diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml index 13e9e377e316..411874fe751b 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml @@ -11,7 +11,11 @@ {{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in families and 'fedora' not in product %}} + {{% if product in ['sle16'] %}} + p+i+n+u+g+s+b+acl+selinux+sha512 + {{% else %}} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512 + {{% endif %}} {{% else %}} ^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$ {{% endif %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh index 7795e143b54a..9b3c6fc05734 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu # packages = aide aide --init @@ -14,5 +14,9 @@ bins=( echo >> {{{ aide_conf_path }}} for theFile in "${bins[@]}" do + {{% if product in ['sle16'] %}} + echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512" >> {{{ aide_conf_path }}} + {{% else %}} echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512" >> {{{ aide_conf_path }}} + {{% endif %}} done diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh index 5a9f67915568..522cf2e3dc77 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu # packages = aide declare -a bins @@ -12,5 +12,9 @@ bins=( echo >> {{{ aide_conf_path }}} for theFile in "${bins[@]}" do + {{% if product in ['sle16'] %}} + echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512" >> {{{ aide_conf_path }}} + {{% else %}} echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> {{{ aide_conf_path }}} + {{% endif %}} done diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh index f3a768e16b61..5730366c3b85 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu # packages = aide declare -a bins @@ -12,5 +12,9 @@ bins=( echo >> {{{ aide_conf_path }}} for theFile in "${bins[@]}" do + {{% if product in ['sle16'] %}} + echo "$theFile p+i+n+u+g+s+b+acl+sha512" >> {{{ aide_conf_path }}} + {{% else %}} echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512" >> {{{ aide_conf_path }}} + {{% endif %}} done diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh index dc664133e207..b2f4b95a65b2 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu # packages = aide declare -a bins @@ -11,5 +11,9 @@ bins=( for theFile in "${bins[@]}" do + {{% if product in ['sle16'] %}} + echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha5122" >> {{{ aide_conf_path }}} + {{% else %}} echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha5122" >> {{{ aide_conf_path }}} + {{% endif %}} done diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh index 026e5b3ed037..f340db561154 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_sle,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu # packages = aide aide --init diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml index 36a76ba9f388..774dbc80c97e 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml @@ -4,14 +4,37 @@ # complexity = low # disruption = low -- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service" - ansible.builtin.blockinfile: - create: yes - dest: /etc/systemd/system/aidecheck.service +{{% if 'suse' in families %}} +{{% set aide_service = 'aide.service' %}} +{{% set aide_timer = 'aide.timer' %}} +{{% else %}} +{{% set aide_service = 'aidecheck.service' %}} +{{% set aide_timer = 'aidecheck.timer' %}} +{{% endif %}} + +{{% if product in ["sle16"] %}} +- name: "{{{ rule_title }}} - Make sure AIDE Check Service is including /etc/aide.conf" + ansible.builtin.copy: + dest: /etc/aide_service.conf + owner: root + group: root + mode: 0600 + content: |- + @@include /etc/aide.conf + +- name: "{{{ rule_title }}} - Make sure AIDE Check Service is in enabled state" + ansible.builtin.file: + src: /usr/lib/systemd/system/{{{ aide_service }}} + path: /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}} + state: link +{{% else %}} +- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service {{{ aide_service }}}" + ansible.builtin.copy: + dest: /etc/systemd/system/{{{ aide_service }}} owner: root group: root - mode: '0644' - block: | + mode: 0644 + content: |- [Unit] Description=Aide Check [Service] @@ -20,35 +43,35 @@ [Install] WantedBy=multi-user.target -- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer" - ansible.builtin.blockinfile: - create: yes - dest: /etc/systemd/system/aidecheck.timer +- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer {{{ aide_timer }}}" + ansible.builtin.copy: + dest: /etc/systemd/system/{{{ aide_timer }}} owner: root group: root - mode: '0644' - block: | + mode: 0644 + content: |- [Unit] Description=Aide check every day at 5AM [Timer] OnCalendar=*-*-* 05:00:00 - Unit=aidecheck.service + Unit={{{ aide_service }}} [Install] WantedBy=multi-user.target -- name: "{{{ rule_title }}} - Ensure AIDE Service is Enabled" +{{% endif %}} +- name: "{{{ rule_title }}} - Ensure AIDE Service {{{ aide_service }}} is enabled" ansible.builtin.systemd: - name: aidecheck.service + name: {{{ aide_service }}} enabled: true daemon_reload: true masked: false when: not ansible_check_mode -- name: "{{{ rule_title }}} - Ensure AIDE Service Timer is Enabled" +- name: "{{{ rule_title }}} - Ensure AIDE Service Timer {{{ aide_timer }}} is enabled" ansible.builtin.systemd: - name: aidecheck.timer - state: started + name: {{{ aide_timer }}} enabled: true daemon_reload: true + state: started masked: false when: not ansible_check_mode diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh index 595783f93ce6..4f9fb65c2b3f 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh @@ -2,8 +2,22 @@ {{{ bash_package_install("aide") }}} +{{% if 'suse' in families %}} +{{% set aide_service = 'aide.service' %}} +{{% set aide_timer = 'aide.timer' %}} +{{% else %}} +{{% set aide_service = 'aidecheck.service' %}} +{{% set aide_timer = 'aidecheck.timer' %}} +{{% endif %}} + +{{% if product in ["sle16"] %}} +cat > /etc/aide_service.conf < /etc/systemd/system/aidecheck.service < /etc/systemd/system/{{{ aide_service }}} < /etc/systemd/system/aidecheck.timer < /etc/systemd/system/{{{ aide_timer }}} < {{{ oval_metadata("Make sure systemd timer is defined to run perodic AIDE check.", rule_title=rule_title) }}} @@ -5,25 +12,25 @@ + comment="systemd {{{ aide_service }}} enabled"/> + comment="systemd {{{ aide_timer }}} active"/> - aidecheck.service + {{{ aide_service }}} UnitFileState - aidecheck.timer + {{{ aide_timer }}} UnitFileState - aidecheck.timer + {{{ aide_timer }}} ActiveState @@ -34,7 +41,7 @@ + comment="systemd {{{ aide_service }}} enabled"> @@ -44,7 +51,7 @@ + comment="systemd {{{ aide_timer }}} active"> diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh index 3d0859291e15..a60033db72b1 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh @@ -2,8 +2,19 @@ # platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux # packages = aide +{{% if 'suse' in families %}} +{{% set aide_service = 'aide.service' %}} +{{% set aide_timer = 'aide.timer' %}} +{{% else %}} +{{% set aide_service = 'aidecheck.service' %}} +{{% set aide_timer = 'aidecheck.timer' %}} +{{% endif %}} + +{{% if product in ["sle16"] %}} +ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}} +{{% else %}} # create unit file for periodic aide database check -cat > /etc/systemd/system/aidecheck.service < /etc/systemd/system/{{{ aide_service }}} < /etc/systemd/system/aidecheck.timer < /etc/systemd/system/{{{ aide_timer }}} < /etc/systemd/system/aidecheck.service < {{{ aide_service_unit }}} < /etc/systemd/system/aidecheck-notify.service < {{{ aide_notify_unit }}} < {{{ oval_metadata("AIDE should notify appropriate personnel of the details @@ -11,7 +14,7 @@ test_ref="test_aide_var_cron_notification" /> -{{% if product in ["sle15", "slmicro5", "slmicro6"] %}} +{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}} @@ -19,6 +22,10 @@ test_ref="test_aidecheck_systemd_scan_wants_notification"/> + {{% if product in [ "sle16" ] %}} + + {{% endif %}} {{% endif %}} @@ -52,7 +59,7 @@ ^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$ 1 -{{% if product in ["sle15", "slmicro5", "slmicro6"] %}} +{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}} @@ -60,8 +67,13 @@ - /etc/systemd/system/aidecheck.service + {{% if product in ["sle16"] %}} + /usr/lib/systemd/system/{{{ aide_service }}} + ^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*$ + {{% else %}} + /etc/systemd/system/{{{ aide_service }}} ^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*\-r\s*file:\/w*.*$ + {{% endif %}} 1 - /etc/systemd/system/aidecheck.service - ^.*Before\=.*aidecheck-notify.service.*$ + {{% if product in ["sle16"] %}} + /usr/lib/systemd/system/{{{ aide_service }}} + {{% else %}} + /etc/systemd/system/{{{ aide_service }}} + {{% endif %}} + ^.*Before\=.*{{{ aide_notify_service }}}.*$ 1 - /etc/systemd/system/aidecheck.service - ^.*Wants\=.*aidecheck-notify.service.*$ + {{% if product in ["sle16"] %}} + /usr/lib/systemd/system/{{{ aide_service }}} + {{% else %}} + /etc/systemd/system/{{{ aide_service }}} + {{% endif %}} + ^.*Wants\=.*{{{ aide_notify_service }}}.*$ 1 + + + + + + + /etc/aide.conf + ^[ \t]*report_url[\s]*=[\s]*file:/var/log/aide-report.log + 1 + + {{% endif %}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml index 5788f259eac1..c5730dc46c9c 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml @@ -50,11 +50,17 @@ references: stigid@ol8: OL08-00-010360 stigid@sle12: SLES-12-010510 +{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}} +platform: package[aide] and package[systemd] +{{% else %}} +platform: package[aide] +{{% endif %}} + ocil_clause: 'AIDE has not been configured or has not been configured to notify personnel of scan details' ocil: |- To determine that periodic AIDE execution has been scheduled, run the following command: -{{% if product in ["sle15", "slmicro5", "slmicro6"] %}} +{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
$ sudo systemctl status  aidecheck-notify|grep loaded
The output should return that the service is loaded. Also we should make sure that notification service is started by the check: @@ -73,14 +79,18 @@ fixtext: |- The AIDE tool can be configured to email designated personnel with the use of the cron system. The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. -{{% if product in ["sle15", "slmicro5", "slmicro6"] %}} +{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}} +{{% if product in ["sle16"] %}} + $ cat > /usr/lib/systemd/system/aidecheck-notify.service < /etc/systemd/system/aidecheck-notify.service </etc/aide.conf </etc/aide.conf </etc/aide.conf </etc/aide.conf <