Skip to content

Commit d2f57f2

Browse files
author
Patrick Meier
committed
Merge pull request #19 from TelekomLabs/lockdown-mode
Lockdown mode
2 parents 9f03078 + de8b8f1 commit d2f57f2

7 files changed

Lines changed: 456 additions & 103 deletions

File tree

‎default/serverspec/os_spec.rb‎

Lines changed: 30 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -62,57 +62,38 @@
6262
end
6363

6464
# GIS: Req 3.21-12
65-
describe 'SUID/ SGID whitelist check' do
66-
it 'found only whitelist suid/sgid' do
67-
whitelist = [
68-
# whitelist as provided by NSA
69-
'/bin/mount', '/bin/ping', '/bin/su', '/bin/umount', '/sbin/pam_timestamp_check',
70-
'/sbin/unix_chkpwd', '/usr/bin/at', '/usr/bin/gpasswd', '/usr/bin/locate',
71-
'/usr/bin/newgrp', '/usr/bin/passwd', '/usr/bin/ssh-agent', '/usr/libexec/utempter/utempter', '/usr/sbin/lockdev',
72-
'/usr/sbin/sendmail.sendmail', '/usr/bin/expiry',
73-
# whitelist ipv6
74-
'/bin/ping6', '/usr/bin/traceroute6.iputils',
75-
# whitelist nfs
76-
'/sbin/mount.nfs', '/sbin/umount.nfs',
77-
# whitelist nfs4
78-
'/sbin/mount.nfs4', '/sbin/umount.nfs4',
79-
# whitelist cron
80-
'/usr/bin/crontab',
81-
# whitelist consolemssaging
82-
'/usr/bin/wall', '/usr/bin/write',
83-
# whitelist: only SGID with utmp group for multi-session access
84-
# impact is limited; installation/usage has some remaining risk
85-
'/usr/bin/screen',
86-
# whitelist locate
87-
'/usr/bin/mlocate',
88-
# whitelist usermanagement
89-
'/usr/bin/chage', '/usr/bin/chfn', '/usr/bin/chsh',
90-
# whitelist fuse
91-
'/bin/fusermount',
92-
# whitelist pkexec
93-
'/usr/bin/pkexec',
94-
# whitelist sudo
95-
'/usr/bin/sudo', '/usr/bin/sudoedit',
96-
# whitelist postfix
97-
'/usr/sbin/postdrop', '/usr/sbin/postqueue',
98-
# whitelist apache
99-
'/usr/sbin/suexec',
100-
# whitelist squid
101-
'/usr/lib/squid/ncsa_auth', '/usr/lib/squid/pam_auth',
102-
# whitelist kerberos
103-
'/usr/kerberos/bin/ksu',
104-
# whitelist pam_caching
105-
'/usr/sbin/ccreds_validate',
106-
# whitelist Xorg
107-
'/usr/bin/Xorg', # xorg
108-
'/usr/bin/X', # xorg
109-
'/usr/lib/dbus-1.0/dbus-daemon-launch-helper', # freedesktop ipc
110-
'/usr/lib/vte/gnome-pty-helper', # gnome
111-
'/usr/lib/libvte9/gnome-pty-helper', # gnome
112-
'/usr/lib/libvte-2.90-9/gnome-pty-helper' # gnome
65+
describe 'SUID/ SGID blacklist check' do
66+
it 'found no blacklisted suid/sgid' do
67+
blacklist = [
68+
# blacklist as provided by NSA
69+
'/usr/bin/rcp', '/usr/bin/rlogin', '/usr/bin/rsh',
70+
# sshd must not use host-based authentication (see ssh cookbook)
71+
'/usr/libexec/openssh/ssh-keysign',
72+
'/usr/lib/openssh/ssh-keysign',
73+
# misc others
74+
'/sbin/netreport', # not normally required for user
75+
'/usr/sbin/usernetctl', # modify interfaces via functional accounts
76+
# connecting to ...
77+
'/usr/sbin/userisdnctl', # no isdn...
78+
'/usr/sbin/pppd', # no ppp / dsl ...
79+
# lockfile
80+
'/usr/bin/lockfile',
81+
'/usr/bin/mail-lock',
82+
'/usr/bin/mail-unlock',
83+
'/usr/bin/mail-touchlock',
84+
'/usr/bin/dotlockfile',
85+
# need more investigation, blacklist for now
86+
'/usr/bin/arping',
87+
'/usr/sbin/uuidd',
88+
'/usr/bin/mtr', # investigate current state...
89+
'/usr/lib/evolution/camel-lock-helper-1.2', # investigate current state...
90+
'/usr/lib/pt_chown', # pseudo-tty, needed?
91+
'/usr/lib/eject/dmcrypt-get-device',
92+
'/usr/lib/mc/cons.saver' # midnight commander screensaver
11393
]
94+
11495
actual = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' -print 2>/dev/null | grep -v \'^find:\'').stdout.split(/\r?\n/)
115-
(actual - whitelist).count.should be 0
96+
(actual & blacklist).count.should be 0
11697
end
11798
end
11899

modules_disabled/serverspec/modules_spec.rb renamed to lockdown/serverspec/modules_spec.rb

File renamed without changes.

‎lockdown/serverspec/os_spec.rb‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# encoding: utf-8
2+
#
3+
# Copyright 2014, Deutsche Telekom AG
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
require 'spec_helper'
19+
20+
RSpec.configure do |c|
21+
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
22+
end
23+
24+
# GIS: Req 3.21-4
25+
describe command('find / -name \'.rhosts\' | wc -l ') do
26+
its(:stdout) { should match(/^0/) }
27+
end
28+
29+
# GIS: Req 3.21-4
30+
describe command('find / -name \'hosts.equiv\' | wc -l ') do
31+
its(:stdout) { should match(/^0/) }
32+
end
33+
34+
# GIS: Req 3.21-7
35+
describe file('/etc/shadow') do
36+
it { should be_owned_by 'root' }
37+
end
38+
39+
# GIS: Req 3.21-7
40+
describe file('/etc/shadow') do
41+
it { should be_mode 600 }
42+
end
43+
44+
# GIS: Req 3.21-8
45+
describe command('echo $PATH | grep -ci \'\.\'') do
46+
its(:stdout) { should match(/^0/) }
47+
end
48+
49+
# GIS: Req 3.21-8
50+
describe file('/etc/login.defs') do
51+
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
52+
end
53+
54+
# GIS: Req 3.21-8
55+
describe file('/etc/login.defs') do
56+
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
57+
end
58+
59+
# GIS: Req 3.21-10
60+
describe file('/etc/login.defs') do
61+
its(:content) { should match(/^UMASK +027/) }
62+
end
63+
64+
# GIS: Req 3.21-12
65+
describe 'SUID/ SGID whitelist check' do
66+
it 'found only whitelist suid/sgid' do
67+
whitelist = [
68+
# whitelist as provided by NSA
69+
'/bin/mount', '/bin/ping', '/bin/su', '/bin/umount', '/sbin/pam_timestamp_check',
70+
'/sbin/unix_chkpwd', '/usr/bin/at', '/usr/bin/gpasswd', '/usr/bin/locate',
71+
'/usr/bin/newgrp', '/usr/bin/passwd', '/usr/bin/ssh-agent', '/usr/libexec/utempter/utempter', '/usr/sbin/lockdev',
72+
'/usr/sbin/sendmail.sendmail', '/usr/bin/expiry',
73+
# whitelist ipv6
74+
'/bin/ping6', '/usr/bin/traceroute6.iputils',
75+
# whitelist nfs
76+
'/sbin/mount.nfs', '/sbin/umount.nfs',
77+
# whitelist nfs4
78+
'/sbin/mount.nfs4', '/sbin/umount.nfs4',
79+
# whitelist cron
80+
'/usr/bin/crontab',
81+
# whitelist consolemssaging
82+
'/usr/bin/wall', '/usr/bin/write',
83+
# whitelist: only SGID with utmp group for multi-session access
84+
# impact is limited; installation/usage has some remaining risk
85+
'/usr/bin/screen',
86+
# whitelist locate
87+
'/usr/bin/mlocate',
88+
# whitelist usermanagement
89+
'/usr/bin/chage', '/usr/bin/chfn', '/usr/bin/chsh',
90+
# whitelist fuse
91+
'/bin/fusermount',
92+
# whitelist pkexec
93+
'/usr/bin/pkexec',
94+
# whitelist sudo
95+
'/usr/bin/sudo', '/usr/bin/sudoedit',
96+
# whitelist postfix
97+
'/usr/sbin/postdrop', '/usr/sbin/postqueue',
98+
# whitelist apache
99+
'/usr/sbin/suexec',
100+
# whitelist squid
101+
'/usr/lib/squid/ncsa_auth', '/usr/lib/squid/pam_auth',
102+
# whitelist kerberos
103+
'/usr/kerberos/bin/ksu',
104+
# whitelist pam_caching
105+
'/usr/sbin/ccreds_validate',
106+
# whitelist Xorg
107+
'/usr/bin/Xorg', # xorg
108+
'/usr/bin/X', # xorg
109+
'/usr/lib/dbus-1.0/dbus-daemon-launch-helper', # freedesktop ipc
110+
'/usr/lib/vte/gnome-pty-helper', # gnome
111+
'/usr/lib/libvte9/gnome-pty-helper', # gnome
112+
'/usr/lib/libvte-2.90-9/gnome-pty-helper' # gnome
113+
]
114+
actual = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' -print 2>/dev/null | grep -v \'^find:\'').stdout.split(/\r?\n/)
115+
(actual - whitelist).count.should be 0
116+
end
117+
end
118+
119+
# GIS: Req 3.21-16
120+
describe 'Unique uid' do
121+
it 'check for unique uids' do
122+
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)
123+
hm = actual.each_with_object(Hash.new(0)) { |d, counts| counts[d] += 1 }
124+
hm.each do |k, v|
125+
str = "User: UID #{k} instances: "
126+
("#{str}#{v}").should eq("#{str}1")
127+
end
128+
end
129+
end

‎lockdown/serverspec/spec_helper.rb‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# encoding: utf-8
2+
#
3+
# Copyright 2014, Deutsche Telekom AG
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
if ENV['STANDALONE_SPEC']
19+
20+
require 'serverspec'
21+
require 'pathname'
22+
require 'net/ssh'
23+
require 'highline/import'
24+
25+
include Serverspec::Helper::Ssh
26+
include Serverspec::Helper::DetectOS
27+
28+
RSpec.configure do |c|
29+
30+
if ENV['ASK_SUDO_PASSWORD']
31+
c.sudo_password = ask('Enter sudo password: ') { |q| q.echo = false }
32+
else
33+
c.sudo_password = ENV['SUDO_PASSWORD']
34+
end
35+
36+
options = {}
37+
38+
if ENV['ASK_LOGIN_PASSWORD']
39+
options[:password] = ask("\nEnter login password: ") { |q| q.echo = false }
40+
else
41+
options[:password] = ENV['LOGIN_PASSWORD']
42+
end
43+
44+
if ENV['ASK_LOGIN_USERNAME']
45+
user = ask("\nEnter login username: ") { |q| q.echo = false }
46+
else
47+
user = ENV['LOGIN_USERNAME'] || ENV['user'] || Etc.getlogin
48+
end
49+
50+
if user.nil?
51+
puts 'specify login user env LOGIN_USERNAME= or user='
52+
exit 1
53+
end
54+
55+
c.host = ENV['TARGET_HOST']
56+
options.merge(Net::SSH::Config.for(c.host))
57+
c.ssh = Net::SSH.start(c.host, user, options)
58+
c.os = backend.check_os
59+
60+
end
61+
62+
else
63+
require 'serverspec'
64+
65+
include Serverspec::Helper::Exec
66+
include Serverspec::Helper::DetectOS
67+
68+
RSpec.configure do |c|
69+
c.before :all do
70+
c.path = '/sbin:/usr/sbin'
71+
end
72+
end
73+
end

0 commit comments

Comments
 (0)