Skip to content

Commit

Permalink
Update PowerSTIG to parse and apply RHEL 7.x V3R2 (#820)
Browse files Browse the repository at this point in the history
* Migrate PowerSTIG to Azure DevOps for Build and Test (#603)

* update folder structure for azure dev ops

* dscresource unit test passing

* updated unit tests

* Unit test pathing update, all passing

* updated unit test to ensure regex data files are loaded

* updated .tests.header for unit\tools directory

* daily commit - Integrated test updates

* updated tests based on testing feedback

* optimized test header based on feedback

* updated build.psd1 case sensitive

* update build agent to windows-2019

* update build and azure yml files

* added hqrm tests to build yml and dependencies

* updated azure-pipelines.yml to include hqrm test

* updated HRQM display name

* updated test exclusion DSCResources

* intro logic to dynamically build requiredmodules

* updated yml to reflect master

* updated changelog.md

* Update azure-pipelines.yml

* rename sources to source (#605)

* Migrate PowerSTIG to Azure DevOps for Build, Test and Release Deployment (#606)

* updated powerstig for dynamic versioning

* updated gitversion to reflect base version

* updated if statement to adhere to style gls

* updated code to adhere to sgl hqrmtest

* updated code to adhere to sgl hqrm tests

* updated code to adhere to sgl hqrm

* update yml files to support CICD pipeline

* updated markdown function

* update change log structure

* updated spacing via PR feedback

* updated 2012R2 STIG after convert tests
reflected a minor delta

* update changelog.md

* Update PowerSTIG to parse and apply Vmware Vsphere 6.5 STIG V1R3 (#607)

* initial commit for vsphere

* updated based on test results

* updated based on vsphere module name

* updated module manifest to check build status

* updated newlines in raw xccdf

* updated newline

* updated newlies in rules

* updated tests

* updated processed Stig name

* updated vsphere schema

* updated composites

* updated spacing

* updated format

* Updated based on feedback

* update required parameter for composite

* updated service rule

* Added Integration DSCresrouce Vsphere Test

* reverted changes to test

* updated integration tests

* added unit tests

* added unit tests

* added unit tests

* updated formatting based on feedback

* updated based on feedback

* updated comments

* updated tests

* updated changelog.md

* trailing whitespace removed

* updated for HQRM tests

* updated based on pr feedback

* updated case

* update code based on PR feedback

* updated code based on PR feedback.

* updated tests based on PR feedback

* updated test based on PR feedback

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* added Ubuntu nxPackage support

* nxPackage update

* added nxService resource script

* added nxFileLine Rule type and structure

* Regex addition to nxFileLine

* daily commit

* convertfactory update

* daily commit

* updated functions

* Unable to Import PowerSTIG 4.4.0 Due to cyclic dependency Error (#617)

* removed vmware.vspheredsc as a dependency because all of its required dependencies are loaded

* updated module load process for VMware modules

* updated build.yaml

* updated test

* Updated tests

* removed stop error action

* updated formating

* updated based on failing hqrm

* updated module  helper

* moved helper module

* updated location of module helper

* reduced vmware.VsphereDSC version

* updated build.yaml

* updated data file

* update module version schema

* updated based on testing

* Update changelog

* Update based on PR feedback

* daily commit

* daily commit

* JUnit commit

* NUnit commit

* daily commit

* daily commit

* update to nxFileLineRule

* ubuntu commit

* Update PowerSTIG to successfully parse/apply Microsoft IIS Server/Site STIG - Ver 1, Rel10 (#623)

* added IIS Server V1R10

* updated changelog and added iis site v1r10

* updated changelog

* removed N-2 STIGS

* Update PowerSTIG to successfully parse Microsoft SQL Server 2012 Database STIG - Ver 1, Rel 20 (#621)

* updated PowerSTIG to use SQL 2012 Database V1R20

* quotes in test

* updated tabs to spaces in sql raw xccdf

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* explicit Pester version due to 5.x (latest) test failures

* Update PowerSTIG to successfully parse/apply Windows Defender Antivirus STIG - V1R8 (#626)

* added new Windows Defender STIG V1R8 removed V1R6

* updated based on PR feedback:

* merged origin

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* initial commit (#640)

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* Update PowerSTIG to successfully parse/apply Microsoft IIS 10 Server/Site STIG - V1R1 (#641)

* added IIS 10.0 Server

* updated IIS 10 site stig

* updated based on tests

* updated based on tests

* updated log file

* added esxi 6.5 v1r4 (#637)

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* Update PowerSTIG to successfully parse/apply Windows Server 2012 DNS STIG - Ver 1, Rel 14 (#635)

* DNS Update commit

* removed DNS 1.12

* explicit version for DscResource.Test

* Update PowerSTIG to allow for workgroup level scans (#643)

* added community requested functionality to not require domain/forest parameters

* updated warning message

* reverted to old module dscresource.test

* Updated based on feedback

* updated sql 2016 instance 1.9 (#638)

* Update PowerSTIG to successfully parse/apply MS SQL Server 2012 Instance Ver. 1 Rel. 20 (#642)

* updated sql 2012 Instance V1R20

* updated Get-SqlTechnologyRole

* removed tabs

* added a new line to the end of xccdf

* update build to use dscresource.test 0.13.1

* updated code based on feedback

* Redhat commit

* daily commit

* daily commit

* daily commit

* daily commit

* daily commit

* updated regex

* updated rule to use hardcoded framework

* updated nxFileLine Rules

* updated processed xml based on banner rule

* updated exclusionlist

* updated TestRange function

* daily commit

* added RHEL composite

* updated RHEL composite and manifest

* Update PowerSTIG with new SkipRuleCategory Parameter to skip entire STIG Category/Severity Level(s) (#740)

* Fixed Missing OrgSettings for V-88203 - Win10 Client 1.19 and 1.21 (#672)

* fixed V-88203 to be org setting with Tenant Guid

* updated changelog.md

* fixed registry rule issue in sql 2016 (#671)

* Release Process Update: Ensure the nuget package uses explicit DSC Resource Module Versions (#670)

* dialy commit

* updated build task to leverage nuget

* added new line for Common.Data.ps1

* warning message to troubleshoot ADO pipeline

* updated package tasks

* updated release.module.build

* updated module

* updated release

* updated release

* updated release

* hard coded nuget.exe path

* fixed FilePath parameter

* dynamically detect nuget.exe

* nuget dynamic detection

* testing alternate nuget detection

* updated release to leverage get-command for nuget
detection

* updated code to replace only the task needed

* updated build funct. conform to style guideline

* updated New-NuspecFile funciton

* Update PowerSTIG to successfully parse/apply Windows 2012 R2 MS Version 2, Rev 19 (#679)

* added support for 2012 R2 V2R19

* added new line to xml

* added Server 2019 V1R5,removed V1R2 (#684)

* Update PowerSTIG to successfully parse/apply Windows 10 STIG - V1R23 (#682)

* Added Windows Client V1R23, Removed Windows CLient V1R19

* Added Windows Client V1R23, Removed Windows CLient V1R19

* removed random tabs

* removed tabs from converted

* updated based on feedback

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* added support for 2016 V1R12 DC/MS (#685)

* Fixed: IIS Sever 10.0 STIG hardening rule V-100163 fails with error in Windows Server 2019 while using PowerSTIG 4.4.2 (#689)

* updated PowerSTIG to use AccessControlDsc 1.4.1

* updated composites with AccessControlDsc 1.4.1

* Update PowerSTIG to successfully parse/apply IIS 10.0 Site/Server V1R2 STIGs (#701)

* added support for IIS 10 Site/Server V1R2

* updated IISServer 10 V1R1 org settings file

* Revert "updated IISServer 10 V1R1 org settings file"

This reverts commit 54d4e82.

* added Firefox V4R29 STIG, remove V4R27 (#700)

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* Update PowerSTIG to successfully parse/apply SQL Server 2016 Instance V1R10 (#705)

* added SQL 2016 Instance V1R10, removed V1R8

* Updated changelog.md

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* added dns V1R15 (#697)

squash/merge

* Update PowerSTIG To Use xDnsServer version 1.16.0.0 (#703)

* Updated xDnsServer version

* update module version

* updated changelog.md

* upgrade xWebadministration to 3.2.0 (#714)

* added IE 11 STIG - V1R19 (#708)

* Removed Windows Server 2016 DC/MS V1R9 from processed STIGs folder (#710)

* removed old 2016 DC/MS processed STIGs

* updated changelog.md

* Update PowerSTIG to successfully parse/apply IIS Site/Server V1R11 STIGs (#706)

* added support for IIS site/server V1R11

* removed old processed STIGs

* updated AuditPolicyDsc to 1.4.0.0 (#716)

* Allow application of applicable user rights assignments for non-domain and disconnected systems (#719)

* updated based on community feedback

* update based on feedback

* update powerstig to use SecurityPolicyDsc 2.10.0.0 (#717)

* updated PowerSTIG to use ComputerMgmtDsc to 8.4.0 (#721)

* Added SkipRuleCategory support to PowerSTIG

* updating test to be compat with new feature

* updated test configs with dynamic logic

* updated test logic to run get-dscresource once

* updated to disallow skipping doc/man rules

* updated integration dscresource tests

* PR Feedback updates

Co-authored-by: Eric Jenkins <erjenkin@microsoft.com>

* Increase Code Coverage of PowerSTIG to %75 (#742)

* updated tests for increased code cov part 1

* fixed test

* update changelog.md

* update changelog

* tes

* reverted change

* added VsphereNTPsetting tests

* updated checklist test

* updated DomainName Function tests

* updated powerstig xml tests

* added tests for Convertto-PowerSTIGxml and Compare

* updated tests

* updated webconfig property rule test

* updated to convert all STIGS

* removed redundant tests

* update only select one of each STIG

* added all office stigs

* reverted some tests

* updated tests:

* removed dependency for helper files

* updated tests

* removed example folder

* update based on feedback

* updated test

* Increase Code Coverage of PowerSTIG (#745)

* Fixed Missing OrgSettings for V-88203 - Win10 Client 1.19 and 1.21 (#672)

* fixed V-88203 to be org setting with Tenant Guid

* updated changelog.md

* fixed registry rule issue in sql 2016 (#671)

* Release Process Update: Ensure the nuget package uses explicit DSC Resource Module Versions (#670)

* dialy commit

* updated build task to leverage nuget

* added new line for Common.Data.ps1

* warning message to troubleshoot ADO pipeline

* updated package tasks

* updated release.module.build

* updated module

* updated release

* updated release

* updated release

* hard coded nuget.exe path

* fixed FilePath parameter

* dynamically detect nuget.exe

* nuget dynamic detection

* testing alternate nuget detection

* updated release to leverage get-command for nuget
detection

* updated code to replace only the task needed

* updated build funct. conform to style guideline

* updated New-NuspecFile funciton

* Update PowerSTIG to successfully parse/apply Windows 2012 R2 MS Version 2, Rev 19 (#679)

* added support for 2012 R2 V2R19

* added new line to xml

* added Server 2019 V1R5,removed V1R2 (#684)

* Update PowerSTIG to successfully parse/apply Windows 10 STIG - V1R23 (#682)

* Added Windows Client V1R23, Removed Windows CLient V1R19

* Added Windows Client V1R23, Removed Windows CLient V1R19

* removed random tabs

* removed tabs from converted

* updated based on feedback

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* added support for 2016 V1R12 DC/MS (#685)

* Fixed: IIS Sever 10.0 STIG hardening rule V-100163 fails with error in Windows Server 2019 while using PowerSTIG 4.4.2 (#689)

* updated PowerSTIG to use AccessControlDsc 1.4.1

* updated composites with AccessControlDsc 1.4.1

* Update PowerSTIG to successfully parse/apply IIS 10.0 Site/Server V1R2 STIGs (#701)

* added support for IIS 10 Site/Server V1R2

* updated IISServer 10 V1R1 org settings file

* Revert "updated IISServer 10 V1R1 org settings file"

This reverts commit 54d4e82.

* added Firefox V4R29 STIG, remove V4R27 (#700)

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* Update PowerSTIG to successfully parse/apply SQL Server 2016 Instance V1R10 (#705)

* added SQL 2016 Instance V1R10, removed V1R8

* Updated changelog.md

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* added dns V1R15 (#697)

squash/merge

* Update PowerSTIG To Use xDnsServer version 1.16.0.0 (#703)

* Updated xDnsServer version

* update module version

* updated changelog.md

* upgrade xWebadministration to 3.2.0 (#714)

* added IE 11 STIG - V1R19 (#708)

* Removed Windows Server 2016 DC/MS V1R9 from processed STIGs folder (#710)

* removed old 2016 DC/MS processed STIGs

* updated changelog.md

* Update PowerSTIG to successfully parse/apply IIS Site/Server V1R11 STIGs (#706)

* added support for IIS site/server V1R11

* removed old processed STIGs

* updated AuditPolicyDsc to 1.4.0.0 (#716)

* Allow application of applicable user rights assignments for non-domain and disconnected systems (#719)

* updated based on community feedback

* update based on feedback

* update powerstig to use SecurityPolicyDsc 2.10.0.0 (#717)

* updated PowerSTIG to use ComputerMgmtDsc to 8.4.0 (#721)

* Added SkipRuleCategory support to PowerSTIG

* updating test to be compat with new feature

* updated test configs with dynamic logic

* updated test logic to run get-dscresource once

* updated to disallow skipping doc/man rules

* updated integration dscresource tests

* testing code coverage

* updated registryrule test to include more coverage

* updated sqlscriptqueryrule tests

* updated setScript in Get-ShutdownOnError function

* updated permissionrule tests with add. test case

* updated permRule test to increase code coverage

* updated changelog

* updated test and code coverage threshold

* updated code coverage threshold to 81

* updated CC threshold to 80

Co-authored-by: Eric Jenkins <erjenkin@microsoft.com>

* removed old stig files after merge with 4.6.0

* updated data and log file based on testing

* updated regex data sections based on testing

* updated regex data

* updated regex patterns for does not contain

* added new line in redhat xccdf

* added new line to methods for HQRM

* created new nxFile rule type for banner rule

* update changelog

* updated processed xml

* updated to RHEL V3R1

* updated code to correct auditrule path

* daily commit

* updated nxFileLine to parse rule correctly

* added more rule support

* Update PowerSTIG to include LegacyId to assist in determining Legacy Vuln Ids with the new DISA standard. (#789)

* added support for legacyid in processed xml

* updated  change log

* updated tests for legacy id

* updated tests to reflect new base rule prop.

* Update PowerSTIG to fix LegacyId Logic (#792)

* updated legacyid logic

* updated changelog

* corrected changelog entry

* Update PowerSTIG to successfully parse/apply Microsoft Windows 2012 and 2012 R2 MS STIG - Ver 3, Rel 1 (#793)

* added support for Win2012R2 MS 3.1

* updated xccdf to have new line based on feedback

* updated cert changes from Eric and regen 2012R2 MS

* added support for 2012 DC 3.1 (#796)

* Update PowerSTIG to successfully parse/apply Microsoft Windows Server 2019 STIG - Ver 2, Rel 1 (#794)

* initial commit

* updated 2019

* updated 2019 MS v2 Stig

* updated to use correct convert flow

* update changelog.md

* fixed merge error

* added newline to raw xccdf

* added newline

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* Update PowerSTIG to successfully parse/apply Microsoft Windows Defender Antivirus STIG - Ver 2, Rel 1 (#795)

* added support for defender v2 stig

* added newline to raw xccdf

* updated org settings

* removed n-2 processed

Co-authored-by: Brian Wilhite <bcwilhite@live.com>

* Update PowerSTIG to successfully parse/apply Microsoft Windows 10 STIG - Ver 2, Rel 1 (#797)

* initial commit

* updated convert

* updated disa copy paste error

* Update PowerSTIG to successfully parse/apply Microsoft Windows Server 2016 STIG - Ver 2, Rel 1 (#798)

* merged 4.7.0 and added 2016 split stig

* added support for 2016 MS-DC v2r1 STIG

* updated default org settings file

* updated Get-StigRule to include legacyid support (#801)

* Update PowerSTIG to Parse/Apply Google Chrome V2R1 (#803)

* initial commit for Chrome

* fixed parse error

* fixed rule

* added support for chrome

* updated changelog

* updated key, removed trailing "

* removed tabs

* updated resource

* updated export function

* updated

* updated based on testing

* Updated based on testing

* updated tests

* updated based on test failure

* updated based on testing

* updated based on testing

* added registry policy file to schema

* update based on feedback

* updated based on feedback

* Fixed 2018 V-205820 to be SecurityOptionRule (#805)

* updated changelog and filehash for release

* updated split rule logic from 4.8.0

* removed old RHEL STIG, fixed hard coded rules

* updated xccdf to have new line

* fixed 2019DC processed stig based on test feedback

* updated regex in testhelper to detect "nx"

* removed ubuntu stig

* removed write-warning

* updated azure pipeline yml to publish CC s/f

* created nx rule type tests

* added nxFile dsc resource script to RHEL composite

* updated nxFile dsc resource script

* added nxFile to nxFileLine resource script

* added support for RHEL 7.x STIG 3.1

* updated changelog.md

* removed ubuntu support from RHEL branch

* added support for RHEL 3.2

* added SkipRuleSev to RHEL

* updated code and tests based on feedback.

* added skip rule resource to RHEL composite.

* updated test based on feedback

* added nxScript.skip for linux.

* updated test based on feedback

Co-authored-by: Eric Jenkins <erjenkin@microsoft.com>
  • Loading branch information
bcwilhite and erjenkin authored Jan 29, 2021
1 parent 479ad18 commit 163c533
Show file tree
Hide file tree
Showing 55 changed files with 16,697 additions and 385 deletions.
5 changes: 3 additions & 2 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

* Update PowerSTIG to remove old rule Ids in Hard Coded Framework: [#790](https://github.com/microsoft/PowerStig/issues/790)
* Update PowerSTIG to Parse/Apply MS Office 365 ProPlus Ver 2, Rel 1: [#811](https://github.com/microsoft/PowerStig/issues/811)
* Update PowerSTIG to parse and apply RHEL 7.x V3R1: [#608](https://github.com/microsoft/PowerStig/issues/608)
* Update PowerSTIG to Add Checklist Accountability: [#808](https://github.com/microsoft/PowerStig/issues/808)
* Update PowerSTIG to move O365 Pro Plus log entries into Exclusion Rule list: [#815](https://github.com/microsoft/PowerStig/issues/815)
* Fixed: ConvertTo-ManualCheckListHashTable function call is missing mandatory argument: [#823](https://github.com/microsoft/PowerStig/issues/823)
Expand Down Expand Up @@ -100,12 +101,12 @@
* Update PowerSTIG to parse and apply Windows Server 2019 V1R3 STIG: [#584](https://github.com/microsoft/PowerStig/issues/584)
* Update PowerSTIG to parse/convert the Windows Server 2016 V2R10: [#582](https://github.com/microsoft/PowerStig/issues/582)
* Update PowerSTIG to parse/convert the Windows Server 2012 DNS STIG V1R13: [#580](https://github.com/microsoft/PowerStig/issues/580)
* Update PowerSTIG to to parse/convert the Windows Server 2012 R2 DC V2R19: [#578](https://github.com/microsoft/PowerStig/issues/578)
* Update PowerSTIG to parse/convert the Windows Server 2012 R2 DC V2R19: [#578](https://github.com/microsoft/PowerStig/issues/578)
* Update PowerSTIG to parse/convert the Windows Defender STIG V1R7: [#576](https://github.com/microsoft/PowerStig/issues/576)
* Update PowerSTIG to successfully parse Mozilla Firefox STIG - Ver 4, Rel 28: [#573](https://github.com/microsoft/PowerStig/issues/573)
* Update PowerSTIG to parse and apply Adobe Acrobat Reader Version 1, Release 6: [#562](https://github.com/microsoft/PowerStig/issues/562)
* Update PowerSTIG release process to include STIG Coverage markdown wiki automation: [#560](https://github.com/microsoft/PowerStig/issues/560)
* Update to PowerSTIG to show duplicate rule status matching in a checklist: [#257](https://github.com/microsoft/PowerStig/issues/257)
* Update PowerSTIG to show duplicate rule status matching in a checklist: [#257](https://github.com/microsoft/PowerStig/issues/257)
* Fixed [#589](https://github.com/microsoft/PowerStig/issues/589): Update module manifest to leverage GPRegistryPolicyDsc v1.2.0
* Fixed [#569](https://github.com/microsoft/PowerStig/issues/569): Update SqlServerDsc module version references
* Fixed [#259](https://github.com/microsoft/PowerStig/issues/259): Checklist .ckl file fails XML validation in Stig Viewer 2.8.
Expand Down
1 change: 0 additions & 1 deletion Tests/Unit/Module/STIG.Checklist.tests.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ Describe 'New-StigCheckList' {
}
}
}

Example -OutputPath $TestDrive

$mofTest = '{0}{1}' -f $TestDrive.fullname,"\localhost.mof"
Expand Down
117 changes: 117 additions & 0 deletions Tests/Unit/Module/nxFileLineRule.tests.ps1
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
#region Header
. $PSScriptRoot\.tests.header.ps1
#endregion

try
{
InModuleScope -ModuleName "$($global:moduleName).Convert" {
#region Test Setup
$testRuleList = @(
@{
FilePath = '/etc/xinetd.d/tftp'
ContainsLine = 'server_args = -s /var/lib/tftpboot'
DoesNotContainPattern = '#\s*server_args\s*=\s*-s\s*/var/lib/tftpboot'
OrganizationValueRequired = $false
CheckContent = 'Verify the TFTP daemon is configured to operate in secure mode.
Check to see if a TFTP server has been installed with the following commands:
# yum list installed tftp-server
tftp-server.x86_64 x.x-x.el7 rhel-7-server-rpms
If a TFTP server is not installed, this is Not Applicable.
If a TFTP server is installed, check for the server arguments with the following command:
# grep server_args /etc/xinetd.d/tftp
server_args = -s /var/lib/tftpboot
If the "server_args" line does not have a "-s" option and a subdirectory is not assigned, this is a finding.'
},
@{
FilePath = '/etc/audit/rules.d/audit.rules'
ContainsLine = '-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid'
DoesNotContainPattern = '#\s*-a\s*always,exit\s*-F\s*arch\s*=\s*b32\s*-S\s*execve\s*-C\s*uid!\s*=\s*euid\s*-F\s*euid\s*=\s*0\s*-k\s*setuid'
OrganizationValueRequired = $false
CheckContent = 'Verify the operating system audits the execution of privileged functions using the following command:
# grep -iw execve /etc/audit/audit.rules
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.'
},
@{
FilePath = '/etc/pam.d/passwd'
ContainsLine = 'password substack system-auth'
DoesNotContainPattern = '^\s*password\s\s+substack\s\s+system-auth\s*$|^#\s*password\s*substack\s*system-auth.*'
OrganizationValueRequired = $false
CheckContent = 'Verify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords:
# grep /etc/pam.d/passwd
password substack system-auth
If no results are returned, the line is commented out, this is a finding.'
},
@{
FilePath = '/etc/pam.d/system-auth'
ContainsLine = ''
DoesNotContainPattern = ''
OrganizationValueRequired = $true
OrganizationValueTestString = 'that the following statement is true when leveraging the correct nxFileLine ContainsLine format: "If the value of "retry" is set to "0" or greater than "3", this is a finding" '
CheckContent = 'Verify the operating system uses "pwquality" to enforce the password complexity rules.
Check for the use of "pwquality" with the following command:
# cat /etc/pam.d/system-auth | grep pam_pwquality
password required pam_pwquality.so retry=3
If the command does not return an uncommented line containing the value "pam_pwquality.so", this is a finding.
If the value of "retry" is set to "0" or greater than "3", this is a finding'
}
)
#endregion

foreach ($testRule in $testRuleList)
{
. $PSScriptRoot\Convert.CommonTests.ps1
}

Describe 'MultipleRules' {
$testRuleList = @(
@{
Count = 4
CheckContent = 'Verify the operating system audits the execution of privileged functions using the following command:
# grep -iw execve /etc/audit/audit.rules
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.
If both the "b32" and "b64" audit rules for "SGID" files are not defined, this is a finding.'
}
)

foreach ($testRule in $testRuleList)
{
It "Should return $true" {
$multipleRule = [nxFileLineRuleConvert]::HasMultipleRules($testRule.CheckContent)
$multipleRule | Should -Be $true
}
It "Should return $($testRule.Count) rules" {
$multipleRule = [nxFileLineRuleConvert]::SplitMultipleRules($testRule.CheckContent)
$multipleRule.count | Should -Be $testRule.Count
}
}
}
}
}
finally
{
. $PSScriptRoot\.tests.footer.ps1
}
39 changes: 39 additions & 0 deletions Tests/Unit/Module/nxFileRule.tests.ps1
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
#region Header
. $PSScriptRoot\.tests.header.ps1
#endregion

try
{
InModuleScope -ModuleName "$($global:moduleName).Convert" {
#region Test Setup
$testRuleList = @(
@{
FilePath = '/etc/issue'
Contents = 'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use details.'
OrganizationValueRequired = $false
CheckContent = 'Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a command line user logon.
Check to see if the operating system displays a banner at the command line logon screen with the following command:
# more /etc/issue
The command should return the following text:
"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use details."
If the operating system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.
If the text in the "/etc/issue" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.'
}
)
#endregion

foreach ($testRule in $testRuleList)
{
. $PSScriptRoot\Convert.CommonTests.ps1
}
}
}
finally
{
. $PSScriptRoot\.tests.footer.ps1
}
35 changes: 35 additions & 0 deletions Tests/Unit/Module/nxPackageRule.tests.ps1
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
#region Header
. $PSScriptRoot\.tests.header.ps1
#endregion

try
{
InModuleScope -ModuleName "$($global:moduleName).Convert" {
#region Test Setup
$testRuleList = @(
@{
Ensure = 'Absent'
Name = 'rsh-server'
OrganizationValueRequired = $false
FixText = 'Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command:
# yum remove rsh-server'
CheckContent = 'Check to see if the rsh-server package is installed with the following command:
# yum list installed rsh-server
If the rsh-server package is installed, this is a finding.'
}
)
#endregion

foreach ($testRule in $testRuleList)
{
. $PSScriptRoot\Convert.CommonTests.ps1
}
}
}
finally
{
. $PSScriptRoot\.tests.footer.ps1
}
46 changes: 46 additions & 0 deletions Tests/Unit/Module/nxServiceRule.tests.ps1
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
#region Header
. $PSScriptRoot\.tests.header.ps1
#endregion

try
{
InModuleScope -ModuleName "$($global:moduleName).Convert" {
#region Test Setup
$testRuleList = @(
@{
Enabled = 'False'
Name = 'autofs'
State = $null
OrganizationValueRequired = $false
FixText = 'Configure the operating system to disable the ability to automount devices.
Turn off the automount service with the following commands:
# systemctl stop autofs
# systemctl disable autofs
If "autofs" is required for Network File System (NFS), it must be documented with the ISSO.'
CheckContent = 'Verify the operating system disables the ability to automount devices.
Check to see if automounter service is active with the following command:
# systemctl status autofs
autofs.service - Automounts filesystems on demand
Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled)
Active: inactive (dead)
If the "autofs" status is set to "active" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.'
}
)
#endregion

foreach ($testRule in $testRuleList)
{
. $PSScriptRoot\Convert.CommonTests.ps1
}
}
}
finally
{
. $PSScriptRoot\.tests.footer.ps1
}
2 changes: 1 addition & 1 deletion Tools/TestHelper/TestHelper.psm1
Original file line number Diff line number Diff line change
Expand Up @@ -498,7 +498,7 @@ function Get-DscResourceModuleInfo
)

$moduleInfo = @()
$modulePattern = "(?<ModuleName>(?<=ModuleName\s)\w+.\w+(?=\s))"
$modulePattern = "(?<ModuleName>(?<=ModuleName\s)\w*.\w+(?=\s))"
$versionPatthern = "(?<ModuleVersion>(?<=ModuleVersion\s)[\d\.]+(?=$))"

$importModuleCommands = Select-String -Path $Path -Pattern 'Import-DscResource' -AllMatches
Expand Down
2 changes: 2 additions & 0 deletions azure-pipelines.yml
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ stages:

- task: PublishBuildArtifacts@1
displayName: 'Publish Test Artifact'
condition: succeededOrFailed()
inputs:
pathToPublish: 'output/testResults/'
artifactName: 'testResults'
Expand Down Expand Up @@ -152,6 +153,7 @@ stages:
- job: Code_Coverage
displayName: 'Publish Code Coverage'
dependsOn: Test_Unit
condition: succeededOrFailed()
pool:
vmImage: 'ubuntu 16.04'
timeoutInMinutes: 0
Expand Down
47 changes: 47 additions & 0 deletions source/DSCResources/RHEL/RHEL.psd1
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License.

@{
# Script module or binary module file associated with this manifest.
RootModule = 'RHEL.schema.psm1'

# Version number of this module.
ModuleVersion = '1.0.0.0'

# ID used to uniquely identify this module
GUID = 'ec05eebf-eddf-4439-9c5b-fdff4910d960'

# Author of this module
Author = 'Microsoft Corporation'

# Company or vendor of this module
CompanyName = 'Microsoft Corporation'

# Copyright statement for this module
Copyright = '(c) 2020 Microsoft Corporation. All rights reserved.'

# Description of the functionality provided by this module
Description = 'Composite DSC Resource for managing Redhat Enterprise Linux DISA STIGs'

# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
FunctionsToExport = @('RHEL')

# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
CmdletsToExport = @()

# Variables to export from this module
VariablesToExport = ''

# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
AliasesToExport = @()

# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
PrivateData = @{

PSData = @{

} # End of PSData hashtable

} # End of PrivateData hashtable

}
Loading

0 comments on commit 163c533

Please sign in to comment.