Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update sssd ldap related rules to check /etc/sssd/conf.d/*.conf files #11474

Merged
merged 4 commits into from
Jan 31, 2024
Merged

Update sssd ldap related rules to check /etc/sssd/conf.d/*.conf files #11474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1d93cb2
Update sssd-ldap rules
Xeicker Jan 18, 2024
a09e9a6
Add tests to sssd-ldap rules
Xeicker Jan 18, 2024
9b71455
Fix shellcheck warning on find command
Xeicker Jan 25, 2024
5537b5c
Fix tests on sssd-ldap
Xeicker Jan 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@
<external_variable comment="External variable: path of the X.509 certificates in /etc/sssd/sssd.conf"
datatype="string" id="var_sssd_ldap_tls_ca_dir" version="1" />

<ind:textfilecontent54_object id="object_sssd_ldap_tls_ca_dir" version="1">
<ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
<ind:textfilecontent54_object id="object_sssd_ldap_tls_ca_dir" version="2">
<ind:filepath operation="pattern match">/etc/sssd/(sssd\.conf|conf.d/[^/]+\.conf)</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*](?:[^\n[\]]*\n+)+?[\s]*ldap_tls_cacertdir[\s]+=[\s]+([^\s]+)[\s]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
Expand Down
15 changes: 15 additions & 0 deletions ...ssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_bad_value_conf_d.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/bin/bash
# packages = /usr/lib/systemd/system/sssd.service

. $SHARED/setup_config_files.sh
setup_correct_sssd_config

systemctl enable sssd

mkdir -p /etc/sssd/conf.d/

cat > "/etc/sssd/conf.d/unused.conf" << EOF
[domain/default]

ldap_tls_cacertdir = /tmp/etc/openldap/cacerts
EOF
27 changes: 27 additions & 0 deletions ...ces/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/tests/ldap_tls_cacertdir_conf_d.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
#!/bin/bash
# packages = /usr/lib/systemd/system/sssd.service

. $SHARED/setup_config_files.sh
setup_correct_sssd_config

systemctl enable sssd


sed -i '/ldap_tls_cacertdir/d' /etc/sssd/sssd.conf

mkdir -p /etc/sssd/conf.d/

cat > "/etc/sssd/conf.d/unused.conf" << EOF
[domain/default]

ldap_id_use_start_tls = True
id_provider = ldap
autofs_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_search_base = dc=com
ldap_tls_cacertdir = /etc/openldap/cacerts
cache_credentials = True
krb5_store_password_if_offline = True
ldap_tls_reqcert = demand
EOF
10 changes: 8 additions & 2 deletions linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,17 @@
comment="Ensures that LDAP TLS requires certificate is set"
id="test_sssd_ldap_tls_reqcert" version="1">
<ind:object object_ref="object_sssd_ldap_tls_reqcert" />
<ind:state state_ref="state_sssd_ldap_tls_reqcert" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_sssd_ldap_tls_reqcert" version="1">
<ind:textfilecontent54_object id="object_sssd_ldap_tls_reqcert" version="2">
<ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*ldap_tls_reqcert[ \t]*=[ \t]*((?i)demand)[ \t]*$</ind:pattern>
<ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*](?:[^\n\[\]]*\n+)+?[\s]*ldap_tls_reqcert[ \t]*=[ \t]*(\w+)[ \t]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_state id="state_sssd_ldap_tls_reqcert" version="1">
<ind:subexpression operation="pattern match">(?i)demand</ind:subexpression>
</ind:textfilecontent54_state>

</def-group>
24 changes: 24 additions & 0 deletions ...ervices/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/tests/correct_value_conf_d.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
#!/bin/bash
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
#!/bin/bash
#!/bin/bash
# packages = sssd-ldap

# packages = sssd-ldap

. $SHARED/setup_config_files.sh
setup_correct_sssd_config

sed -i '/ldap_tls_reqcert/d' /etc/sssd/sssd.conf

mkdir -p /etc/sssd/conf.d/

cat > "/etc/sssd/conf.d/unused.conf" << EOF
[domain/default]

ldap_id_use_start_tls = True
id_provider = ldap
autofs_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_search_base = dc=com
ldap_tls_cacertdir = /etc/openldap/cacerts
cache_credentials = True
krb5_store_password_if_offline = True
ldap_tls_reqcert = demand
EOF
13 changes: 13 additions & 0 deletions ...p/sssd_ldap_configure_tls_reqcert/tests/ldap_id_provider_and_reqcert_never_conf_d.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
#!/bin/bash
#!/bin/bash
# packages = sssd-ldap

# packages = sssd-ldap

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this test scenario fails for me, the rule passes:

jcerny@fedora:~/work/git/scap-security-guide (pr/11474)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel7 --scenario ldap_id_provider_and_reqcert_never_conf_d.fail.sh sssd_ldap_configure_tls_reqcert
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-01-25-1102/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert
ERROR - Script ldap_id_provider_and_reqcert_never_conf_d.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in pass, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert'.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I set the wrong config in the test hahaha

. $SHARED/setup_config_files.sh
setup_correct_sssd_config

mkdir -p /etc/sssd/conf.d/

cat > "/etc/sssd/conf.d/unused.conf" << EOF
[domain/default]

ldap_tls_reqcert = never
EOF
10 changes: 8 additions & 2 deletions linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,17 @@
comment="Ensures that LDAP uses STARTTLS"
id="test_use_starttls" version="1">
<ind:object object_ref="object_use_starttls_sssd_conf" />
<ind:state state_ref="state_use_starttls_sssd_conf" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_use_starttls_sssd_conf" version="1">
<ind:textfilecontent54_object id="object_use_starttls_sssd_conf" version="2">
<ind:filepath operation="pattern match">^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ \t]*=[ \t]*((?i)true)[ \t]*$</ind:pattern>
<ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*](?:[^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ \t]*=[ \t]*((?i)\w+)[ \t]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_state id="state_use_starttls_sssd_conf" version="1">
<ind:subexpression operation="pattern match">(?i)true</ind:subexpression>
</ind:textfilecontent54_state>

</def-group>
2 changes: 1 addition & 1 deletion linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ description: |-
<br /><br />
To check if LDAP is configured to use TLS when <tt>id_provider</tt> is
set to <tt>ldap</tt> or <tt>ipa</tt>, use the following command:
<pre>$ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf</pre>
<pre>$ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf</pre>

rationale: |-
Without cryptographic integrity protections, information can be
Expand Down
27 changes: 27 additions & 0 deletions ...x_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value_conf_d.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
#!/bin/bash
# packages = /usr/lib/systemd/system/sssd.service

. $SHARED/setup_config_files.sh
setup_correct_sssd_config

systemctl enable sssd

mkdir -p /etc/sssd/conf.d/

sed -i '/ldap_id_use_start_tls/d' /etc/sssd/sssd.conf

cat > "/etc/sssd/conf.d/unused.conf" << EOF
[domain/default]

ldap_id_use_start_tls = True
id_provider = ldap
autofs_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_search_base = dc=com
ldap_tls_cacertdir = /etc/openldap/cacerts
cache_credentials = True
krb5_store_password_if_offline = True
ldap_tls_reqcert = demand
EOF

15 changes: 15 additions & 0 deletions ...es/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false_conf_d.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/bin/bash
# packages = /usr/lib/systemd/system/sssd.service

. $SHARED/setup_config_files.sh
setup_correct_sssd_config

systemctl enable sssd

mkdir -p /etc/sssd/conf.d/

cat > "/etc/sssd/conf.d/unused.conf" << EOF
[domain/default]

ldap_id_use_start_tls = False
EOF
14 changes: 14 additions & 0 deletions shared/macros/10-ansible.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -707,6 +707,20 @@ The following macro remediates Audit syscall rule in :code:`/etc/audit/audit.rul
- test_grep_domain.stdout | length > 0
- test_id_provider.stdout is defined
- test_id_provider.stdout | length < 1

- name: Find all the conf files inside /etc/sssd/conf.d/
find:
paths: "/etc/sssd/conf.d/"
patterns: "*.conf"
register: sssd_conf_d_files

- name: Set {{{ parameter }}} to {{{ value }}} in /etc/sssd/conf.d/ if exists
ansible.builtin.replace:
path: "{{ item.path }}"
regexp: '[^#]*{{{ parameter }}}.*'
replace: '{{{ parameter }}} = {{{ value }}}'
with_items: "{{ sssd_conf_d_files.files }}"

{{%- endmacro %}}


Expand Down
7 changes: 6 additions & 1 deletion shared/macros/10-bash.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1269,7 +1269,6 @@ for f in /etc/sudoers /etc/sudoers.d/* ; do
done
{{%- endmacro -%}}


{{% macro bash_sssd_ldap_config(parameter, value) -%}}
SSSD_CONF="/etc/sssd/sssd.conf"
LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*{{{ parameter }}}'
Expand All @@ -1296,6 +1295,12 @@ if grep -qvzosP $AD_REGEX $SSSD_CONF; then
fi
fi
fi

readarray -t SSSD_CONF_D_FILES < <(find /etc/sssd/conf.d/ -name "*.conf")
for SSSD_CONF_D_FILE in "${SSSD_CONF_D_FILES[@]}"; do
sed -i "s#{{{ parameter }}}[^(\n)]*#{{{ parameter }}} = {{{ value }}}#" "$SSSD_CONF_D_FILE"
done

{{%- endmacro %}}


Expand Down
Loading