Skip to content

Commit 439426a

Browse files
oheimburgeroheimburger
committed
Updates for 250623
1 parent 6370e5f commit 439426a

File tree

6 files changed

+51
-38
lines changed

6 files changed

+51
-38
lines changed

‎.DS_Store

0 Bytes
Binary file not shown.

‎security/security-design/shared-assets/oci-security-health-check-standard/README.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Owner: Olaf Heimburger
44

5-
Version: 250602 (cis_report.py version 3.0.0.4) for CIS OCI Foundation Benchmark 3.0.0
5+
Version: 250623 (cis_report.py version 3.0.0.5) for CIS OCI Foundation Benchmark 3.0.0
66

77
# Introduction
88
![Flyer](./files/resources/OCI_Security_Health_Check_Standard.png)
@@ -56,22 +56,22 @@ See the *OCI Security Health Check - Standard Edition* in action and watch the [
5656

5757
Before running the *OCI Security Health Check - Standard Edition* you should download and verify it.
5858

59-
- Download the latest distribution [oci-security-health-check-standard-250602.zip](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.zip).
59+
- Download the latest distribution [oci-security-health-check-standard-250623.zip](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.zip).
6060
- Download the respective checksum file:
61-
- [oci-security-health-check-standard-250602.sha512](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.sha512).
62-
- [oci-security-health-check-standard-250602.sha512256](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.sha512256).
61+
- [oci-security-health-check-standard-250623.sha512](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.sha512).
62+
- [oci-security-health-check-standard-250623.sha512256](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.sha512256).
6363
- Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory).
6464

6565
On MacOS:
6666
```
6767
cd <your_downloads_directory>
68-
shasum -a 512256 -c oci-security-health-check-standard-250602.sha512256
68+
shasum -a 512256 -c oci-security-health-check-standard-250623.sha512256
6969
```
7070
7171
On Linux (including Cloud Shell):
7272
```
7373
cd <your_downloads_directory>
74-
sha512sum -c oci-security-health-check-standard-250602.sha512
74+
sha512sum -c oci-security-health-check-standard-250623.sha512
7575
```
7676
7777
**Reject the downloaded file if the check fails!**
@@ -84,10 +84,10 @@ In OCI Cloud Shell you can do a short cut without downloading the files mentione
8484
2. Open Cloud Shell
8585
3. Run these commands in your Cloud Shell:
8686
```
87-
wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.zip
88-
wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.sha512
89-
sha512sum -c oci-security-health-check-standard-250602.sha512
90-
unzip -q oci-security-health-check-standard-250602.zip
87+
wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.zip
88+
wget -q https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.sha512
89+
sha512sum -c oci-security-health-check-standard-250623.sha512
90+
unzip -q oci-security-health-check-standard-250623.zip
9191
```
9292
9393
## Prepare the OCI Tenancy

‎security/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Owner: Olaf Heimburger
44

5-
Version: 250602 (cis_report.py version 3.0.0.4) for CIS OCI Foundation Benchmark 3.0.0
5+
Version: 250623 (cis_report.py version 3.0.0.5) for CIS OCI Foundation Benchmark 3.0.0
66

77
## When to use this asset?
88

@@ -47,22 +47,22 @@ Tested on **OCI Cloud Shell** with **Public network**, **Oracle Linux**, **MacOS
4747

4848
Before running the *OCI Security Health Check - Standard Edition* you should download and verify it.
4949

50-
- Download the latest distribution [oci-security-health-check-standard-250602.zip](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.zip).
50+
- Download the latest distribution [oci-security-health-check-standard-250623.zip](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.zip).
5151
- Download the respective checksum file:
52-
- [oci-security-health-check-standard-250602.sha512](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.sha512).
53-
- [oci-security-health-check-standard-250602.sha512256](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250602.sha512256).
52+
- [oci-security-health-check-standard-250623.sha512](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.sha512).
53+
- [oci-security-health-check-standard-250623.sha512256](https://github.com/oracle-devrel/technology-engineering/raw/main/security/security-design/shared-assets/oci-security-health-check-standard/files/resources/oci-security-health-check-standard-250623.sha512256).
5454
- Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory).
5555

5656
On MacOS:
5757
```
5858
cd <your_downloads_directory>
59-
shasum -a 512256 -c oci-security-health-check-standard-250602.sha512256
59+
shasum -a 512256 -c oci-security-health-check-standard-250623.sha512256
6060
```
6161
6262
On Linux (including Cloud Shell):
6363
```
6464
cd <your_downloads_directory>
65-
sha512sum -c oci-security-health-check-standard-250602.sha512
65+
sha512sum -c oci-security-health-check-standard-250623.sha512
6666
```
6767
6868
**Reject the downloaded file when the check fails!**
@@ -207,7 +207,7 @@ allow group 'Default'/'grp-auditors' to inspect vcns in compartment <compartment
207207
- Upload the distribution file.
208208
- Extract it
209209
```
210-
unzip -q oci-security-health-check-standard-250602.zip
210+
unzip -q oci-security-health-check-standard-250623.zip
211211
```
212212
213213
#### Run the script
@@ -281,11 +281,11 @@ allow group 'Default'/'grp-auditors' to inspect vcns in compartment <compartment
281281
Follow the instructions to select /usr/bin/python3.9
282282
- Log out
283283
284-
- From your desktop, upload the `oci-security-health-check-standard-250602.zip` file to the Compute VM using any SFTP client.
284+
- From your desktop, upload the `oci-security-health-check-standard-250623.zip` file to the Compute VM using any SFTP client.
285285
- Log into the Compute VM
286286
- Extract the distribution
287287
```
288-
unzip -q oci-security-health-check-standard-250602.zip
288+
unzip -q oci-security-health-check-standard-250623.zip
289289
```
290290
- Change directory into `oci-security-health-check-standard`:
291291
```

‎security/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
OCI Security Health Check - Standard Edition
33
============================================
44
Owner: Olaf Heimburger
5-
Version: 250602 (cis_report.py version 3.0.0.4) for CIS OCI Foundation Benchmark 3.0.0
5+
Version: 250623 (cis_report.py version 3.0.0.5) for CIS OCI Foundation Benchmark 3.0.0
66

77
When to use this asset?
88

@@ -112,7 +112,7 @@ Usage
112112
- From the menu select the Cloud Shell item.
113113
- When running it the first time:
114114
- Upload the provided ZIP file.
115-
- Extract it with unzip -q oci-security-health-check-standard-250602.zip
115+
- Extract it with unzip -q oci-security-health-check-standard-250623.zip
116116
- Change directory into oci-security-health-check-standard
117117
$ cd oci-security-health-check-standard
118118
$ screen
@@ -169,11 +169,11 @@ Usage
169169
- Log out
170170

171171
- From your desktop, upload the
172-
"oci-security-health-check-standard-250602.zip" file to the Compute VM
172+
"oci-security-health-check-standard-250623.zip" file to the Compute VM
173173
using any SFTP client.
174174
- Log into the Compute VM
175175
- Extract the distribution
176-
unzip -q oci-security-health-check-standard-250602.zip
176+
unzip -q oci-security-health-check-standard-250623.zip
177177

178178
- Change directory into "oci-security-health-check-standard":
179179
cd oci-security-health-check-standard

‎security/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/scripts/cis_reports/cis_reports.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,9 @@
4242
except Exception:
4343
OUTPUT_DIAGRAMS = False
4444

45-
RELEASE_VERSION = "3.0.0.4"
45+
RELEASE_VERSION = "3.0.0.5"
4646
PYTHON_SDK_VERSION = "2.152.1"
47-
UPDATED_DATE = "May 27, 2025"
47+
UPDATED_DATE = "June 23, 2025"
4848

4949

5050
##########################################################################
@@ -975,7 +975,7 @@ def __init__(self, config, signer, proxy, output_bucket, report_directory, repor
975975
self.__raw_regions.append(record)
976976

977977
# By Default it is today's date
978-
self.__report_directory = f'{report_directory}/' if report_directory else f'{self.__tenancy.name}-{self.report_datetime}'
978+
self.__report_directory = f'{report_directory}' if report_directory else f'{self.__tenancy.name}-{self.report_datetime}'
979979

980980
self.__report_prefix = f'{report_prefix}_' if report_prefix else ''
981981
self.__report_summary_json = report_summary_json
@@ -4355,7 +4355,7 @@ def __report_cis_analyze_tenancy_data(self):
43554355
self.cis_foundations_benchmark_3_0['2.5']['Findings'].append(
43564356
sl)
43574357
break
4358-
elif 'destination' in irule and irule['destination'] == "0.0.0.0/0":
4358+
elif 'destination' in irule and irule['destination'] == "0.0.0.0/0" and irule['protocol'] != '1':
43594359
debug("Security List has bad egress rule")
43604360
self.cis_foundations_benchmark_3_0['2.5']['Status'] = False
43614361
self.cis_foundations_benchmark_3_0['2.5']['Findings'].append(
@@ -6349,8 +6349,8 @@ def execute_report():
63496349
if OUTPUT_DIAGRAMS:
63506350
try:
63516351
worksheet = workbook.add_worksheet('cis_summary_charts')
6352-
worksheet.insert_image('B2', f'{csv_report_directory}{report_prefix}cis_summary_compliance.png')
6353-
worksheet.insert_image('L2', f'{csv_report_directory}{report_prefix}cis_summary_compliance_by_focus_area.png')
6352+
worksheet.insert_image('B2', f'{csv_report_directory}/{report_prefix}cis_summary_compliance.png')
6353+
worksheet.insert_image('L2', f'{csv_report_directory}/{report_prefix}cis_summary_compliance_by_focus_area.png')
63546354
except Exception:
63556355
pass
63566356
csvfiles = glob.glob(f'{csv_report_directory}/{report_prefix}*.csv')

‎security/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/standard.sh

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
#
88
# Author: Olaf Heimburger
99
#
10-
VERSION=250602
10+
VERSION=250623
1111

1212
graal_version=24.2.1
1313
OS_TYPE=$(uname)
@@ -23,19 +23,26 @@ if [ ${PARENT_DIR} == "." ]; then
2323
PARENT_DIR=${PWD}
2424
fi
2525

26+
DEBUG=0
2627
RUN_CIS=1
2728
RUN_SHOWOCI=1
2829
NO_ZIP=0
2930
NO_CSV=1
3031
ZIP_PROTECT=0
3132
QUIET=1
32-
NEW_STYLE=0
33+
NEW_STYLE=1
3334
PREPARE_ONLY=0
3435
REGION_NAME=''
3536
TENANCY="DEFAULT"
3637
INSTANCE_PRINCIPAL=0
3738
INSTALL_GRAAL=0
3839

40+
debug() {
41+
if [ $DEBUG -eq 1 ]; then
42+
echo 'DEBUG: ' $*
43+
fi
44+
}
45+
3946
SCRIPT_NAME=$(basename $0)
4047
IS_ADVANCED=1
4148
PYTHON_ENV=$HOME/.venv/advanced
@@ -91,14 +98,16 @@ usage() {
9198
printf " --cis options -- Run cis_report only and provide additional options.\n"
9299
printf " --showoci options -- Run showoci only and provide additional options.\n"
93100
printf " For example, --showoci '-h' shows available options.\n"
94-
printf " The options -jf, -ip, -t, -rg, -xlsx_nodate, --version can be ignored.\n"
101+
printf " The options -jf, -ip, -t, -rg, -xlsx_nodate, --version are detected automatically and are not required.\n"
95102
printf " --new-style -- Changes output for compliance checking.\n"
96103
else
97104
printf "\nUsage: $0 [-h] [-ip] [-r|--region region_name] [-t|--tenancy tenancy_name] [-c|--cis options]\n"
98105
printf " [--no-zip] [--zip-protect] [--verbose] [-v|--version]\n"
99-
printf " -h -- this message\n"
100-
printf " -ip -- Use instance principal for authentication.\n"
101-
printf " --cis options -- Run cis_report only and provide additional options.\n"
106+
printf " -h -- this message\n"
107+
printf " -ip -- Use instance principal for authentication.\n"
108+
printf " --cis options -- Run cis_report only and provide additional options.\n"
109+
printf " For example, --cis '-h' shows available options.\n"
110+
printf " The options -dt, -ip, -t, --regions are detected automatically and are not required.\n"
102111
fi
103112
printf " --no-zip -- Do not create a ZIP file for the contents pf the output directory.\n"
104113
printf " --zip-protect -- Encrypt ZIP file with a password of your choice.\n"
@@ -160,6 +169,7 @@ make_env() {
160169
PYTHON_CMD=$(which python3)
161170
${PYTHON_CMD} -m pip install pip --upgrade ${PIP_OPTS}
162171
fi
172+
163173
printf "INFO: Checking for required libraries...\n"
164174
${PYTHON_CMD} -m pip install ${PIP_OPTS} -r ${ASSESS_DIR}/requirements.txt
165175
if [ $? -gt 0 ]; then
@@ -456,9 +466,9 @@ if [ $RUN_SHOWOCI -eq 1 ]; then
456466
fi
457467
SHOWOCI_XLSX="-xlsx_nodate -xlsx ${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}"
458468
SHOWOCI_JSON_FILE="${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}.json"
459-
if [ ${NEW_STYLE} -eq 1 ]; then
460-
SHOWOCI_JSON_FILE="${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}_new.json"
461-
fi
469+
# if [ ${NEW_STYLE} -eq 1 ]; then
470+
# SHOWOCI_JSON_FILE="${OUTPUT_DIR}/showoci_${OUTPUT_DIR_NAME}_new.json"
471+
# fi
462472
SHOWOCI_JSON="-jf ${SHOWOCI_JSON_FILE}"
463473
SHOWOCI_QUIET=""
464474
if [ ${QUIET} -eq 1 ]; then
@@ -493,4 +503,7 @@ if [ ${NO_ZIP} -eq 0 ]; then
493503
fi
494504
mv ${OUTPUT_DIR_NAME}.zip ${PARENT_DIR}
495505
printf "\nINFO: All output can be found in the directory '%s'.\nINFO: Results are packaged as downloadable file '%s' at '%s'.\n" "${OUTPUT_DIR_NAME}" "${OUTPUT_DIR_NAME}.zip" "${PARENT_DIR}"
506+
if [ ! -z "${CLOUD_SHELL_TOOL_SET}" ]; then
507+
printf "\nINFO: To download the ZIP file:\nINFO: 1. Copy the filename %s\nINFO: 2. Click on the settings icon of the Cloud Shell on the right\nINFO: 3. Select 'Download'\nINFO: 4. Paste the file name into the modal window and click on 'Download'\n\n" "${OUTPUT_DIR_NAME}.zip"
508+
fi
496509
fi

0 commit comments

Comments
 (0)