awailly / cis-ubuntu-ansible Goto Github PK
View Code? Open in Web Editor NEWAudit and modify an Ubuntu system to satisfy CIS (Center for Internet Security) rules
License: GNU General Public License v2.0
Audit and modify an Ubuntu system to satisfy CIS (Center for Internet Security) rules
License: GNU General Public License v2.0
The following condition in check_requirement.yml is not working with latest version of ansible - 2.0.2.0
ansible_version.full | version_compare('1.8', '<')
Hi,
I think I've found an issue in section_12_level1.yml regarding "12.8 Find Un-owned Files and Directories" section.
In the current version shell command is the following:
df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nogroup -ls
I think it should be the following:
df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser -ls
If you check 12.8 in the official CIS benchmark they also use "-nouser" option.
Regards,
Tamas
When running on an Ubuntu Desktop 14.04.3 LTS without openssh-server
installed:
TASK: [cis | 9.3.{4,7,8,9,10} Disable some SSH options (Scored)] **************
failed: [127.0.0.1] => (item=X11Forwarding) => {"failed": true, "item": "X11Forwarding", "rc": 257}
msg: Destination /etc/ssh/sshd_config does not exist !
failed: [127.0.0.1] => (item=HostbasedAuthentication) => {"failed": true, "item": "HostbasedAuthentication", "rc": 257}
msg: Destination /etc/ssh/sshd_config does not exist !
failed: [127.0.0.1] => (item=PermitRootLogin) => {"failed": true, "item": "PermitRootLogin", "rc": 257}
msg: Destination /etc/ssh/sshd_config does not exist !
failed: [127.0.0.1] => (item=PermitEmptyPasswords) => {"failed": true, "item": "PermitEmptyPasswords", "rc": 257}
msg: Destination /etc/ssh/sshd_config does not exist !
failed: [127.0.0.1] => (item=PermitUserEnvironment) => {"failed": true, "item": "PermitUserEnvironment", "rc": 257}
msg: Destination /etc/ssh/sshd_config does not exist !
FATAL: all hosts have already failed -- aborting
The idempotence test fails under Ubuntu Desktop 14.10 (in a VM). It looks like AppArmor can't start (after at least 3 executions):
TASK: [cis | 4.5 Activate AppArmor (start) (Scored)] **************************
changed: [192.168.1.20]
Here's what I get when I try to start AppArmor:
$ sudo service apparmor start 2> /dev/null ; echo $?
apparmor stop/waiting
0
Under Debian 64bit 8.0.0 in a VM:
TASK: [cis | 4.5 Activate AppArmor (start) (Scored)] **************************
failed: [127.0.0.1] => {"failed": true}
msg: Job for apparmor.service failed. See 'systemctl status apparmor.service' and 'journalctl -xn' for details.
FATAL: all hosts have already failed -- aborting
$ systemctl status apparmor.service
โ apparmor.service - LSB: AppArmor initialization
Loaded: loaded (/etc/init.d/apparmor)
Active: failed (Result: exit-code) since Tue 2015-05-19 14:04:11 CEST; 26min ago
Process: 3296 ExecStart=/etc/init.d/apparmor start (code=exited, status=1/FAILURE)
Could be the same issue as #10.
Maybe:
apt: update_cache=yes cache_valid_time={{apt_cache_valid_time}}
With apt_cache_valid_time: 3600
in defaults/main.yml
As part of our base playbook we already update the cache. Setting a valid time in 1.1.1 would prevent from updating the cache again. I've seen lots of larger playbooks also update the cache, so this should be generally useful.
On a Raspbian (release 2015-05-05), after running the playbook once (with use_apparmor = False
) and restarting:
/var/log/
, syslog
, messages
, auth.log
, kern.log
and user.log
fill up with several warnings/messages that seem to repeat an infinite number of times.After the execution of the Ansible playbook on a Raspbian, my logs fill up with:
May 17 08:43:48 localhost sudo: pam_unix(sudo:session): session closed for user root
May 17 08:43:36 localhost sudo: PAM unable to dlopen(pam_cracklib.so): /lib/security/pam_cracklib.so: cannot open shared object file: No such file or directory
May 17 08:43:36 localhost sudo: PAM adding faulty module: pam_cracklib.so
The location of the logs isn't updated when applying the playbook twice with different settings.
I ran the playbook once with send_rsyslog_remote = True
, rebooted and ran it a second time with send_rsyslog_remote = False
. As a result rsyslog still tries to send the logs remotely.
7.1.1 Disable IP Forwarding sets net.ipv4.ip_forward=0. But this pretty much breaks docker. I don't know why I just ran into this today and not many months ago (could be that I have moved running CIS at the end of playbooks):
I would really like to disable a few of the 7.1's. This exclusion really should be configured in the playbook and not left for someone to remember to add --exclude-tags. Using tags for exclusion really does not work since there is no way to set tags programmatically.
My first thought was to change from:
tags:
- section7
- section7.1
- section7.1.2
- section7.1.2.1
To
when: >-
(section7 | default(true) | bool) and
(section7_1 | default(true) | bool) and
(section7_1_2 | default(true) | bool) and
(section7_1_2_1 | default(true) | bool)
But that is really messy and a huge change. Besides the tags would still be needed.
So I guess what I want to propose is to define variables for the sysctl values with defaults as they are now:
- name: 7.1.2.1 Disable Send Packet Redirects (Scored)
sysctl: >
name=net.ipv4.conf.all.send_redirects
value="{{ net.ipv4.conf.all.send_redirects }}"
state=present
But when the value is overridden then the node is not in compliance with CIS. But really this playbook does not actually audit anyway.
I need this change at least for some of these just to get my systems working again. Unless I am mistaken about docker needing
$ sysctl net.ipv4.conf.all.forwarding=1
(https://docs.docker.com/engine/userguide/networking/default_network/container-communication/)
Thoughts?
Looks like the cron config file isn't at the same place in Raspbian:
TASK: [cis | 9.1.1.2 Enable cron Daemon (Scored)] *****************************
failed: [192.168.1.11] => {"failed": true, "rc": 257}
msg: Destination /etc/init/cron.conf does not exist !
FATAL: all hosts have already failed -- aborting
This fails to run with ansible 2.0. Error message below:
fatal: [localhost]: FAILED! => {"failed": true, "reason": "ERROR! this task 'debug' has extra params, which is only allowed in the following modules: command, shell, script, include, include_vars, add_host, group_by, set_fact, raw, meta\n\nThe error appears to have been in '/etc/ansible/roles/awailly.cis-ubuntu-ansible/tasks/check_requirements.yml': line 3, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n - name: Check if OS is Debian-based (we do not support others)\n ^ here\n"}
@pchaigno suggested that code does not have to know about the testing environment, which is correct. Remove the travis_env
variable and create a specific configuration file in tests. Update the .travis.yml to copy the tests/main.yml to default/main.yml in before_install.
(Thoughts in progress...)
We are currently using OSSEC on all nodes. OSSEC comes with Syscheck, which I think performs the same function as AIDE. Would it be possible to factor out the bit that installs AIDE?
I'm not really sure just how this would work though. At least in our playbooks we run cis first, then ossec after. So file checking won't be installed when cis runs. I could swap the two, but I wanted to run cis as soon as possible.
This line throws an error when the variable contains a single quote.
I couldn't find how to properly escape it :/
ok: [192.168.1.11] => (item= 36069 228 -rw-r--r-- 1 2625 2625 230139 Feb 20 2010 /usr/share/scratch/Projects/Speak\ Up/4\ OneDay.sb) => {
"item": " 36069 228 -rw-r--r-- 1 2625 2625 230139 Feb 20 2010 /usr/share/scratch/Projects/Speak\\ Up/4\\ OneDay.sb",
"msg": " 36069 228 -rw-r--r-- 1 2625 2625 230139 Feb 20 2010 /usr/share/scratch/Projects/Speak\\ Up/4\\ OneDay.sb"
}
fatal: [192.168.1.11] => error parsing argument string 'msg=' 36067 200 -rw-r--r-- 1 2625 2625 200851 Feb 20 2010 /usr/share/scratch/Projects/Speak\ Up/5\ E-Cocat'sEarthTips.sb'', try quoting the entire line.
FATAL: all hosts have already failed -- aborting
On an Ubuntu Desktop 14.04 in a VM:
TASK: [cis | 8.1.12 Collect Use of Privileged Commands (infos) (Scored)] ******
fatal: [192.168.1.20] => A variable inserted a new parameter into the module args. Be sure to quote variables if they contain equal signs (for example: "{{var}}").
FATAL: all hosts have already failed -- aborting
The first output lines from audit_lines_for_find
:
-a always,exit -F path=/bin/fusermount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
-a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
-a always,exit -F path=/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
-a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
-a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
-a always,exit -F path=/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
I have a client who ran this on their machine and has since forgotten their root password. This, along with the grub password that is now in place, effectively locks us out of the machine. Is there any way for me to find out what the grub password was set to?
If section 2.17 is skipped section 2.17.2 will result in the following error:
TASK: [cis | 2.17.2 Set Sticky Bit on All World-Writable Directories (Scored)] ***
fatal: [10.0.139.156] => with_items expects a list or a set
fatal: [10.0.136.223] => with_items expects a list or a set
This is really a general problem with ansible (at least with 1.9) in that even though a task is skipped its with_items is still evaluated.
After execution, the exec and login lines are still present in /etc/inetd.conf. The current lineinfile
task does not work.
eg,
failed: [10.0.192.55] => (item=/home/barry/.zprofile) => {"failed": true, "item": "/home/barry/.zprofile"}
msg: src and dest are required for creating links
failed: [10.0.192.55] => (item=/home/barry/.zshenv) => {"failed": true, "item": "/home/barry/.zshenv"}
msg: src and dest are required for creating links
When enabling partitioning
:
(Ubuntu Desktop 14.04 in a VM)
TASK: [cis | 2.6 Bind Mount the /var/tmp directory to /tmp (Scored)] **********
failed: [127.0.0.1] => {"failed": true}
msg: missing required arguments: fstype
FATAL: all hosts have already failed -- aborting
Creating this issue to list to different things missing in the README. I'll probably turn this into a pull request once we have a stable list of what the README should include/explain.
I have certainly playbooks that need (ok want) to skip some checks. For example, 12.8 which checks for un-owned files when I am rebuilding an elasticsearch node and reattaching an existing EBS volume. When CIS runs, the elasticsearch user has not been created yet and the elasticsearch role that will set the owner of the data files on the EBS has not run yet. So the gazillion elasticsearch files on the EBS are not yet owned, which generates a gazillion errors.
What I really want to say -- in that specific playbook -- don't run 12.8. But I can't because the only way to turn off bits of CIS is via tags. And tags can only be set on the command line.
So what do others do? Do you just ignore that you get a 10k errors when provisioning a new node. Or do you always the run the CIS role last in the playbook. (I have considered this, but I want to create a base image with CIS configured since it takes so long.)
On an Ubuntu 14.04 Desktop in a VM, when running the playbook for the second time:
TASK: [cis | 4.5 Activate AppArmor (Scored)]
**********************************
failed: [192.168.1.20] => {"changed": false, "cmd": ["apparmor_status"],
"delta": "0:00:00.290396", "end": "2015-05-12 21:43:08.904776",
"failed": true, "failed_when_result": true, "rc": 0, "start":
"2015-05-12 21:43:08.614380", "stdout_lines": ["apparmor module is loaded.", "26 profiles are loaded.", "26 profiles are in enforce mode.",
" /sbin/dhclient", " /usr/bin/evince", " /usr/bin/evince-previewer",
" /usr/bin/evince-previewer//sanitized_helper", "
/usr/bin/evince-thumbnailer", "
/usr/bin/evince-thumbnailer//sanitized_helper", "
/usr/bin/evince//sanitized_helper", "
/usr/lib/NetworkManager/nm-dhcp-client.action", "
/usr/lib/connman/scripts/dhclient-script", "
/usr/lib/cups/backend/cups-pdf", "
/usr/lib/firefox/firefox{,*[^s][^h]}", "
/usr/lib/firefox/firefox{,*[^s][^h]}//browser_java", "
/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk", "
/usr/lib/firefox/firefox{,*[^s][^h]}//sanitized_helper", "
/usr/lib/lightdm/lightdm-guest-session", "
/usr/lib/lightdm/lightdm-guest-session//chromium", "
/usr/lib/telepathy/mission-control-5", "
/usr/lib/telepathy/telepathy-*", "
/usr/lib/telepathy/telepathy-*//pxgsettings", "
/usr/lib/telepathy/telepathy-*//sanitized_helper", "
/usr/lib/telepathy/telepathy-ofono", " /usr/sbin/cups-browsed", "
/usr/sbin/cupsd", " /usr/sbin/ntpd", " /usr/sbin/rsyslogd", "
/usr/sbin/tcpdump", "0 profiles are in complain mode.", "9 processes
have profiles defined.", "8 processes are in enforce mode.", "
/sbin/dhclient (707) ", " /usr/lib/telepathy/mission-control-5 (2196) ",
" /usr/sbin/cups-browsed (26564) ", " /usr/sbin/cupsd (26826) ", "
/usr/sbin/cupsd (26829) ", " /usr/sbin/cupsd (26830) ", "
/usr/sbin/cupsd (26831) ", " /usr/sbin/ntpd (21635) ", "0 processes
are in complain mode.", "1 processes are unconfined but have a profile
defined.", " /usr/sbin/rsyslogd (10302) "], "warnings": []}
stdout: apparmor module is loaded.
26 profiles are loaded.
26 profiles are in enforce mode.
/sbin/dhclient
/usr/bin/evince
/usr/bin/evince-previewer
/usr/bin/evince-previewer//sanitized_helper
/usr/bin/evince-thumbnailer
/usr/bin/evince-thumbnailer//sanitized_helper
/usr/bin/evince//sanitized_helper
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/connman/scripts/dhclient-script
/usr/lib/cups/backend/cups-pdf
/usr/lib/firefox/firefox{,*[^s][^h]}
/usr/lib/firefox/firefox{,*[^s][^h]}//browser_java
/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk
/usr/lib/firefox/firefox{,*[^s][^h]}//sanitized_helper
/usr/lib/lightdm/lightdm-guest-session
/usr/lib/lightdm/lightdm-guest-session//chromium
/usr/lib/telepathy/mission-control-5
/usr/lib/telepathy/telepathy-*
/usr/lib/telepathy/telepathy-*//pxgsettings
/usr/lib/telepathy/telepathy-*//sanitized_helper
/usr/lib/telepathy/telepathy-ofono
/usr/sbin/cups-browsed
/usr/sbin/cupsd
/usr/sbin/ntpd
/usr/sbin/rsyslogd
/usr/sbin/tcpdump
0 profiles are in complain mode.
9 processes have profiles defined.
8 processes are in enforce mode.
/sbin/dhclient (707)
/usr/lib/telepathy/mission-control-5 (2196)
/usr/sbin/cups-browsed (26564)
/usr/sbin/cupsd (26826)
/usr/sbin/cupsd (26829)
/usr/sbin/cupsd (26830)
/usr/sbin/cupsd (26831)
/usr/sbin/ntpd (21635)
0 processes are in complain mode.
1 processes are unconfined but have a profile defined.
/usr/sbin/rsyslogd (10302)
FATAL: all hosts have already failed -- aborting
PLAY RECAP
********************************************************************
to retry, use: --limit @/home/paul/playbook.retry
192.168.1.20 : ok=41 changed=0 unreachable=0 failed=1
I find that after running the playbook the OSSEC agent on the node can no longer contact the OSSEC server on UDP port 1514.
I'm digging thru all the controls, but if anybody can help me along I would really appreciate it.
TASK: [cis | 2.17.1 Set Sticky Bit on All World-Writable Directories (preparation) (Scored)] ***
skipping: [x.x.x.x]
TASK: [cis | 2.17.2 Set Sticky Bit on All World-Writable Directories (Scored)] ***
fatal: [x.x.x.x] => with_items expects a list or a set
But I don't see why 2.17.1 was skipped. I certainly had no skip-tags specified.
Move from comments to file feeding
For the tests "Create Seperate Partition..." only a message is return, but no test in fstab is performed.
Add a test in fsab and create a warning in logs.
@paskl47 Can you add the badge in the README? We need to check if everything is good quickly, and have the exact URL.
We could check the Operating System (in our case Debian-based) before running the playbook to prevent the user from running it against an unsupported OS.
Currently code coverage is low because Travis test build is very limited (that's mainly the reason why it's so easy to find bugs :p). Some tasks can't be tested because of Travis limitations but many other tasks could be tested if the Travis VM had more "issues".
For instance, Travis didn't find the issue with quotes (#13) because it simply didn't have any unowned file.
So, maybe there should be some first script to add stuff to be fixed to the VM (as in 6f6c6e8). This would insure that Travis does run all the commands it can run from the playbook.
Ansible seems a little light on the testing side but maybe there is a way to check the code coverage of a playbook...?
Depending on where the instance is located, France may not be the closest or best ntp server.
(I will submit a PR shortly)
On a new Ubuntu 14.04 in a VM:
TASK: [cis | 2.17.2 Set Sticky Bit on All World-Writable Directories (Scored)] ***
failed: [192.168.1.20] => (item=/var/metrics) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 116, "group": "whoopsie", "item": "/var/metrics", "mode": "03777", "owner": "root", "path": "/var/metrics", "size": 4096, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/var/crash) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 116, "group": "whoopsie", "item": "/var/crash", "mode": "03777", "owner": "root", "path": "/var/crash", "size": 4096, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/var/tmp) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/var/tmp", "mode": "01777", "owner": "root", "path": "/var/tmp", "size": 4096, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/tmp) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/tmp", "mode": "01777", "owner": "root", "path": "/tmp", "size": 4096, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/tmp/.X11-unix) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/tmp/.X11-unix", "mode": "01777", "owner": "root", "path": "/tmp/.X11-unix", "size": 4096, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/tmp/.ICE-unix) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/tmp/.ICE-unix", "mode": "01777", "owner": "root", "path": "/tmp/.ICE-unix", "size": 4096, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/run/shm) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/run/shm", "mode": "01777", "owner": "root", "path": "/run/shm", "size": 140, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/run/lock) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/run/lock", "mode": "01777", "owner": "root", "path": "/run/lock", "size": 80, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/run/lock) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/run/lock", "mode": "01777", "owner": "root", "path": "/run/lock", "size": 80, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
failed: [192.168.1.20] => (item=/run/shm) => {"details": "invalid literal for int() with base 8: 'a+t'", "failed": true, "gid": 0, "group": "root", "item": "/run/shm", "mode": "01777", "owner": "root", "path": "/run/shm", "size": 140, "state": "directory", "uid": 0}
msg: mode needs to be something octalish
FATAL: all hosts have already failed -- aborting
On allI CIS'ed systems I find that /var/log/auth.log and /var/log/syslog are empty. If I change the owner of these files to 'syslog' and restart rsyslog then logs are written.
The task is clearly consistent with the benchmark. So I am confused as to what is missing on my systems.
We need at least ansible 1.8, galaxy says 1.6.
I added this to my requirements.yml
:
- src: [email protected]:awailly/cis-ubuntu-ansible.git
version: 1aabf4353ba2c5c5e6d2bac41b4eaf5ea5cb1edc
and then tried to install via ansible-galaxy install -r requirements.yml -p $(pwd)/roles --force
- cis-ubuntu-ansible was installed successfully
Traceback (most recent call last):
File "/Users/marshall/.virtualenvs/vg-vault/bin/ansible-galaxy", line 957, in <module>
main()
File "/Users/marshall/.virtualenvs/vg-vault/bin/ansible-galaxy", line 951, in main
fn(args, options, parser)
File "/Users/marshall/.virtualenvs/vg-vault/bin/ansible-galaxy", line 848, in execute_install
for dep in role_dependencies:
TypeError: 'NoneType' object is not iterable
I suspect the issue is the empty dependencies here. this should be - dependencies: []
The auditd configuration may generate a large amount of logs locally if no remote server log is configured. Add an option to warn about that.
When the role is skipped, eg
- role: cis
when: some_variable_that_is_false
A 13.18 fails with
TASK: [cis | 13.18 Check for Presence of User .netrc Files (stat) (Scored)] ***
fatal: [10.0.139.165] => with_items expects a list or a set
fatal: [10.0.136.68] => with_items expects a list or a set
fatal: [10.0.137.117] => with_items expects a list or a set
This may or not be problem with ansible 2.0, but it is with 1.9.x.
To handle this case the two 13.8 with_item values need to be changed to
with_items: '{{ home_users.stdout_lines | default([]) }}'
...
with_items: '{{ netrc_files.results | default([]) }}'
Why ever skip cis? When adding new nodes a cluster (eg, a new mesos-slave node) I will run the entire cluster playbook. The new node gets created and provisioned, but all the other nodes run too. Of course with good playbooks that's just a bunch of 'oks'.
But with some type of nodes, for some of the cis tasks that check files or permissions, there are so many files to check that the playbook can take hours to complete. The mesos-slave for example, is runnign lots of docker containers and other mesos containers and will have a gazzilion data files. For these nodes, I set a value in /etc/ansible/facts.d/cis_ubuntu.fact
indicating that cis has already run and not to do it again.
PR on the way.
Here's what happen with a Raspbian:
TASK: [cis | 4.5 Activate AppArmor (Scored)] **********************************
failed: [192.168.1.11] => {"changed": false, "cmd": ["apparmor_status"], "delta": "0:00:00.280982", "end": "2015-05-13 23:39:45.443618", "failed": true, "failed_when_result": true, "rc": 1, "start": "2015-05-13 23:39:45.162636", "stdout_lines": [], "warnings": []}
stderr: AppArmor not available in kernel.
FATAL: all hosts have already failed -- aborting
Good luck fixing this one! ๐
When I launch the playbook on an Ubuntu 14.04 in Docker:
TASK: [cis-ubuntu-ansible | 7.2.8 Enable TCP SYN Cookies (Scored)] ************
failed: [localhost] => {"failed": true}
msg: Failed to reload sysctl: sysctl: setting key "fs.suid_dumpable": Read-only file system
sysctl: setting key "kernel.randomize_va_space": Read-only file system
sysctl: setting key "net.ipv4.ip_forward": Read-only file system
sysctl: setting key "net.ipv4.conf.all.send_redirects": Read-only file system
sysctl: sett
ing key "net.ipv4.conf.default.send_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.all.accept_source_route": Read-only file system
sysctl: setting key "net.ipv4.conf.default.accept_source_route": Read-only file system
sysctl: setting key "net.ipv4.conf.all.accept_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.default.accept_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.all.secure_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.default.secure_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.all.log_martians": Read-only file system
sysctl: setting key "net.ipv4.conf.default.log_martians": Read-only file system
sysctl: setting key "net.ipv4.icmp_echo_ignore_broadcasts": Read-only file system
sysctl: setting key "net.ipv4.icmp_ignore_bogus_error_responses": Read-only file system
sysctl: setting key "net.ipv4.conf.all.rp_filter": Read-only file system
sysctl: setting key "net.ipv4.conf.default.rp_filter": Read-only file system
sysctl: cannot stat /proc/sys/net/ipv4/tcp_syncookies: No such file or directory
Looks like there is no TCP syncookies support in the kernel. Is it mandatory for the CIS rules? If it is, we'll probably need to add an option to skip it in Docker. Otherwise, it should detect that the kernel doesn't support it and skip this task automatically...
EDIT: Docker build: https://registry.hub.docker.com/u/pchaigno/cis-ubuntu-ansible/build_id/63371/code/bzpufxc6renmdzgkhyrdy7b/
To add to the existing RedHat lockdown.
On an Ubuntu 14.04.02, after running the playbook once and restarting:
/var/log/audit/audit.log
fills up with type=AVC msg=audit(1434557031.321:238105): apparmor="DENIED" operation="open" profile="/usr/sbin/rsyslogd" name="/run/utmp" pid=1033 comm=72733A6D61696E20513A526567 requested_mask="r" denied_mask="r" fsuid=101 ouid=0
lines./cc @paskl47 (who found the bug and left the dirty job of reporting it to the intern... ๐ )
When partitioning with /tmp
in a shared partition. Should we leave it like this or should it skip this one?
TASK: [cis | 2.2 - 4 Set nodev, nosuid, noexec option for /tmp Partition (Scored)] ***
failed: [127.0.0.1] => {"failed": true}
msg: Error mounting /tmp: mount: /tmp is not a block device
FATAL: all hosts have already failed -- aborting
I have the config
$ cat /etc/rsyslog.d/30-marathon.conf
if $programname == 'marathon' then {
action(type="omfile" asyncWriting="on" file="/var/log/marathon.log")
stop
}
This puts the value file="/var/log/marathon.log"
in results
, which ends up failing 8.2.4.3 since that is not a simple file name.
I'm a bit of novice when it comes to syslog configs -- I just copied the above from somewhere and made it part of my marathon install role.
Is this is case that should be handled? Or should I have a different form in the config?
The current mount service only provide session-wide settings, we have to feed the /etc/fstab rather than configuring mount options.
On a new Ubuntu 14.04 in a VM, it runs okay until:
TASK: [cis | 4.5 Activate AppArmor (enforce) (Scored)] ************************
failed: [192.168.1.13] => {"changed": false, "cmd": "aa-enforce /etc/apparmor.d/*", "delta": "0:00:01.333396", "end": "2015-05-02 16:02:57.457397", "failed": true, "failed_when_result": true, "rc": 1, "start": "2015-05-02 16:02:56.124001", "stdout_lines": ["Profile for /etc/apparmor.d/abstractions not found, skipping"], "warnings": []}
stderr: Traceback (most recent call last):
File "/usr/sbin/aa-enforce", line 30, in <module>
tool.cmd_enforce()
File "/usr/lib/python3/dist-packages/apparmor/tools.py", line 153, in cmd_enforce
apparmor.read_profiles()
File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2564, in read_profiles
read_profile(profile_dir + '/' + file, True)
File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2590, in read_profile
profile_data = parse_profile_data(data, file, 0)
File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2843, in parse_profile_data
store_list_var(filelist[file]['lvar'], list_var, value, var_operation)
File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 3274, in store_list_var
raise AppArmorException(_('An existing variable redefined: %s') % list_var)
apparmor.common.AppArmorException: 'An existing variable redefined: @{MOZ_LIBDIR}'
stdout: Profile for /etc/apparmor.d/abstractions not found, skipping
FATAL: all hosts have already failed -- aborting
PLAY RECAP ********************************************************************
to retry, use: --limit @/home/paul/playbook.retry
192.168.1.13 : ok=43 changed=0 unreachable=0 failed=1
I am not the creator, please remove it if not used anymore!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.