Mirrors/linux-baseline
2
0
Fork 0
mirror of https://github.com/dev-sec/linux-baseline synced 2024-11-26 13:00:21 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #21 from atomic111/master

Browse source 
changed GIS to DTAG SEC
This commit is contained in:
Dominik Richter 2014-09-14 19:22:54 +02:00
commit f81fd221a4
4 changed files with 46 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
default/serverspec/os_spec.rb
View file

@ -21,47 +21,47 @@ RSpec.configure do |c|
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
end
# GIS: Req 3.21-4
describe command('find / -name \'.rhosts\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end
# GIS: Req 3.21-4
describe command('find / -name \'hosts.equiv\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end
# GIS: Req 3.21-7
describe file('/etc/shadow') do
it { should be_owned_by 'root' }
end
# GIS: Req 3.21-7
describe file('/etc/shadow') do
it { should be_mode 600 }
end
# GIS: Req 3.21-8
describe command('echo $PATH | grep -ci \'\.\'') do
its(:stdout) { should match(/^0/) }
end
# GIS: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
end
# GIS: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
end
# GIS: Req 3.21-10
describe file('/etc/login.defs') do
its(:content) { should match(/^UMASK +027/) }
end
# GIS: Req 3.21-12
describe 'SUID/ SGID blacklist check' do
it 'found no blacklisted suid/sgid' do
blacklist = [
@ -97,7 +97,7 @@ describe 'SUID/ SGID blacklist check' do
end
end
# GIS: Req 3.21-16
describe 'Unique uid' do
it 'check for unique uids' do
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)

26
default/serverspec/sysctl_spec.rb
View file

@ -23,27 +23,27 @@ end
describe 'IP V4 networking' do
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv4.ip_forward') do
its(:value) { should eq 0 }
end
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
its(:value) { should eq 0 }
end
# GIS: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-3 ; GIS: Req 3.37-10
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its(:value) { should eq 1 }
end
@ -52,7 +52,7 @@ describe 'IP V4 networking' do
its(:value) { should eq 1 }
end
# GIS: Req 3.01-9
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
its(:value) { should eq 100 }
end
@ -65,12 +65,12 @@ describe 'IP V4 networking' do
its(:value) { should eq 0 }
end
# GIS: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
its(:value) { should eq 2 }
end
@ -91,12 +91,12 @@ describe 'IP V4 networking' do
its(:value) { should eq 1 }
end
# GIS: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its(:value) { should eq 0 }
end
# GIS: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
its(:value) { should eq 0 }
end
@ -138,7 +138,7 @@ describe 'IP V6 Networking' do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
its(:value) { should eq 0 }
end
@ -202,7 +202,7 @@ end
describe 'ExecShield' do
# GIS: Req 3.21-5
# check if we find the nx flag
if command('cat /proc/cpuinfo').return_stdout?(/^flags.*?:.*? nx( .*?)?$/)
true
@ -217,7 +217,7 @@ describe 'ExecShield' do
end
end
# GIS: Req 3.21-5
context linux_kernel_parameter('kernel.randomize_va_space') do
its(:value) { should eq 2 }
end

20
lockdown/serverspec/os_spec.rb
View file

@ -21,47 +21,47 @@ RSpec.configure do |c|
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
end
# GIS: Req 3.21-4
describe command('find / -name \'.rhosts\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end
# GIS: Req 3.21-4
describe command('find / -name \'hosts.equiv\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end
# GIS: Req 3.21-7
describe file('/etc/shadow') do
it { should be_owned_by 'root' }
end
# GIS: Req 3.21-7
describe file('/etc/shadow') do
it { should be_mode 600 }
end
# GIS: Req 3.21-8
describe command('echo $PATH | grep -ci \'\.\'') do
its(:stdout) { should match(/^0/) }
end
# GIS: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
end
# GIS: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
end
# GIS: Req 3.21-10
describe file('/etc/login.defs') do
its(:content) { should match(/^UMASK +027/) }
end
# GIS: Req 3.21-12
describe 'SUID/ SGID whitelist check' do
it 'found only whitelist suid/sgid' do
whitelist = [
@ -116,7 +116,7 @@ describe 'SUID/ SGID whitelist check' do
end
end
# GIS: Req 3.21-16
describe 'Unique uid' do
it 'check for unique uids' do
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)

26
lockdown/serverspec/sysctl_spec.rb
View file

@ -23,27 +23,27 @@ end
describe 'IP V4 networking' do
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv4.ip_forward') do
its(:value) { should eq 0 }
end
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
its(:value) { should eq 0 }
end
# GIS: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-3 ; GIS: Req 3.37-10
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its(:value) { should eq 1 }
end
@ -52,7 +52,7 @@ describe 'IP V4 networking' do
its(:value) { should eq 1 }
end
# GIS: Req 3.01-9
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
its(:value) { should eq 100 }
end
@ -65,12 +65,12 @@ describe 'IP V4 networking' do
its(:value) { should eq 0 }
end
# GIS: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
its(:value) { should eq 2 }
end
@ -91,12 +91,12 @@ describe 'IP V4 networking' do
its(:value) { should eq 1 }
end
# GIS: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its(:value) { should eq 0 }
end
# GIS: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
its(:value) { should eq 0 }
end
@ -138,7 +138,7 @@ describe 'IP V6 Networking' do
its(:value) { should eq 1 }
end
# GIS: Req 3.21-1
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
its(:value) { should eq 0 }
end
@ -202,7 +202,7 @@ end
describe 'ExecShield' do
# GIS: Req 3.21-5
# check if we find the nx flag
if command('cat /proc/cpuinfo').return_stdout?(/^flags.*?:.*? nx( .*?)?$/)
true
@ -217,7 +217,7 @@ describe 'ExecShield' do
end
end
# GIS: Req 3.21-5
context linux_kernel_parameter('kernel.randomize_va_space') do
its(:value) { should eq 2 }
end