{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/875","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/875/labels{/name}","comments_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/875/comments","events_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/875/events","html_url":"https://github.com/OpenSCAP/scap-security-guide/pull/875","id":119569036,"number":875,"title":"[RHEL/6] [RHEL/7] 'smartcard_auth' rule OVAL & remediations enhancements","user":{"login":"iankko","id":8414918,"avatar_url":"https://avatars.githubusercontent.com/u/8414918?v=3","gravatar_id":"","url":"https://api.github.com/users/iankko","html_url":"https://github.com/iankko","followers_url":"https://api.github.com/users/iankko/followers","following_url":"https://api.github.com/users/iankko/following{/other_user}","gists_url":"https://api.github.com/users/iankko/gists{/gist_id}","starred_url":"https://api.github.com/users/iankko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iankko/subscriptions","organizations_url":"https://api.github.com/users/iankko/orgs","repos_url":"https://api.github.com/users/iankko/repos","events_url":"https://api.github.com/users/iankko/events{/privacy}","received_events_url":"https://api.github.com/users/iankko/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/bugfix","name":"bugfix","color":"fbca04"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/RHEL6","name":"RHEL6","color":"006b75"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/RHEL7","name":"RHEL7","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"mpreisler","id":753153,"avatar_url":"https://avatars.githubusercontent.com/u/753153?v=3","gravatar_id":"","url":"https://api.github.com/users/mpreisler","html_url":"https://github.com/mpreisler","followers_url":"https://api.github.com/users/mpreisler/followers","following_url":"https://api.github.com/users/mpreisler/following{/other_user}","gists_url":"https://api.github.com/users/mpreisler/gists{/gist_id}","starred_url":"https://api.github.com/users/mpreisler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpreisler/subscriptions","organizations_url":"https://api.github.com/users/mpreisler/orgs","repos_url":"https://api.github.com/users/mpreisler/repos","events_url":"https://api.github.com/users/mpreisler/events{/privacy}","received_events_url":"https://api.github.com/users/mpreisler/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/milestones/18","html_url":"https://github.com/OpenSCAP/scap-security-guide/milestones/Finish%20RHEL-6%20PCIDSS%20profile%20support%20(provide%20missing%20remediations)","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/milestones/18/labels","id":1391295,"number":18,"title":"Finish RHEL-6 PCIDSS profile support (provide missing remediations)","description":"The current (performed as of 2015-11-03) scan of a freshly installed Red Hat Enterprise Linux 6 Update 7 system against the included PCI-DSS profile returns the following failing rules:\r\n\r\nLegend:\r\n  RA = Required Action,\r\n  O = Owner.\r\n\r\n* 1) Build and Test AIDE Database (RA: Provide RHEL-6 remediation script, O: ?)\r\n* 2) Verify and Correct File Permissions with RPM (RA: Report relevant bugs downstream, O: iankko),\r\n* 3) Set Password Minimum Length (RA: Provide RHEL-6 remediation script, O: ?),\r\n* 4) Enable Smart Card Login (RA: Provide RHEL-6 remediation script, O:?),\r\n* 5) Configure auditd to use audispd's syslog plugin (RA: Provide RHEL-6 remediation script, O: ?),\r\n* 6) Record attempts to alter time through settimeofday (RA: Fix RHEL-6 OVAL / remediation, O: ?),\r\n* 7) Record Attempts to Alter Time Through stime (RA: Fix RHEL-6 OVAL / remediation, O: ?),\r\n* 8) Record Attempts to Alter Login and Logout Events (RA: Provide RHEL-6 remediation, O: ?),\r\n* 9) Ensure auditd Collects Information on the Use of Privileged Commands (RA: Fix RHEL-6 OVAL, O: iankko),\r\n\r\nSee a full HTML report of freshly installed RHEL-6U7 system post performing the online remediation for PCI DSS profile at:\r\n&nbsp; &nbsp; [1] https://jlieskov.fedorapeople.org/rhel6.7-fresh-install-pcidss-after-remediation-report.html\r\n\r\nThis milestone exists to track the progress done on fixing aforementioned issues (and their owners).","creator":{"login":"iankko","id":8414918,"avatar_url":"https://avatars.githubusercontent.com/u/8414918?v=3","gravatar_id":"","url":"https://api.github.com/users/iankko","html_url":"https://github.com/iankko","followers_url":"https://api.github.com/users/iankko/followers","following_url":"https://api.github.com/users/iankko/following{/other_user}","gists_url":"https://api.github.com/users/iankko/gists{/gist_id}","starred_url":"https://api.github.com/users/iankko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iankko/subscriptions","organizations_url":"https://api.github.com/users/iankko/orgs","repos_url":"https://api.github.com/users/iankko/repos","events_url":"https://api.github.com/users/iankko/events{/privacy}","received_events_url":"https://api.github.com/users/iankko/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":7,"state":"open","created_at":"2015-11-03T13:52:42Z","updated_at":"2015-12-01T15:43:32Z","due_on":"2015-11-30T23:00:00Z","closed_at":null},"comments":2,"created_at":"2015-11-30T20:05:01Z","updated_at":"2015-12-02T12:14:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/pulls/875","html_url":"https://github.com/OpenSCAP/scap-security-guide/pull/875","diff_url":"https://github.com/OpenSCAP/scap-security-guide/pull/875.diff","patch_url":"https://github.com/OpenSCAP/scap-security-guide/pull/875.patch"},"body":"This changeset is performing the following:\r\n* patch https://github.com/OpenSCAP/scap-security-guide/commit/ef3bca0f3f44006c3a595c1617fc1d9ed2b2af45 is fixing ```HTTP 404``` (Page Not Found) error for URL provided in RHEL-6 XCCDF prose for ```smartcard_auth``` rule. While on that fixes also some trailing whitespace noise,\r\n* patch https://github.com/OpenSCAP/scap-security-guide/commit/1b831a10073dcced286438881c11c3753e43add7 is enhancing the existing RHEL-7 OVAL for this rule to also check if ```pcscd.socket``` systemd activation socket is enabled on the underlying RHEL-7 system,\r\n* patch https://github.com/OpenSCAP/scap-security-guide/commit/c9e8cfcdfc9a50036e2fd67f0ba06e19cc151111 modifies the existing RHEL-7 remediation script for this rule to enable ```pcscd.socket``` activation socket on that system as part of the remediation,\r\n* patch https://github.com/OpenSCAP/scap-security-guide/commit/a816236cee41bb640f6f2e277e1a40750f10d1ec is rewriting / replacing the existing RHEL-6 OVAL for this (```smartcard_auth```) rule in order to support both scenarios (in order to return PASS if system properly configured in both from the following cases):\r\n * the case when smart card auth is enabled, but other login methods are allowed on the system,\r\n * the case when solely smart card authentication is allowed on the system, \r\n\r\nand finally:\r\n* patch https://github.com/OpenSCAP/scap-security-guide/commit/8093ca5590764192798fde5fdaa7a216deacc3f4 is adding RHEL-6 remediation for this rule (```smartcard_auth```). It was not possible to make a ```shared/``` version of this remediation script, because there are couple of subtle differences for RHEL-6. Namely:\r\n * ```cert_policy``` key in ```/etc/pam_pkcs11/pam_pkcs11.conf``` doesn't expect a space around the '=' character (between ```cert_policy``` and its value) in contrast to RHEL-7 system,\r\n * as was realized during implementation on RHEL-6 system it's not possible to use ```authconfig``` command to perform the setting, since its use discards the necessary ```/etc/pam_pkcs11/pam_pkcs11.conf``` changes (see inline commits in that remediation for further details).\r\n\r\n  Fixes: https://github.com/OpenSCAP/scap-security-guide/issues/836\r\n\r\nTesting report:\r\n-------------------\r\nAll of the changes have been tested on both:\r\n* recent RHEL-7 system, and\r\n* recent RHEL-6 system\r\n\r\nand AFAICT from testing they are working fine (```make validate``` passes on RHEL-6 AFAICT).\r\n\r\nPlease review.\r\n\r\nThank you, Jan.\r\n"},"comment":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/comments/161274293","html_url":"https://github.com/OpenSCAP/scap-security-guide/pull/875#issuecomment-161274293","issue_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/875","id":161274293,"user":{"login":"mpreisler","id":753153,"avatar_url":"https://avatars.githubusercontent.com/u/753153?v=3","gravatar_id":"","url":"https://api.github.com/users/mpreisler","html_url":"https://github.com/mpreisler","followers_url":"https://api.github.com/users/mpreisler/followers","following_url":"https://api.github.com/users/mpreisler/following{/other_user}","gists_url":"https://api.github.com/users/mpreisler/gists{/gist_id}","starred_url":"https://api.github.com/users/mpreisler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpreisler/subscriptions","organizations_url":"https://api.github.com/users/mpreisler/orgs","repos_url":"https://api.github.com/users/mpreisler/repos","events_url":"https://api.github.com/users/mpreisler/events{/privacy}","received_events_url":"https://api.github.com/users/mpreisler/received_events","type":"User","site_admin":false},"created_at":"2015-12-02T12:14:43Z","updated_at":"2015-12-02T12:14:43Z","body":"LGTM, ACK."}}