diff --git a/doc/source/developer-notes/V-38667.rst b/doc/source/developer-notes/V-38667.rst new file mode 100644 index 00000000..488b3ef7 --- /dev/null +++ b/doc/source/developer-notes/V-38667.rst @@ -0,0 +1,6 @@ +**Fixed by another STIG** + +The openstack-ansible project already installs and configures AppArmor, which +is a Linux Security Module providing similar functionality to SELinux. In +addition, AIDE is installed to monitor system files in the Ansible tasks for +V-38429. diff --git a/doc/source/developer-notes/V-38670.rst b/doc/source/developer-notes/V-38670.rst new file mode 100644 index 00000000..e264f8c0 --- /dev/null +++ b/doc/source/developer-notes/V-38670.rst @@ -0,0 +1,5 @@ +The AIDE package is already installed as part of the Ansible tasks to fix +V-38429, but these Ansible tasks will verify that the cron job file is actually +in place. Ubuntu will configure the cron job automatically as soon as the +package is installed. If the cron job is missing, an error will be printed +and the playbook will fail. diff --git a/doc/source/developer-notes/V-38695.rst b/doc/source/developer-notes/V-38695.rst new file mode 120000 index 00000000..f65e09f6 --- /dev/null +++ b/doc/source/developer-notes/V-38695.rst @@ -0,0 +1 @@ +V-38670.rst \ No newline at end of file diff --git a/doc/source/developer-notes/V-38696.rst b/doc/source/developer-notes/V-38696.rst new file mode 120000 index 00000000..f65e09f6 --- /dev/null +++ b/doc/source/developer-notes/V-38696.rst @@ -0,0 +1 @@ +V-38670.rst \ No newline at end of file diff --git a/doc/source/developer-notes/V-38698.rst b/doc/source/developer-notes/V-38698.rst new file mode 120000 index 00000000..f65e09f6 --- /dev/null +++ b/doc/source/developer-notes/V-38698.rst @@ -0,0 +1 @@ +V-38670.rst \ No newline at end of file diff --git a/doc/source/developer-notes/V-38700.rst b/doc/source/developer-notes/V-38700.rst new file mode 120000 index 00000000..f65e09f6 --- /dev/null +++ b/doc/source/developer-notes/V-38700.rst @@ -0,0 +1 @@ +V-38670.rst \ No newline at end of file diff --git a/tasks/misc.yml b/tasks/misc.yml index fdd0384e..d85aec7d 100644 --- a/tasks/misc.yml +++ b/tasks/misc.yml @@ -21,6 +21,23 @@ - cat2 - V-38489 +- name: Check for AIDE cron job (for V-38670) + stat: + path: /etc/cron.daily/aide + register: v38670_result + changed_when: False + tags: + - cat2 + - V-38670 + +- name: V-38670 - System must detect unauthorized changes to software and information + fail: + msg: "FAILED: AIDE cron job is missing" + when: v38670_result.stat.exists == False + tags: + - cat2 + - V-38670 + - name: Search for .netrc files (for V-38619) shell: find /root /home -xdev -name .netrc | wc -l register: v38619_result