAssertRpm "$PACKAGE" - rlAssertRpm "openscap-scanner" - # On CentOS images, NetworkManager and firewalld is not installed by default - rlRun "yum install -y NetworkManager firewalld" - rlRun "rlServiceEnable NetworkManager" - rlRun "rlServiceStart NetworkManager" - - PLAYBOOK="/usr/share/scap-security-guide/ansible/${scapCommonDISTRO}-playbook-${PROFILE}.yml" - - rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" - rlRun "pushd $tmp" - - # Remove when CentOS repos use at least 3072b RSA key - if rlIsCentOS ">=8" && [ "$PROFILE" == "ospp" ]; then - rlRun "echo sslverify=0 >> /etc/yum.conf" 0 "Workaround for FIPS:OSPP crypto policy" - rlRun "sed -i '/^\s*hosts: all.*/a \ module_defaults:\n package:\n sslverify: false' $PLAYBOOK" \ - 0 "Workaround for FIPS:OSPP crypto policy in ansible-playbook" - fi - - if [ $REBOOT_COUNT -eq 0 ]; then - TIMESTAMP=$(date +%Y%m%d%H%M%S) - echo "$TIMESTAMP" > "$TIMESTAMP_FILE" - rlLog "Setting TIMESTAMP before hardening: $TIMESTAMP" - dsUnselectBadRules "$scapCommonDS" - else - TIMESTAMP=$(cat "$TIMESTAMP_FILE") - rlLog "Using TIMESTAMP: $TIMESTAMP" - fi - DS="/$(basename $scapCommonDS)" - fi - rlPhaseEnd - - if [ "$REBOOT_COUNT" -eq 0 ]; then - rlPhaseStartTest "Ansible hardening with $PROFILE profile" - rlRun -s "ansible-playbook -i \"localhost,\" -c local --skip-tags \"$SKIP_TAGS\" $PLAYBOOK" \ - 0 "Harden system to $PROFILE profile using Ansible playbook" - rlRun "rhts-reboot" 0 "Reboot the machine" - rlPhaseEnd - elif [ "$REBOOT_COUNT" -eq 1 ]; then - rlPhaseStartTest "Scan $PROFILE hardened machine after reboot" - FINAL_REPORT="${PROFILE}.html" - rlRun -s "oscap xccdf eval --progress --profile ${PROFILE_ID} --results ${PROFILE}-xccdf-results.xml --report ${FINAL_REPORT} $DS" \ - 0,2 "Final $PROFILE profile scan" - - rlRun "sed -i '/Function pcre_exec() failed to match a regular expression with return code -10/d' $rlRun_LOG" 0 "Remove known problem caused by non-utf8 character in CentOS image logs" - rlRun "sed -i '/xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions:error/d' $rlRun_LOG" 0 "Remove erroring rule caused by failed regular expression" - rlAssertNotGrep ":error$" "$rlRun_LOG" -i - rlAssertNotGrep ":unknown$" "$rlRun_LOG" -i - if rlIsRHEL 7; then - rlRun "sed -i '/E: probe_file: Failed to check available memory/d' $rlRun_LOG" 0 "Waiving because of https://github.com/OpenSCAP/openscap/issues/1867" - fi - rlAssertNotGrep "(^E:|^openscap error:)" "$rlRun_LOG" -iE - filtered_results=$(scapResPrintResults "${PROFILE}-xccdf-results.xml" "$DS" "$scapCommonDISTRO" "$PROFILE" "fail" "" "ansible") - if [ -z "$filtered_results" ]; then - rlPass "There are no fail results after remediation" - else - rlFail "Rules not passing after remediation:\n$filtered_results" - rlRun "sos report -z xz --tmp-dir . --batch --skip-plugins cloud_init,i18n,jars,oddjob,soundcard,xen --since $TIMESTAMP &>sos_report.log" \ - 0 "Collecting system information with sos report" - if [ $? -ne 0 ]; then - SOS_REPORT="sos_report.log" - else - SOS_REPORT=$(ls -1 | grep "tar\.xz$" | head -n1 ) - if [ ! -f "$SOS_REPORT" ]; then - rlFail "Archive with sos report not found" - SOS_REPORT="sos_report.log" - fi - fi - fi - - # Add read permission to make the report accessible in Testing Farm - rlRun "chmod 0644 ${REMEDIATE_REPORT} ${FINAL_REPORT}" 0 "Add read permission to reports" - rlRun "chmod a-t /var/tmp" 0 "Get rid of sticky bit to keep permissions for file submit" - rlRun "umask 0000" 0 "Remove mode mask" - rlFileSubmit "$FINAL_REPORT" "$FINAL_REPORT" - if [ -f "$SOS_REPORT" ]; then - rlRun "chmod 0644 $SOS_REPORT" 0 "Add read permission to $SOS_REPORT" - rlFileSubmit "$SOS_REPORT" "$SOS_REPORT" - fi - rlRun "rm -f $REMEDIATE_REPORT $SOS_REPORT" - rlPhaseEnd - fi - - rlPhaseStartCleanup - if [ $REBOOT_COUNT -le 1 ]; then - rlRun "popd" - rlRun "rm -r $tmp" 0 "Remove tmp directory" - fi - if [ $REBOOT_COUNT -eq 1 ]; then - if rlIsRHEL 7 || rlIsCentOS 7; then - # Follows https://access.redhat.com/solutions/2422061 - rlLogInfo "Disable FIPS mode to not interfere with package installation/removal from beaker-tasks repo" - rlRun "yum remove -y dracut-fips\*" - rlRun "rm -f /boot/initramfs-$(uname -r).img" - rlRun "dracut" - rlRun "grubby --update-kernel=ALL --remove-args=fips=1" - [[ -f /etc/default/grub ]] && rlRun "sed -i 's/ fips=1//' /etc/default/grub" - else - rlRun "fips-mode-setup --disable" \ - 0 "Disable FIPS mode to not interfere with package installation/removal from beaker-tasks repo" - fi - rlRun "rhts-reboot" 0 "Reboot the machine" - fi - rlPhaseEnd -rlJournalEnd diff --git a/Sanity/ansible-machine-hardening/stig.fmf b/Sanity/ansible-machine-hardening/stig.fmf deleted file mode 100644 index f70db3d..0000000 --- a/Sanity/ansible-machine-hardening/stig.fmf +++ /dev/null @@ -1,5 +0,0 @@ -environment: - PROFILE: stig -extra-summary: /CoreOS/scap-security-guide/Sanity/ansible-machine-hardening STIG -extra-nitrate: TC#0614431 -id: 4ff71a2e-cc4a-4c1d-8930-67a52b9b11d7