Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🧹 Fixes double mql issues: Mondoo Linux Policy #414

Closed
wants to merge 47 commits into from
Closed

🧹 Fixes double mql issues: Mondoo Linux Policy #414

wants to merge 47 commits into from

Conversation

mm-weber
Copy link
Contributor

This is a workaround that fixes the Mondoo Linux Policy by re-writing the mql of all checks.

@mm-weber
linux/mql-syntax-changes: Ensure that strong Key Exchange algorithms …
62f84a4 
…are used

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure that strong Key Exchange algorithms …
a7da9a3 
…are used++

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure that strong Key Exchange algorithms …
d8410ed 
…are used++++

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure core dumps are restricted+
d26f955 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: kernel.parameters["kernel.randomize_va_spac…
68493a7 
…e"].downcase == 2

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: package("prelink").installed != true
11be3b6 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure IMAP and POP3 server is stopped and …
b04b3d5 
…not enabled+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure mail transfer agent is configured fo…
3424818 
…r local-only mode+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure NIS server is stopped and not enabled+
e421bf8 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure rsh server is stopped and not enabled+
ce37494 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure telnet server is stopped and not ena…
ca110cb 
…bled+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure tftp server is stopped and not enabled
25fcefa 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure rsync service is stopped and not ena…
2cd348e 
…bled

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure talk server is stopped and not enabled+
12282f3 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure IP forwarding is disabled++
70cc5d3 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure packet redirect sending is disabled
67c9075 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure source routed packets are not accepted+
706226e 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure ICMP redirects are not accepted
42c4d17 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure secure ICMP redirects are not accepted
307e9c4 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure suspicious packets are logged+
9c34dbe 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure broadcast ICMP requests are ignored+
de7229e 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure bogus ICMP responses are ignored
157b817 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure Reverse Path Filtering is enabled+
04213f7 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure TCP SYN Cookies is enabled
cf704b6 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure IPv6 router advertisements are not a…
0d8885b 
…ccepted+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure auditd is installed
1de3805 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure auditd is installed+
b08841f 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure auditing for processes that start pr…
539fcb2 
…ior to auditd is enabled+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure audit log storage size is configured
0eb418c 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure audit logs are not automatically del…
cb35686 
…eted+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure audit logs are not automatically del…
22f4463 
…eted++

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: auditFilesMondoo
30990e8 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure only strong MAC algorithms are used
f4608e4 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure access to the su command is restricted
be05c0e 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure rsyslog Service is enabled
880942f 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure journald is configured to send logs …
54c6c27 
…to rsyslog+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure journald is configured to write logf…
7b281e8 
…iles to persistent disk+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure journald is configured to compress l…
59ead8a 
…arge log files+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure secure permissions on SSH public hos…
21fc6d2 
…t key files are set+

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure only strong ciphers are used+
76e1b02 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure only strong MAC algorithms are used+
a6ae932 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure no duplicate UIDs exist
288fbd2 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure no duplicate user names exist+
a9b58e4 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure no duplicate group names exist++
159bddc 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure default group for the root account i…
f862aa9 
…s GID 0

Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure UID_MIN is set to 1000
38de710 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber
linux/mql-syntax-changes: Ensure system accounts are non-login
f8ed0f1 
Signed-off-by: Manuel Weber <[email protected]>
@mm-weber mm-weber requested a review from chris-rock June 27, 2024 20:59
@mm-weber mm-weber self-assigned this Jun 27, 2024
@mm-weber
Copy link
Contributor Author

superseded by: #415

@mm-weber mm-weber closed this Jun 28, 2024
@github-actions github-actions bot locked and limited conversation to collaborators Jun 28, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@chris-rock chris-rock Awaiting requested review from chris-rock

Assignees

@mm-weber mm-weber

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@mm-weber