Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SqlServer rule V-41402 should be an instance role #650

Closed
General-Fault opened this issue Jun 10, 2020 · 2 comments
Closed

SqlServer rule V-41402 should be an instance role #650

General-Fault opened this issue Jun 10, 2020 · 2 comments
Assignees

Comments

@General-Fault
Copy link

General-Fault commented Jun 10, 2020

Describe the bug
SqlServer resource rule V-41402 is currently categorized as a "Database" role rule. However the settings, unless I'm misunderstanding how they work, are applied to the database instance.

To Reproduce

  1. Create a basic configuration containing a SqlServer resource with the SqlRole = "Database" and the instance and any database name.
Configuration TestConfig {
    Import-DscResource -ModuleName 'PowerSTIG' -ModuleVersion '4.3.0'

    Node localhost {
      
        SqlServer DatabaseSettings {
            SqlVersion = '2016'
            SqlRole = 'Database'
            StigVersion = '1.19'
            ServerInstance = '.\DatabaseInstance'
            Database = 'master'
        }
    }
}
  1. Compile the configuration TestConfig -Verbose
  2. Open the resulting MOF file and find rule V-41402.
  3. Note that the database name is not used in the DSC get/set/test scripts (other than as recently added in a comment for issue Conflict when configuring multiple databases #647).
@erjenkin erjenkin self-assigned this Jun 12, 2020
@erjenkin
Copy link
Member

erjenkin commented Jun 12, 2020

Hello @General-Fault ,

Thanks for the issue. I agree with you on this issue being an 2012 SQL Instance STIG, but DISA has released this as a DB rule, which is why we parsed it as such. The checktext clearly states that traceID's on the instance will be listed, not database.

Check Text: Check to see that all required events are being audited.
From the query prompt:
SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);
All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding.

I don't believe this is an issue with PowerSTIG because this settings is configured and the trace id's are listed correctly via the method listed in DISA's rule

SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0);

@General-Fault
Copy link
Author

I'm happy with just having this case to document the issue. Especially as it pertains to case #647.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants