Skip to content

Add Debian 13 auditd variable options and grub2 UEFI password OVAL #14782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
israel-villar wants to merge 1 commit into
base: master
Choose a base branch
from
+30 −0
Open

Add Debian 13 auditd variable options and grub2 UEFI password OVAL #14782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,3 +28,4 @@ options:
cis_ubuntu2204: syslog|single|halt
cis_ubuntu2404: syslog|single|halt
cis_debian12: syslog|single|halt
cis_debian13: syslog|single|halt
1 change: 1 addition & 0 deletions linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,3 +29,4 @@ options:
cis_ubuntu2204: halt|single
cis_ubuntu2404: halt|single
cis_debian12: halt|single
cis_debian13: halt|single
28 changes: 28 additions & 0 deletions linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/oval/debian.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
<def-group>
<definition class="compliance" id="grub2_uefi_password" version="1">
{{{ oval_metadata("The UEFI grub2 boot loader should have password protection enabled.", rule_title=rule_title) }}}

<criteria operator="AND">
<criterion comment="make sure a password is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" test_ref="test_grub2_uefi_password_grubcfg" />
<criterion comment="make sure a superuser is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" test_ref="test_bootloader_uefi_superuser"/>
</criteria>
</definition>

<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" id="test_bootloader_uefi_superuser" version="2">
<ind:object object_ref="object_bootloader_uefi_superuser" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_bootloader_uefi_superuser" version="2">
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in {{{ grub2_uefi_boot_path }}}/grub.cfg" id="test_grub2_uefi_password_grubcfg" version="1">
<ind:object object_ref="object_grub2_uefi_password_grubcfg" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_grub2_uefi_password_grubcfg" version="1">
<ind:filepath>{{{ grub2_uefi_boot_path }}}/grub.cfg</ind:filepath>
<ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>