You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are several profiles available as part of the Compliance Operator installation.
9
-
10
-
View the available profiles:
8
+
There are several profiles available as part of the Compliance Operator installation. You can use the `oc get` command to view available profiles, profile details, and specific rules.
11
9
10
+
* View the available profiles:
11
+
+
12
12
[source,terminal]
13
13
----
14
14
$ oc get -n <namespace> profiles.compliance
15
15
----
16
-
16
+
+
17
+
This example displays the profiles in the default `openshift-compliance` namespace:
18
+
+
19
+
[source,terminal]
20
+
----
21
+
$ oc get -n openshift-compliance profiles.compliance
22
+
----
23
+
+
17
24
.Example output
18
25
[source,terminal]
19
26
----
20
-
NAME AGE
21
-
ocp4-cis 4h52m
22
-
ocp4-cis-node 4h52m
23
-
ocp4-e8 4h52m
24
-
ocp4-moderate 4h52m
25
-
rhcos4-e8 4h52m
26
-
rhcos4-moderate 4h52m
27
+
NAME AGE
28
+
ocp4-cis 32m
29
+
ocp4-cis-node 32m
30
+
ocp4-e8 32m
31
+
ocp4-moderate 32m
32
+
ocp4-moderate-node 32m
33
+
ocp4-nerc-cip 32m
34
+
ocp4-nerc-cip-node 32m
35
+
ocp4-pci-dss 32m
36
+
ocp4-pci-dss-node 32m
37
+
rhcos4-e8 32m
38
+
rhcos4-moderate 32m
39
+
rhcos4-nerc-cip 32m
27
40
----
41
+
+
42
+
These profiles represent different compliance benchmarks. Each profile has the product name that it applies to added as a prefix to the profile’s name. `ocp4-e8` applies the Essential 8 benchmark to the {product-title} product, while `rhcos4-e8` applies the Essential 8 benchmark to the {op-system-first} product.
28
43
29
-
These profiles represent different compliance benchmarks.
30
-
31
-
View the details of a profile:
32
-
44
+
* View the details of a profile:
45
+
+
33
46
[source,terminal]
34
47
----
35
48
$ oc get -n <namespace> -oyaml profiles.compliance <profile name>
36
49
----
37
-
50
+
+
51
+
This example displays the details of the `rhcos4-e8` profile:
52
+
+
53
+
[source,terminal]
54
+
----
55
+
$ oc get -n openshift-compliance -oyaml profiles.compliance rhcos4-e8
56
+
----
57
+
+
38
58
.Example output
39
59
[source,yaml]
40
60
----
@@ -45,113 +65,133 @@ description: |-
45
65
Cyber Security Centre (ACSC) Essential Eight.
46
66
A copy of the Essential Eight in Linux Environments guide can
title: Australian Cyber Security Centre (ACSC) Essential Eight
113
138
----
114
139
115
-
View the rules within a desired profile:
116
-
140
+
* View the rules within a desired profile:
141
+
+
117
142
[source,terminal]
118
143
----
119
144
$ oc get -n <namespace> -oyaml rules.compliance <rule_name>
120
145
----
121
-
146
+
+
147
+
This example displays the `rhcos4-audit-rules-login-events` rule in the `rhcos4` profile:
148
+
+
149
+
[source,terminal]
150
+
----
151
+
$ oc get -n openshift-compliance -oyaml rules.compliance rhcos4-audit-rules-login-events
152
+
----
153
+
+
122
154
.Example output
123
155
[source,yaml]
124
156
----
125
-
apiVersion: compliance.openshift.io/v1alpha1
126
-
description: '<code>auditd</code><code>augenrules</code><code>.rules</code><code>/etc/audit/rules.d</code><pre>-w /var/log/tallylog -p wa -k logins -w /var/run/faillock -p wa -k logins -w /var/log/lastlog -p wa -k logins</pre><code>auditd</code><code>auditctl</code><code>/etc/audit/audit.rules</code><pre>-w /var/log/tallylog -p wa -k logins -w /var/run/faillock -p wa -k logins -w /var/log/lastlog -p wa -k logins</pre>file in order to watch for unattempted manual edits of files involved in storing logon events:'
Manual editing of these files may indicate nefarious activity,
143
-
such as an attacker attempting to remove evidence of an
144
-
intrusion.
157
+
apiVersion: compliance.openshift.io/v1alpha1
158
+
checkType: Node
159
+
description: |-
160
+
The audit system already collects login information for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix.rules in the directory /etc/audit/rules.d in order to watch for attempted manual edits of files involved in storing logon events:
161
+
162
+
-w /var/log/tallylog -p wa -k logins
163
+
-w /var/run/faillock -p wa -k logins
164
+
-w /var/log/lastlog -p wa -k logins
165
+
166
+
If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file in order to watch for unattempted manual edits of files involved in storing logon events:
This rule checks for multiple syscalls related to login
152
-
events and was written with DISA STIG in mind.
153
-
Other policies should use separate rule for
154
-
each syscall that needs to be checked.
195
+
warning: Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.
155
196
----
156
197
157
-
Each profile has the product name that it applies to added as a prefix to the profile's name. `ocp4-e8` applies the Essential 8 benchmark to the {product-title} product, while `rhcos4-e8` applies the Essential 8 benchmark to the {op-system-first} product.
0 commit comments