Add debian10 content #5058

pschneiders · 2019-12-05T18:49:01Z

Description:

Adding content for Debian 10 "Buster" based on existing content for Debian 9 "Stretch"

Rationale:

Content for auditing Debian 10 didn't exist.

openscap-ci · 2019-12-05T18:49:03Z

Can one of the admins verify this patch?

pep8speaks · 2019-12-05T18:49:05Z

Hello @pschneiders! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:

There are currently no PEP 8 issues detected in this Pull Request. Cheers! 🍻

Comment last updated at 2019-12-19 15:04:07 UTC

redhatrises · 2019-12-05T18:53:31Z

@openscap-ci test this please

pschneiders · 2019-12-05T20:45:12Z

I believe some of the tests that are failing on multiple separate debian environments (armhf and amd64) are old tests that are not relevant. Going to compare Debian 8, 9 and 10 and remove obsolete tests.

redhatrises · 2019-12-05T20:52:02Z

@pschneiders did you scan this as a root user? Some of the SSH errors look as if you scanned as a regular user and not a privileged user.

pschneiders · 2019-12-05T20:56:45Z

@pschneiders did you scan this as a root user? Some of the SSH errors look as if you scanned as a regular user and not a privileged user.

Yes. The scan was done with sudo locally. I performed the same scan on a second system with similar results. I have --verbose DEVEL output too, but I don't find it very helpful in determining a root cause.

redhatrises · 2019-12-05T20:59:27Z

@pschneiders did you scan this as a root user? Some of the SSH errors look as if you scanned as a regular user and not a privileged user.

Yes. The scan was done with sudo locally. I performed the same scan on a second system with similar results. I have --verbose DEVEL output too, but I don't find it very helpful in determining a root cause.

Can you sudo su - to first and then run a scan? Also add the --results, --report, and --oval-results flags and provide the .html and .xml file from the report flag.

pschneiders · 2019-12-05T21:18:14Z

output.zip
Github limits which extensions I can upload so here's a zip with the output. This was run on an amd64 debian 10 system as sudo su - and the command was:

/usr/bin/oscap xccdf eval --results target-results-`date "+%Y-%m-%d-%s"`.xml --report target-report-`date "+%Y-%m-%d-%s"`.html --profile xccdf_org.ssgproject.content_profile_anssi_np_nt28_high --oval-results /usr/local/share/xml/scap/ssg/content/ssg-debian10-ds.xml > output.log 2>&1

pschneiders · 2019-12-05T21:29:26Z

For consistency, here's output from the original armhf system with the same command also in a sudo su - shell.
armhf.zip

yuumasato · 2019-12-06T10:11:20Z

Looks like a bug in OpenSCAP. I find it suspicious that only some tests for package installed/removed are returning error.

grep -P "<test.*package.*(installed|removed).*result=" ssg-debian10-oval.xml.result.xml 
        <test test_id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
        <test test_id="oval:ssg-test_package_avahi_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" result="error"/>
        <test test_id="oval:ssg-test_package_dconf_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_esc_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_gdm_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
        <test test_id="oval:ssg-test_package_nis_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
        <test test_id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
        <test test_id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
        <test test_id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" check_existence="all_exist" check="all" result="error"/>
        <test test_id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="error"/>
        <test test_id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_pam_pkcs11_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_prelink_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" result="error"/>
        <test test_id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_snmp_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_package_syslogng_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
        <test test_id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
        <test test_id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
        <test test_id="oval:ssg-test_service_auditd_package_auditd_installed:tst:1" version="1" check_existence="all_exist" check="all" result="error"/>
        <test test_id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
        <test test_id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" result="error"/>
        <test test_id="oval:ssg-test_service_snmpd_package_snmpd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
        <test test_id="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>

The probe for dpkg_info may be hitting a corner case with following packages and returning an invalid syschar flag.
rsyslog, auditd, cron and openssh-server.

jan-cerny · 2019-12-06T13:43:43Z

It looks like a bug in OpenSCAP in dpkg_info probe.

Could you try to use latest version of OpenSCAP instead of 1.2.16? There were some fixes in the last year?

pschneiders · 2019-12-06T16:32:11Z

It looks like a bug in OpenSCAP in dpkg_info probe.

Could you try to use latest version of OpenSCAP instead of 1.2.16? There were some fixes in the last year?

I'm working on that now. I can't find a newer deb package and building openscap from source fails multiple tests in the build process.

ggbecker · 2019-12-09T19:03:19Z

@openscap-ci test this please

pschneiders · 2019-12-13T14:17:13Z

This content appears to run without errors if I build against this PR branch: OpenSCAP/openscap#1387

pschneiders · 2019-12-17T17:35:46Z

OpenSCAP/openscap#1387 was merged into the current maint-1.3 branch

pschneiders · 2019-12-17T17:43:00Z

2019-12-17_output.zip

Attached is output from a successful run without errors or unknowns.

debian10/cpe/debian10-cpe-dictionary.xml

linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml

linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/rule.yml

linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml

..._os/guide/system/logging/rsyslog_accepting_remote_messages/service_syslogng_enabled/rule.yml

linux_os/guide/system/software/disk_partitioning/partition_for_var/rule.yml

shared/checks/oval/installed_OS_is_debian10.xml

ssg/constants.py

redhatrises · 2019-12-19T00:56:07Z

@openscap-ci test this please

…l pattern

redhatrises · 2019-12-19T15:48:59Z

@openscap-ci add to whitelist

jan-cerny · 2020-01-02T16:22:15Z

LGTM, scanning works for me on my Debian 10 VM with OpenSCAP compiled from git.

@redhatrises Do you need more changes or can we merge it?

redhatrises · 2020-01-02T20:21:02Z

Thanks @pschneiders merging

This comment has been minimized.

Sign in to view

pschneiders force-pushed the debian10 branch from a8a99b1 to b640b3a Compare December 17, 2019 17:49

redhatrises suggested changes Dec 17, 2019

View reviewed changes

pschneiders force-pushed the debian10 branch 2 times, most recently from 1dfad89 to dfce952 Compare December 18, 2019 13:37

pschneiders requested a review from redhatrises December 18, 2019 13:40

Bryan Schneiders added 2 commits December 19, 2019 09:57

Add debian10 content

c6980e7

update debian10 apt_sources_list security regex to contain missing ur…

d4de4c4

…l pattern

pschneiders force-pushed the debian10 branch from a708a66 to d4de4c4 Compare December 19, 2019 15:04

redhatrises merged commit 1c026ff into ComplianceAsCode:master Jan 2, 2020

redhatrises added this to the 0.1.48 milestone Jan 2, 2020

redhatrises added the enhancement General enhancements to the project. label Jan 2, 2020

redhatrises self-assigned this Jan 2, 2020

yuumasato added the Highlight This PR/Issue should make it to the featured changelog. label Jan 15, 2020

mdedonno1337 mentioned this pull request Oct 8, 2021

Add support for Debian 11 #7715

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add debian10 content #5058

Add debian10 content #5058

pschneiders commented Dec 5, 2019 •

edited

Loading

openscap-ci commented Dec 5, 2019

pep8speaks commented Dec 5, 2019 •

edited

Loading

This comment has been minimized.

redhatrises commented Dec 5, 2019

This comment has been minimized.

pschneiders commented Dec 5, 2019

redhatrises commented Dec 5, 2019

pschneiders commented Dec 5, 2019

redhatrises commented Dec 5, 2019

pschneiders commented Dec 5, 2019

pschneiders commented Dec 5, 2019

yuumasato commented Dec 6, 2019

jan-cerny commented Dec 6, 2019

pschneiders commented Dec 6, 2019

ggbecker commented Dec 9, 2019

This comment has been minimized.

pschneiders commented Dec 13, 2019

pschneiders commented Dec 17, 2019

pschneiders commented Dec 17, 2019

redhatrises commented Dec 19, 2019

redhatrises commented Dec 19, 2019

jan-cerny commented Jan 2, 2020

redhatrises commented Jan 2, 2020

Add debian10 content #5058

Add debian10 content #5058

Conversation

pschneiders commented Dec 5, 2019 • edited Loading

Description:

Rationale:

openscap-ci commented Dec 5, 2019

pep8speaks commented Dec 5, 2019 • edited Loading

Comment last updated at 2019-12-19 15:04:07 UTC

This comment has been minimized.

redhatrises commented Dec 5, 2019

This comment has been minimized.

pschneiders commented Dec 5, 2019

redhatrises commented Dec 5, 2019

pschneiders commented Dec 5, 2019

redhatrises commented Dec 5, 2019

pschneiders commented Dec 5, 2019

pschneiders commented Dec 5, 2019

yuumasato commented Dec 6, 2019

jan-cerny commented Dec 6, 2019

pschneiders commented Dec 6, 2019

ggbecker commented Dec 9, 2019

This comment has been minimized.

pschneiders commented Dec 13, 2019

pschneiders commented Dec 17, 2019

pschneiders commented Dec 17, 2019

redhatrises commented Dec 19, 2019

redhatrises commented Dec 19, 2019

jan-cerny commented Jan 2, 2020

redhatrises commented Jan 2, 2020

pschneiders commented Dec 5, 2019 •

edited

Loading

pep8speaks commented Dec 5, 2019 •

edited

Loading