|
 |
eabbfc |
From d97cd9112ba9f3958e6658775a8a31e44bd0f0e9 Mon Sep 17 00:00:00 2001
|
|
|
eabbfc |
From: Watson Sato <wsato@redhat.com>
|
|
|
eabbfc |
Date: Tue, 5 Jan 2021 18:03:24 +0100
|
|
|
eabbfc |
Subject: [PATCH] Add rule sudo_add_passwd_timeout
|
|
|
eabbfc |
|
|
|
eabbfc |
This rule configures sudo password prompt timeout.
|
|
|
eabbfc |
---
|
|
|
eabbfc |
controls/anssi.yml | 3 +-
|
|
|
eabbfc |
.../sudo/sudo_add_passwd_timeout/rule.yml | 40 +++++++++++++++++++
|
|
|
eabbfc |
.../software/sudo/var_sudo_passwd_timeout.var | 21 ++++++++++
|
|
|
eabbfc |
shared/references/cce-redhat-avail.txt | 2 -
|
|
|
eabbfc |
4 files changed, 63 insertions(+), 3 deletions(-)
|
|
|
eabbfc |
create mode 100644 linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml
|
|
|
eabbfc |
create mode 100644 linux_os/guide/system/software/sudo/var_sudo_passwd_timeout.var
|
|
|
eabbfc |
|
|
|
eabbfc |
diff --git a/controls/anssi.yml b/controls/anssi.yml
|
|
|
eabbfc |
index 705f8e25aab..5120456230b 100644
|
|
|
eabbfc |
--- a/controls/anssi.yml
|
|
|
eabbfc |
+++ b/controls/anssi.yml
|
|
|
eabbfc |
@@ -892,7 +892,8 @@ controls:
|
|
|
eabbfc |
- var_sudo_umask=0027
|
|
|
eabbfc |
- sudo_add_ignore_dot
|
|
|
eabbfc |
- sudo_add_env_reset
|
|
|
eabbfc |
- # passwd_timeout=1
|
|
|
eabbfc |
+ - sudo_add_passwd_timeout
|
|
|
eabbfc |
+ - var_sudo_passwd_timeout=1_minute
|
|
|
eabbfc |
|
|
|
eabbfc |
- id: R59
|
|
|
eabbfc |
level: minimal
|
|
|
eabbfc |
diff --git a/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml b/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml
|
|
|
eabbfc |
new file mode 100644
|
|
|
eabbfc |
index 00000000000..ae3399527f4
|
|
|
eabbfc |
--- /dev/null
|
|
|
eabbfc |
+++ b/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml
|
|
|
eabbfc |
@@ -0,0 +1,40 @@
|
|
|
eabbfc |
+documentation_complete: true
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+prodtype: ol7,ol8,rhel7,rhel8
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+title: 'Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout'
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+description: |-
|
|
|
eabbfc |
+ The sudo <tt>passwd_timeout</tt> tag sets the amount of time sudo password prompt waits.
|
|
|
eabbfc |
+{{%- if product in ["rhel7", "rhel8"] %}}
|
|
|
eabbfc |
+ On {{{ full_name }}}, the default <tt>passwd_timeout</tt> value is 5 minutes.
|
|
|
eabbfc |
+{{% endif %}}
|
|
|
eabbfc |
+ The passwd_timeout should be configured by making sure that the
|
|
|
eabbfc |
+ <tt>passwd_timeout=sub_var_value("var_sudo_passwd_timeout")</tt> tag exists in
|
|
|
eabbfc |
+ <tt>/etc/sudoers</tt> configuration file or any sudo configuration snippets
|
|
|
eabbfc |
+ in <tt>/etc/sudoers.d/</tt>.
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+rationale: |-
|
|
|
eabbfc |
+ Reducing the time <tt>sudo</tt> waits for a a password reduces the time the process is exposed.
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+severity: medium
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+identifiers:
|
|
|
eabbfc |
+ cce@rhel7: CCE-83963-9
|
|
|
eabbfc |
+ cce@rhel8: CCE-83964-7
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+references:
|
|
|
eabbfc |
+ anssi: BP28(R58)
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+ocil_clause: 'passwd_timeout is not set with the appropriate value for sudo'
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+ocil: |-
|
|
|
eabbfc |
+ To determine if <tt>passwd_timeout</tt> has been configured for sudo, run the following command:
|
|
|
eabbfc |
+ $ sudo grep -ri '^Defaults.*passwd_timeout=sub_var_value("var_sudo_passwd_timeout")' /etc/sudoers /etc/sudoers.d/
|
|
|
eabbfc |
+ The command should return a matching output.
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+template:
|
|
|
eabbfc |
+ name: sudo_defaults_option
|
|
|
eabbfc |
+ vars:
|
|
|
eabbfc |
+ option: passwd_timeout
|
|
|
eabbfc |
+ variable_name: "var_sudo_passwd_timeout"
|
|
|
eabbfc |
diff --git a/linux_os/guide/system/software/sudo/var_sudo_passwd_timeout.var b/linux_os/guide/system/software/sudo/var_sudo_passwd_timeout.var
|
|
|
eabbfc |
new file mode 100644
|
|
|
eabbfc |
index 00000000000..4a9dcd5bb7b
|
|
|
eabbfc |
--- /dev/null
|
|
|
eabbfc |
+++ b/linux_os/guide/system/software/sudo/var_sudo_passwd_timeout.var
|
|
|
eabbfc |
@@ -0,0 +1,21 @@
|
|
|
eabbfc |
+documentation_complete: true
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+title: 'Sudo - passwd_timeout value'
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+description: |-
|
|
|
eabbfc |
+ Defines the number of minutes before the <tt>sudo</tt> password prompt times out.
|
|
|
eabbfc |
+ Defining 0 means no timeout. The default timeout value is 5 minutes.
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+interactive: false
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+type: string
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+operator: equals
|
|
|
eabbfc |
+
|
|
|
eabbfc |
+options:
|
|
|
eabbfc |
+ default: "5"
|
|
|
eabbfc |
+ infinite: "0"
|
|
|
eabbfc |
+ 1_minute: "1"
|
|
|
eabbfc |
+ 2_minutes: "2"
|
|
|
eabbfc |
+ 3_minutes: "3"
|
|
|
eabbfc |
+ 5_minutes: "5"
|
|
|
eabbfc |
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
|
|
|
eabbfc |
index 61391f50c2d..e095e405f66 100644
|
|
|
eabbfc |
--- a/shared/references/cce-redhat-avail.txt
|
|
|
eabbfc |
+++ b/shared/references/cce-redhat-avail.txt
|
|
|
eabbfc |
@@ -349,8 +349,6 @@ CCE-83959-7
|
|
|
eabbfc |
CCE-83960-5
|
|
|
eabbfc |
CCE-83961-3
|
|
|
eabbfc |
CCE-83962-1
|
|
|
eabbfc |
-CCE-83963-9
|
|
|
eabbfc |
-CCE-83964-7
|
|
|
eabbfc |
CCE-83965-4
|
|
|
eabbfc |
CCE-83966-2
|
|
|
eabbfc |
CCE-83967-0
|