Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Align RHEL9 hardening to RHEL8 to pass OpenSCAP check #153

Closed
wants to merge 1 commit into from

Conversation

jLemmings
Copy link
Contributor

Overall Review of Changes:
OpenSCAP checks if the sudo logfile definition exists in /etc/sudoers. If the path is wrapped with quotes the check fails. The RHEL8 CIS task does it without quotes: https://github.com/ansible-lockdown/RHEL8-CIS/blob/devel/tasks/section_5/cis_5.3.x.yml#L35

image

Issue Fixes:
No open issue.

Enhancements:
OpenSCAP will accept the hardening.

How has this been tested?:
N/A

@jLemmings
Copy link
Contributor Author

@uk-bolly Any comment regarding this PR?

@uk-bolly
Copy link
Member

hi @jLemmings

Thank you for taking the time to raise this PR. While openscap may not need quotes, CIS does ask for it to be quoted. We often find that many scanners are very brittle in checks not allowing for differing ways of doing things. While this may fix the openscap scan it may break another scan for someone else. So we choose to adhere to documented control.
Unfortunatley for this reason, we will leave as it current is, or we end up trying to make the code fit all the different scanner out there.
I hope that makes sense.

many thanks once again

uk-bolly

@uk-bolly
Copy link
Member

closing PR as unable to complete, different scanners looking for different restrictive values, unable to accomodate all. Written as close to documented controls

@uk-bolly uk-bolly closed this Feb 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants