Skip to content

Commit 3d10ad5

Browse files
dodysdodys
authored
Merge pull request #13403 from alanmcanonical/UBTU-24-400370
[Ubuntu]: Implement rule UBTU-24-400370
2 parents d420a3d + c3c353c commit 3d10ad5

File tree

9 files changed

+106
-2
lines changed

9 files changed

+106
-2
lines changed

‎components/sssd.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ rules:
1818
- sssd_enable_certmap
1919
- sssd_enable_pam_services
2020
- sssd_enable_smartcards
21+
- sssd_enable_user_cert
2122
- sssd_has_trust_anchor
2223
- sssd_ldap_configure_tls_ca
2324
- sssd_ldap_configure_tls_ca_dir

‎controls/stig_ubuntu2404.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -855,8 +855,9 @@ controls:
855855
account for PKI-based authentication.
856856
levels:
857857
- high
858-
related_rules: []
859-
status: planned
858+
rules:
859+
- sssd_enable_user_cert
860+
status: automated
860861

861862
- id: UBTU-24-400375
862863
title: Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management

‎linux_os/guide/services/sssd/sssd_enable_user_cert/oval/shared.xml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<def-group>
2+
<definition class="compliance" id="{{{ rule_id }}}" version="1">
3+
{{{ oval_metadata("SSSD should be configured to map the certificate to
4+
correct user or group") }}}
5+
<criteria>
6+
<criterion comment="check value of ldap_user_certificate in sssd configuration"
7+
test_ref="test_{{{rule_id}}}" />
8+
</criteria>
9+
</definition>
10+
11+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="test the value of
12+
ldap_user_certificate in sssd configuration" id="test_{{{rule_id}}}" version="1">
13+
<ind:object object_ref="obj_{{{rule_id}}}" />
14+
<ind:state state_ref="state_{{{rule_id}}}" />
15+
</ind:textfilecontent54_test>
16+
17+
<ind:textfilecontent54_object id="obj_{{{rule_id}}}" version="1">
18+
<ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
19+
<ind:pattern operation="pattern match">^[\s]*\[[^\n\[\]]+\](?:[^\n\[]*\n+)+?[\s]*ldap_user_certificate\s*=\s*([\w;]+)$</ind:pattern>
20+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
21+
</ind:textfilecontent54_object>
22+
23+
<ind:textfilecontent54_state comment="value of ldap_user_certificate" id="state_{{{rule_id}}}" version="1">
24+
<ind:subexpression operation="equals">userCertificate;binary</ind:subexpression>
25+
</ind:textfilecontent54_state>
26+
</def-group>

‎linux_os/guide/services/sssd/sssd_enable_user_cert/rule.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
documentation_complete: true
2+
3+
4+
title: 'Enable Certificates Mapping in SSSD'
5+
6+
description: |-
7+
SSSD needs to be set up to link the authenticated identity to the user or group account
8+
for PKI-based authentication. To implement this, confirm that the /etc/sssd/sssd.conf
9+
file contains the following line
10+
<pre>
11+
ldap_user_certificate=userCertificate;binary
12+
</pre>
13+
14+
rationale: |-
15+
Without mapping the certificate used to authenticate to the user account, the ability to
16+
determine the identity of the individual user or group will not be available for forensic
17+
analysis.
18+
19+
severity: medium
20+
21+
platform: package[sssd]

‎linux_os/guide/services/sssd/sssd_enable_user_cert/tests/commented.fail.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# remediation = none
3+
# packages = sssd
4+
5+
CONF="/etc/sssd/sssd.conf"
6+
echo -e "[domain/LDAP]\n#ldap_user_certificate = userCertificate;binary" > "$CONF"

‎linux_os/guide/services/sssd/sssd_enable_user_cert/tests/correct_value.pass.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# remediation = none
3+
# packages = sssd
4+
5+
CONF="/etc/sssd/sssd.conf"
6+
echo -e "[domain/LDAP]\nldap_user_certificate = userCertificate;binary" > "$CONF"

‎linux_os/guide/services/sssd/sssd_enable_user_cert/tests/multiple_in_section_and_correct_value.pass.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
# remediation = none
3+
# packages = sssd
4+
5+
CONF="/etc/sssd/sssd.conf"
6+
cat << EOF > "$CONF"
7+
[sssd]
8+
domains = example.com,example2,example3
9+
services = nss, pam
10+
ldap_user_certificate = userCertificate.;binary
11+
certificate_verification = ocsp_dgst=sha1
12+
13+
[domain/example.com]
14+
id_provider = ldap
15+
ldap_uri = ldap://ldap.example.com
16+
ldap_search_base = dc=example,dc=com
17+
ldap_user_certificate = userCertificate;binary
18+
certificate_verification = ocsp_dgst=sha1
19+
20+
[domain/example2]
21+
id_provider = ldap
22+
ldap_uri = ldap://ldap.example2.com
23+
ldap_search_base = dc=example2,dc=com
24+
certificate_verification = ocsp_dgst=sha256
25+
26+
[domain/example3]
27+
id_provider = ldap
28+
ldap_uri = ldap://ldap.example3.com
29+
ldap_search_base = dc=example3,dc=com
30+
ldap_user_certificate = userCertificate;binary
31+
EOF

‎linux_os/guide/services/sssd/sssd_enable_user_cert/tests/nonexistent_file.fail.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# remediation = none
3+
# packages = sssd
4+
5+
CONF="/etc/sssd/sssd.conf"
6+
rm -f "$CONF"

‎linux_os/guide/services/sssd/sssd_enable_user_cert/tests/wrong_value.fail.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# remediation = none
3+
# packages = sssd
4+
5+
CONF="/etc/sssd/sssd.conf"
6+
echo -e "[domain/LDAP]\nldap_user_certificate = default" > "$CONF"

0 commit comments

Comments
 (0)