Skip to content

Commit fcafaff

Browse files
author
Emily Rodriguez
committed
testing delta formatting
Signed-off-by: Emily Rodriguez <[email protected]>
1 parent 77ae270 commit fcafaff

File tree

167 files changed

+4428
-2619
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

167 files changed

+4428
-2619
lines changed

‎controls/SV-238196.rb‎

Lines changed: 31 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
control 'SV-238196' do
1+
control "SV-238196" do
22
title "The Ubuntu operating system must provision temporary user accounts with an expiration time
33
of 72 hours or less. "
44
desc "If temporary user accounts remain active when no longer needed or for an excessive period,
@@ -15,8 +15,23 @@
1515
1616
To address
1717
access requirements, many operating systems may be integrated with enterprise-level
18-
authentication/access mechanisms that meet or exceed access control policy requirements. "
19-
desc 'check', "Verify that the Ubuntu operating system expires temporary user accounts within 72 hours or
18+
authentication/access mechanisms that meet or exceed access control policy requirements."
19+
desc "default", "If temporary user accounts remain active when no longer needed or for an excessive period,
20+
these accounts may be used to gain unauthorized access. To mitigate this risk, automated
21+
termination of all temporary accounts must be set upon account creation.
22+
23+
Temporary
24+
accounts are established as part of normal account activation procedures when there is a need
25+
for short-term accounts without the demand for immediacy in account activation.
26+
27+
If
28+
temporary accounts are used, the operating system must be configured to automatically
29+
terminate these types of accounts after a DoD-defined time period of 72 hours.
30+
31+
To address
32+
access requirements, many operating systems may be integrated with enterprise-level
33+
authentication/access mechanisms that meet or exceed access control policy requirements."
34+
desc "check", "Verify that the Ubuntu operating system expires temporary user accounts within 72 hours or
2035
less.
2136
2237
For every existing temporary account, run the following command to obtain its
@@ -32,24 +47,24 @@
3247
accounts has an expiration date set within 72 hours of account creation.
3348
3449
If any temporary
35-
account does not expire within 72 hours of that account's creation, this is a finding. "
36-
desc 'fix', "If a temporary account must be created, configure the system to terminate the account after a
50+
account does not expire within 72 hours of that account's creation, this is a finding."
51+
desc "fix", "If a temporary account must be created, configure the system to terminate the account after a
3752
72-hour time period with the following command to set an expiration date on it.
3853
3954
Substitute
4055
\"system_account_name\" with the account to be created.
4156
4257
$ sudo chage -E $(date -d \"+3 days\"
43-
+%F) system_account_name "
58+
+%F) system_account_name"
4459
impact 0.5
45-
tag severity: 'medium '
46-
tag gtitle: 'SRG-OS-000002-GPOS-00002 '
47-
tag gid: 'V-238196 '
48-
tag rid: 'SV-238196r653763_rule '
49-
tag stig_id: 'UBTU-20-010000 '
50-
tag fix_id: 'F-41365r653762_fix '
51-
tag cci: ['CCI-000016']
52-
tag nist: ['AC-2 (2)']
60+
tag severity: "medium "
61+
tag gtitle: "SRG-OS-000002-GPOS-00002 "
62+
tag gid: "V-238196 "
63+
tag rid: "SV-238196r653763_rule "
64+
tag stig_id: "UBTU-20-010000 "
65+
tag fix_id: "F-41365r653762_fix "
66+
tag cci: ["CCI-000016"]
67+
tag nist: ["AC-2 (2)"]
5368

5469
temporary_accounts = input('temporary_accounts')
5570

@@ -65,4 +80,5 @@
6580
end
6681
end
6782
end
68-
end
83+
84+
end

‎controls/SV-238197.rb‎

Lines changed: 63 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
control 'SV-238197' do
1+
control "SV-238197" do
22
title "The Ubuntu operating system must enable the graphical user logon banner to display the
33
Standard Mandatory DoD Notice and Consent Banner before granting local access to the system
44
via a graphical user logon. "
@@ -48,8 +48,55 @@
4848
characters that can be displayed in the banner:
4949
5050
\"I've read & consent to terms in IS user
51-
agreem't.\" "
52-
desc 'check', "Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD
51+
agreem't.\""
52+
desc "default", "Display of a standardized and approved use notification before granting access to the Ubuntu
53+
operating system ensures privacy and security notification verbiage used is consistent
54+
with applicable federal laws, Executive Orders, directives, policies, regulations,
55+
standards, and guidance.
56+
57+
System use notifications are required only for access via logon
58+
interfaces with human users and are not required when such human interfaces do not exist.
59+
60+
61+
The banner must be formatted in accordance with applicable DoD policy. Use the following
62+
verbiage for operating systems that can accommodate banners of 1300 characters:
63+
64+
\"You are
65+
accessing a U.S. Government (USG) Information System (IS) that is provided for
66+
USG-authorized use only.
67+
68+
By using this IS (which includes any device attached to this IS),
69+
you consent to the following conditions:
70+
71+
-The USG routinely intercepts and monitors
72+
communications on this IS for purposes including, but not limited to, penetration testing,
73+
COMSEC monitoring, network operations and defense, personnel misconduct (PM), law
74+
enforcement (LE), and counterintelligence (CI) investigations.
75+
76+
-At any time, the USG may
77+
inspect and seize data stored on this IS.
78+
79+
-Communications using, or data stored on, this IS
80+
are not private, are subject to routine monitoring, interception, and search, and may be
81+
disclosed or used for any USG-authorized purpose.
82+
83+
-This IS includes security measures
84+
(e.g., authentication and access controls) to protect USG interests--not for your personal
85+
benefit or privacy.
86+
87+
-Notwithstanding the above, using this IS does not constitute consent
88+
to PM, LE or CI investigative searching or monitoring of the content of privileged
89+
communications, or work product, related to personal representation or services by
90+
attorneys, psychotherapists, or clergy, and their assistants. Such communications and
91+
work product are private and confidential. See User Agreement for details.\"
92+
93+
Use the
94+
following verbiage for operating systems that have severe limitations on the number of
95+
characters that can be displayed in the banner:
96+
97+
\"I've read & consent to terms in IS user
98+
agreem't.\""
99+
desc "check", "Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD
53100
Notice and Consent Banner before granting access to the operating system via a graphical user
54101
logon.
55102
@@ -65,8 +112,8 @@
65112
banner-message-enable=true
66113
67114
If the line is
68-
commented out or set to \"false\", this is a finding. "
69-
desc 'fix', "Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.
115+
commented out or set to \"false\", this is a finding."
116+
desc "fix", "Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.
70117
71118
Look for the
72119
\"banner-message-enable\" parameter under the \"[org/gnome/login-screen]\" section and
@@ -84,16 +131,16 @@
84131
85132
$ sudo dconf
86133
update
87-
$ sudo systemctl restart gdm3 "
134+
$ sudo systemctl restart gdm3"
88135
impact 0.5
89-
tag severity: 'medium '
90-
tag gtitle: 'SRG-OS-000023-GPOS-00006 '
91-
tag gid: 'V-238197 '
92-
tag rid: 'SV-238197r653766_rule '
93-
tag stig_id: 'UBTU-20-010002 '
94-
tag fix_id: 'F-41366r653765_fix '
95-
tag cci: ['CCI-000048']
96-
tag nist: ['AC-8 a']
136+
tag severity: "medium "
137+
tag gtitle: "SRG-OS-000023-GPOS-00006 "
138+
tag gid: "V-238197 "
139+
tag rid: "SV-238197r653766_rule "
140+
tag stig_id: "UBTU-20-010002 "
141+
tag fix_id: "F-41366r653765_fix "
142+
tag cci: ["CCI-000048"]
143+
tag nist: ["AC-8 a"]
97144

98145
xorg_status = command('which Xorg').exit_status
99146
if xorg_status == 0
@@ -106,4 +153,5 @@
106153
skip("GUI not installed.\nwhich Xorg exit_status: " + command('which Xorg').exit_status.to_s)
107154
end
108155
end
109-
end
156+
157+
end

‎controls/SV-238198.rb‎

Lines changed: 63 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
control 'SV-238198' do
1+
control "SV-238198" do
22
title "The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent
33
Banner before granting local access to the system via a graphical user logon. "
44
desc "Display of a standardized and approved use notification before granting access to the Ubuntu
@@ -47,8 +47,55 @@
4747
characters that can be displayed in the banner:
4848
4949
\"I've read & consent to terms in IS user
50-
agreem't.\" "
51-
desc 'check', "Verify the Ubuntu operating system displays the Standard Mandatory DoD Notice and Consent
50+
agreem't.\""
51+
desc "default", "Display of a standardized and approved use notification before granting access to the Ubuntu
52+
operating system ensures privacy and security notification verbiage used is consistent
53+
with applicable federal laws, Executive Orders, directives, policies, regulations,
54+
standards, and guidance.
55+
56+
System use notifications are required only for access via logon
57+
interfaces with human users and are not required when such human interfaces do not exist.
58+
59+
60+
The banner must be formatted in accordance with applicable DoD policy. Use the following
61+
verbiage for operating systems that can accommodate banners of 1300 characters:
62+
63+
\"You are
64+
accessing a U.S. Government (USG) Information System (IS) that is provided for
65+
USG-authorized use only.
66+
67+
By using this IS (which includes any device attached to this IS),
68+
you consent to the following conditions:
69+
70+
-The USG routinely intercepts and monitors
71+
communications on this IS for purposes including, but not limited to, penetration testing,
72+
COMSEC monitoring, network operations and defense, personnel misconduct (PM), law
73+
enforcement (LE), and counterintelligence (CI) investigations.
74+
75+
-At any time, the USG may
76+
inspect and seize data stored on this IS.
77+
78+
-Communications using, or data stored on, this IS
79+
are not private, are subject to routine monitoring, interception, and search, and may be
80+
disclosed or used for any USG-authorized purpose.
81+
82+
-This IS includes security measures
83+
(e.g., authentication and access controls) to protect USG interests--not for your personal
84+
benefit or privacy.
85+
86+
-Notwithstanding the above, using this IS does not constitute consent
87+
to PM, LE or CI investigative searching or monitoring of the content of privileged
88+
communications, or work product, related to personal representation or services by
89+
attorneys, psychotherapists, or clergy, and their assistants. Such communications and
90+
work product are private and confidential. See User Agreement for details.\"
91+
92+
Use the
93+
following verbiage for operating systems that have severe limitations on the number of
94+
characters that can be displayed in the banner:
95+
96+
\"I've read & consent to terms in IS user
97+
agreem't.\""
98+
desc "check", "Verify the Ubuntu operating system displays the Standard Mandatory DoD Notice and Consent
5299
Banner before granting access to the operating system via a graphical user logon.
53100
54101
Note: If
@@ -80,8 +127,8 @@
80127
81128
If the
82129
banner-message-text is missing, commented out, or does not match the Standard Mandatory DoD
83-
Notice and Consent Banner exactly, this is a finding. "
84-
desc 'fix', "Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.
130+
Notice and Consent Banner exactly, this is a finding."
131+
desc "fix", "Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.
85132
86133
Set the \"banner-message-text\" line
87134
to contain the appropriate banner message text as shown below:
@@ -108,16 +155,15 @@
108155
109156
$ sudo dconf update
110157
$ sudo
111-
systemctl restart gdm3 "
112-
impact 0.5
113-
tag severity: 'medium '
114-
tag gtitle: 'SRG-OS-000023-GPOS-00006 '
115-
tag gid: 'V-238198 '
116-
tag rid: 'SV-238198r653769_rule '
117-
tag stig_id: 'UBTU-20-010003 '
118-
tag fix_id: 'F-41367r653768_fix '
119-
tag cci: ['CCI-000048']
120-
tag nist: ['AC-8 a']
158+
systemctl restart gdm3"
159+
tag severity: "medium "
160+
tag gtitle: "SRG-OS-000023-GPOS-00006 "
161+
tag gid: "V-238198 "
162+
tag rid: "SV-238198r653769_rule "
163+
tag stig_id: "UBTU-20-010003 "
164+
tag fix_id: "F-41367r653768_fix "
165+
tag cci: ["CCI-000048"]
166+
tag nist: ["AC-8 a"]
121167

122168
banner_text = input('banner_text')
123169
clean_banner = banner_text.gsub(/[\r\n\s]/, '')
@@ -134,4 +180,5 @@
134180
skip 'Package gdm3 not installed, this control Not Applicable'
135181
end
136182
end
137-
end
183+
184+
end

‎controls/SV-238199.rb‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
control 'SV-238199' do
1+
control "SV-238199" do
22
title "The Ubuntu operating system must retain a user's session lock until that user reestablishes
33
access using established identification and authentication procedures. "
44
desc "A session lock is a temporary action taken when a user stops work and moves away from the
@@ -11,10 +11,19 @@
1111
Regardless of where the session lock is determined and
1212
implemented, once invoked, a session lock of the Ubuntu operating system must remain in place
1313
until the user reauthenticates. No other activity aside from reauthentication must unlock
14-
the system.
14+
the system."
15+
desc "default", "A session lock is a temporary action taken when a user stops work and moves away from the
16+
immediate physical vicinity of the information system but does not want to log out because of
17+
the temporary nature of the absence.
1518
16-
"
17-
desc 'check', "Verify the Ubuntu operation system has a graphical user interface session lock enabled.
19+
The session lock is implemented at the point where
20+
session activity can be determined.
21+
22+
Regardless of where the session lock is determined and
23+
implemented, once invoked, a session lock of the Ubuntu operating system must remain in place
24+
until the user reauthenticates. No other activity aside from reauthentication must unlock
25+
the system."
26+
desc "check", "Verify the Ubuntu operation system has a graphical user interface session lock enabled.
1827
1928
2029
Note: If the Ubuntu operating system does not have a graphical user interface installed,
@@ -29,8 +38,8 @@
2938
true
3039
3140
If \"lock-enabled\" is
32-
not set to \"true\", this is a finding. "
33-
desc 'fix', "Configure the Ubuntu operating system to allow a user to lock the current graphical user
41+
not set to \"true\", this is a finding."
42+
desc "fix", "Configure the Ubuntu operating system to allow a user to lock the current graphical user
3443
interface session.
3544
3645
Note: If the Ubuntu operating system does not have a graphical user
@@ -40,17 +49,17 @@
4049
to allow graphical user interface session locks with the following command:
4150
4251
$ sudo
43-
gsettings set org.gnome.desktop.screensaver lock-enabled true "
52+
gsettings set org.gnome.desktop.screensaver lock-enabled true"
4453
impact 0.5
45-
tag severity: 'medium '
46-
tag gtitle: 'SRG-OS-000028-GPOS-00009 '
47-
tag satisfies: %w(SRG-OS-000028-GPOS-00009 SRG-OS-000029-GPOS-00010)
48-
tag gid: 'V-238199 '
49-
tag rid: 'SV-238199r653772_rule '
50-
tag stig_id: 'UBTU-20-010004 '
51-
tag fix_id: 'F-41368r653771_fix '
52-
tag cci: %w(CCI-000056 CCI-000057)
53-
tag nist: ['AC-11 b', 'AC-11 a']
54+
tag severity: "medium "
55+
tag gtitle: "SRG-OS-000028-GPOS-00009 "
56+
tag satisfies: ["SRG-OS-000028-GPOS-00009", "SRG-OS-000029-GPOS-00010"]
57+
tag gid: "V-238199 "
58+
tag rid: "SV-238199r653772_rule "
59+
tag stig_id: "UBTU-20-010004 "
60+
tag fix_id: "F-41368r653771_fix "
61+
tag cci: ["CCI-000056", "CCI-000057"]
62+
tag nist: ["AC-11 b", "AC-11 a"]
5463

5564
xorg_status = command('which Xorg').exit_status
5665
if xorg_status == 0
@@ -62,4 +71,5 @@
6271
skip("GUI not installed.\nwhich Xorg exit_status: " + command('which Xorg').exit_status.to_s)
6372
end
6473
end
65-
end
74+
75+
end

0 commit comments

Comments
 (0)