Skip to content

Commit f81fd22

Browse files
arlimusarlimus
committed
Merge pull request #21 from atomic111/master
changed GIS to DTAG SEC
2 parents 8b5dffd + 63d6ce6 commit f81fd22

4 files changed

Lines changed: 46 additions & 46 deletions

File tree

‎default/serverspec/os_spec.rb‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,47 +21,47 @@
2121
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
2222
end
2323

24-
# GIS: Req 3.21-4
24+
2525
describe command('find / -name \'.rhosts\' | wc -l ') do
2626
its(:stdout) { should match(/^0/) }
2727
end
2828

29-
# GIS: Req 3.21-4
29+
3030
describe command('find / -name \'hosts.equiv\' | wc -l ') do
3131
its(:stdout) { should match(/^0/) }
3232
end
3333

34-
# GIS: Req 3.21-7
34+
3535
describe file('/etc/shadow') do
3636
it { should be_owned_by 'root' }
3737
end
3838

39-
# GIS: Req 3.21-7
39+
4040
describe file('/etc/shadow') do
4141
it { should be_mode 600 }
4242
end
4343

44-
# GIS: Req 3.21-8
44+
4545
describe command('echo $PATH | grep -ci \'\.\'') do
4646
its(:stdout) { should match(/^0/) }
4747
end
4848

49-
# GIS: Req 3.21-8
49+
5050
describe file('/etc/login.defs') do
5151
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
5252
end
5353

54-
# GIS: Req 3.21-8
54+
5555
describe file('/etc/login.defs') do
5656
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
5757
end
5858

59-
# GIS: Req 3.21-10
59+
6060
describe file('/etc/login.defs') do
6161
its(:content) { should match(/^UMASK +027/) }
6262
end
6363

64-
# GIS: Req 3.21-12
64+
6565
describe 'SUID/ SGID blacklist check' do
6666
it 'found no blacklisted suid/sgid' do
6767
blacklist = [
@@ -97,7 +97,7 @@
9797
end
9898
end
9999

100-
# GIS: Req 3.21-16
100+
101101
describe 'Unique uid' do
102102
it 'check for unique uids' do
103103
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)

‎default/serverspec/sysctl_spec.rb‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,27 +23,27 @@
2323

2424
describe 'IP V4 networking' do
2525

26-
# GIS: Req 3.21-1
26+
2727
context linux_kernel_parameter('net.ipv4.ip_forward') do
2828
its(:value) { should eq 0 }
2929
end
3030

31-
# GIS: Req 3.21-1
31+
3232
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
3333
its(:value) { should eq 0 }
3434
end
3535

36-
# GIS: Req 3.21-3
36+
3737
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
3838
its(:value) { should eq 1 }
3939
end
4040

41-
# GIS: Req 3.21-3 ; GIS: Req 3.37-10
41+
4242
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
4343
its(:value) { should eq 1 }
4444
end
4545

46-
# GIS: Req 3.21-1
46+
4747
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
4848
its(:value) { should eq 1 }
4949
end
@@ -52,7 +52,7 @@
5252
its(:value) { should eq 1 }
5353
end
5454

55-
# GIS: Req 3.01-9
55+
5656
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
5757
its(:value) { should eq 100 }
5858
end
@@ -65,12 +65,12 @@
6565
its(:value) { should eq 0 }
6666
end
6767

68-
# GIS: Req 3.21-3
68+
6969
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
7070
its(:value) { should eq 1 }
7171
end
7272

73-
# GIS: Req 3.21-3
73+
7474
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
7575
its(:value) { should eq 2 }
7676
end
@@ -91,12 +91,12 @@
9191
its(:value) { should eq 1 }
9292
end
9393

94-
# GIS: Req 3.37-12
94+
9595
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
9696
its(:value) { should eq 0 }
9797
end
9898

99-
# GIS: Req 3.37-12
99+
100100
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
101101
its(:value) { should eq 0 }
102102
end
@@ -138,7 +138,7 @@
138138
its(:value) { should eq 1 }
139139
end
140140

141-
# GIS: Req 3.21-1
141+
142142
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
143143
its(:value) { should eq 0 }
144144
end
@@ -202,7 +202,7 @@
202202

203203
describe 'ExecShield' do
204204

205-
# GIS: Req 3.21-5
205+
206206
# check if we find the nx flag
207207
if command('cat /proc/cpuinfo').return_stdout?(/^flags.*?:.*? nx( .*?)?$/)
208208
true
@@ -217,7 +217,7 @@
217217
end
218218
end
219219

220-
# GIS: Req 3.21-5
220+
221221
context linux_kernel_parameter('kernel.randomize_va_space') do
222222
its(:value) { should eq 2 }
223223
end

‎lockdown/serverspec/os_spec.rb‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,47 +21,47 @@
2121
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
2222
end
2323

24-
# GIS: Req 3.21-4
24+
2525
describe command('find / -name \'.rhosts\' | wc -l ') do
2626
its(:stdout) { should match(/^0/) }
2727
end
2828

29-
# GIS: Req 3.21-4
29+
3030
describe command('find / -name \'hosts.equiv\' | wc -l ') do
3131
its(:stdout) { should match(/^0/) }
3232
end
3333

34-
# GIS: Req 3.21-7
34+
3535
describe file('/etc/shadow') do
3636
it { should be_owned_by 'root' }
3737
end
3838

39-
# GIS: Req 3.21-7
39+
4040
describe file('/etc/shadow') do
4141
it { should be_mode 600 }
4242
end
4343

44-
# GIS: Req 3.21-8
44+
4545
describe command('echo $PATH | grep -ci \'\.\'') do
4646
its(:stdout) { should match(/^0/) }
4747
end
4848

49-
# GIS: Req 3.21-8
49+
5050
describe file('/etc/login.defs') do
5151
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
5252
end
5353

54-
# GIS: Req 3.21-8
54+
5555
describe file('/etc/login.defs') do
5656
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
5757
end
5858

59-
# GIS: Req 3.21-10
59+
6060
describe file('/etc/login.defs') do
6161
its(:content) { should match(/^UMASK +027/) }
6262
end
6363

64-
# GIS: Req 3.21-12
64+
6565
describe 'SUID/ SGID whitelist check' do
6666
it 'found only whitelist suid/sgid' do
6767
whitelist = [
@@ -116,7 +116,7 @@
116116
end
117117
end
118118

119-
# GIS: Req 3.21-16
119+
120120
describe 'Unique uid' do
121121
it 'check for unique uids' do
122122
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)

‎lockdown/serverspec/sysctl_spec.rb‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,27 +23,27 @@
2323

2424
describe 'IP V4 networking' do
2525

26-
# GIS: Req 3.21-1
26+
2727
context linux_kernel_parameter('net.ipv4.ip_forward') do
2828
its(:value) { should eq 0 }
2929
end
3030

31-
# GIS: Req 3.21-1
31+
3232
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
3333
its(:value) { should eq 0 }
3434
end
3535

36-
# GIS: Req 3.21-3
36+
3737
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
3838
its(:value) { should eq 1 }
3939
end
4040

41-
# GIS: Req 3.21-3 ; GIS: Req 3.37-10
41+
4242
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
4343
its(:value) { should eq 1 }
4444
end
4545

46-
# GIS: Req 3.21-1
46+
4747
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
4848
its(:value) { should eq 1 }
4949
end
@@ -52,7 +52,7 @@
5252
its(:value) { should eq 1 }
5353
end
5454

55-
# GIS: Req 3.01-9
55+
5656
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
5757
its(:value) { should eq 100 }
5858
end
@@ -65,12 +65,12 @@
6565
its(:value) { should eq 0 }
6666
end
6767

68-
# GIS: Req 3.21-3
68+
6969
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
7070
its(:value) { should eq 1 }
7171
end
7272

73-
# GIS: Req 3.21-3
73+
7474
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
7575
its(:value) { should eq 2 }
7676
end
@@ -91,12 +91,12 @@
9191
its(:value) { should eq 1 }
9292
end
9393

94-
# GIS: Req 3.37-12
94+
9595
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
9696
its(:value) { should eq 0 }
9797
end
9898

99-
# GIS: Req 3.37-12
99+
100100
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
101101
its(:value) { should eq 0 }
102102
end
@@ -138,7 +138,7 @@
138138
its(:value) { should eq 1 }
139139
end
140140

141-
# GIS: Req 3.21-1
141+
142142
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
143143
its(:value) { should eq 0 }
144144
end
@@ -202,7 +202,7 @@
202202

203203
describe 'ExecShield' do
204204

205-
# GIS: Req 3.21-5
205+
206206
# check if we find the nx flag
207207
if command('cat /proc/cpuinfo').return_stdout?(/^flags.*?:.*? nx( .*?)?$/)
208208
true
@@ -217,7 +217,7 @@
217217
end
218218
end
219219

220-
# GIS: Req 3.21-5
220+
221221
context linux_kernel_parameter('kernel.randomize_va_space') do
222222
its(:value) { should eq 2 }
223223
end

0 commit comments

Comments
 (0)