Versions Compared

Old Version 4

changes.mady.by.user inoue

Saved on

compared with

New Version 5

changes.mady.by.user inoue

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Test document

...

Execute with reference to the following

Bluval User Guide

Steps To Implement Security Scan Requirements

https://vuls.io/docs/en/tutorial-docker.html

There are 2 security related tests: lynis & vuls. And there are 2 k8s related tests: kube-hunter & conformance tests.

...

The Configuration file are only supported up to Ubuntu 18.

Vuls

We use Ubuntu 20.04, so we ran Vuls test as follows:

  1. Create directory

    $ mkdir ~/vuls
$ cd ~/vuls
$ mkdir go-cve-dictionary-log goval-dictionary-log gost-log


  2. Fetch NVD

    $ docker run --rm -it \
    -v $PWD:/go-cve-dictionary \
    -v $PWD/go-cve-dictionary-log:/var/log/go-cve-dictionary \
    vuls/go-cve-dictionary fetch nvd


  3. Fetch OVAL

    $ docker run --rm -it \
     -v $PWD:/goval-dictionary \
     -v $PWD/goval-dictionary-log:/var/log/goval-dictionary \
     vuls/goval-dictionary fetch ubuntu 18 19 20


  4. Fetch gost

    $ docker run --rm -i \
     -v $PWD:/gost \
     -v $PWD/gost-log:/var/log/gost \
     vuls/gost fetch ubuntu


  5. Create config.toml

    [servers]

[servers.master]
host = "192.168.51.22"
port = "22"
user = "test-user"
keyPath = "/root/.ssh/id_rsa" # path to ssh private key in docker


  6. Start vuls container to run tests

    $ docker run --rm -it \
    -v ~/.ssh:/root/.ssh:ro \
    -v $PWD:/vuls \
    -v $PWD/vuls-log:/var/log/vuls \
    -v /etc/localtime:/etc/localtime:ro \
    -v /etc/timezone:/etc/timezone:ro \
    vuls/vuls scan \
    -config=./config.toml


  7. Get the report

    $ docker run --rm -it \
     -v ~/.ssh:/root/.ssh:ro \
     -v $PWD:/vuls \
     -v $PWD/vuls-log:/var/log/vuls \
     -v /etc/localtime:/etc/localtime:ro \
     vuls/vuls report \
     -format-list \
     -config=./config.toml


Vuls

Nexus URL: 

PDH,IoT Gateway

...

The initial results compare with the Lynis Incubation: PASS/FAIL Criteria, v1.0 as follows.

IoT Gateway

The Lynis Program Update test MUST pass with no errors.

Code Block
2022-11-22 07:46:44 Test: Checking for program update...
2022-11-22 07:46:44 Current installed version  : 308
2022-11-22 07:46:45 Latest stable version      : 308
2022-11-22 07:46:45 No Lynis update available.

...

The following list of tests MUST complete as passing

Result: AllowUsers is not set
Result: AllowGroups is not set
Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine.
Hardening: assigned partial number of hardening points (0 of 1). Currently having 140 points (out of 217)
Security check: file is normal
Checking permissions of /home/ubuntu/lynis/include/tests_snmp
File permissions are OK

Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)
Result: AllowUsers is not set
Result: AllowGroups is not set
Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine.
Hardening: assigned partial number of hardening points (0 of 1). Currently having 108 points (out of 157)
Security check: file is normal
Checking permissions of /home/pi/lynis/lynis/include/tests_snmp
File permissions are OK

Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf
echo 'fs.suid_dumpable=0' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep suidSet recommended value in /etc/sysctl.d/90-lynis-hardening.conf
echo 'kernel.dmesg_restrict=1' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep dmesgSet recommended value in /etc/sysctl.d/90-lynis-hardening.conf
echo 'net.ipv4.conf.default.accept_source_route=0' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep ipv4.conf.default.accept_source_route
No.TestResultFix
1Test: Checking PASS_MAX_DAYS option in /etc/login.defs

Result:

max password age is 180 days		OK2Performing test ID AUTH-9328 (Default umask values)Test: Checking /etc/profile.d directory
Result: found /etc/

password aging limits are not configured
Suggestion: Configure maximum password age in /etc/login.defs [test:AUTH-9286] [details:-] [solution:-]
Hardening: assigned partial number of hardening points (0 of 1). Currently having 11 points (out of 24)

Set PASS_MAX_DAYS 180 in /etc/login.defs
2Performing test ID AUTH-9328 (Default umask values)Result: found /etc/profile.d, with one or more files in itTest: Checking /etc/profile
Result: file /etc/profile exists
Test: Checking umask value in /etc/profile
Result: did not find umask in /etc/profile
Result: found no umask. Please check if this is correct
Test: Checking umask entries in /etc/passwd (pam_umask)
Result: file /etc/passwd exists
Test: Checking umask value in /etc/passwd
Manual: one or more manual actions are required for further testing of this control/plugin
Test: Checking /etc/login.defs		OK
3Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)
Result: AllowUsers is not set
Result: AllowGroups is not set
Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine.
Hardening: assigned partial number of hardening points (0 of 1). Currently having 108 points (out of 157)
Security check: file is normal
Checking permissions of /home/pi/lynis/lynis/include/tests_snmp
File permissions are OK		Configure AllowUsers, AllowGroups in /etc/ssh/sshd_config

！要確認
→やり方を問い合わせ
4Test: checking for file /etc/network/if-up.d/ntpdateResult: file /etc/login.defs exists
Test: Checking umask value in /etc/login.defs
Result: umask is 027, which is finenetwork/if-up.d/ntpdate does not exist
Result: Found a time syncing daemon/client.
Hardening: assigned maximum number of hardening points for this item (23). Currently having 18 117 points (out of 30172)Test: Checking /etc/init.d/functions
Result: file /etc/init.d/functions does not exist
Test: Checking /etc/init.d/rc
Result: file /etc/init.d/rc does not exist
Test: Checking /etc/init.d/rcS
Result: file /etc/init.d/rcS does not exist		OK3Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)Configure AllowUsers, AllowGroups in /etc/ssh/sshd_config
4Test: checking for file /etc/network/if-up.d/ntpdateResult: file /etc/network/if-up.d/ntpdate does not exist
Result: Found a time syncing daemon/client.
Hardening: assigned maximum number of hardening points for this item (3). Currently having 149 points (out of 232)		OK
5Performing test ID KRNL-6000 (Check sysctl key pairs in scan profile) :  Following sub-tests requiredN/AN/A
5asysctl key fs.suid_dumpable contains equal expected and current value (0)Result: sysctl key fs.suid_dumpable has a different value than expected in scan profile. Expected=0, Real=2
Hardening: assigned partial number of hardening points (0 of 1). Currently having 151 points (out of 247)		5bsysctl key kernel.dmesg_restrict contains equal expected and current value (1)Result: sysctl key kernel.dmesg_restrict has a different value than expected in scan profile. Expected=1, Real=05csysctl key net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)Result: sysctl key net.ipv4.conf.default.accept_source_route has a different value than expected in scan profile. Expected=0, Real=1
6Test: Check if one or more compilers can be found on the systemResult: found installed compiler. See top of logfile which compilers have been found or use /bin/grep to filter on 'compiler'
Hardening: assigned partial number of hardening points (1 of 3). Currently having 168 points (out of 280)		Uninstall gcc and remove /usr/bin/as

PC/Server for robot control

The Lynis Program Update test MUST pass with no errors.

Code Block
2022-03-23 05:13:56 Test: Checking for program update...
2022-03-23 05:14:03 Current installed version : 308
2022-03-23 05:14:03 Latest stable version : 307
2022-03-23 05:14:03 No Lynis update available

Fix: Download and run the latest Lynis directly on SUT.

Steps To Implement Security Scan Requirements#InstallandExecute

The following list of tests MUST complete as passing
No.TestResultFix
1Test: Checking PASS_MAX_DAYS option in /etc/login.defs

Result: password aging limits are not configured
Suggestion: Configure maximum password age in /etc/login.defs [test:AUTH-9286] [details:-] [solution:-]
Hardening: assigned partial number of hardening points (0 of 1). Currently having 11 points (out of 24)

Set PASS_MAX_DAYS 180 in /etc/login.defs
2Performing test ID AUTH-9328 (Default umask values)Result: found /etc/profile.d, with one or more files in itOK
3Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)
Result: AllowUsers is not set
Result: AllowGroups is not set
Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine.OK
5Performing test ID KRNL-6000 (Check sysctl key pairs in scan profile) :  Following sub-tests requiredN/AN/A
5asysctl key fs.suid_dumpable contains equal expected and current value (0)Result: sysctl key fs.suid_dumpable contains equal expected and current value (0)OK
5bsysctl key kernel.dmesg_restrict contains equal expected and current value (1)Result: sysctl key kernel.dmesg_restrict contains equal expected and current value (1)OK
5csysctl key net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)Result: sysctl key net.ipv4.conf.all.accept_source_route contains equal expected and current value (0)OK
6Test: Check if one or more compilers can be found on the system

Performing test ID HRDN-7220 (Check if one or more compilers are installed)
Test: Check if one or more compilers can be found on the system
Result: no compilers found
Hardening: assigned maximum number of hardening points for this item (3). Currently having 138 points (out of 219)

OK


PC/Server for robot control

The Lynis Program Update test MUST pass with no errors.

Code Block
2022-03-23 05:13:56 Test: Checking for program update...
2022-03-23 05:14:03 Current installed version : 308
2022-03-23 05:14:03 Latest stable version : 308
2022-03-23 05:14:03 No Lynis update available


Fix: Download and run the latest Lynis directly on SUT.

Steps To Implement Security Scan Requirements#InstallandExecute

The following list of tests MUST complete as passing

No.TestResultFix
1Test: Checking PASS_MAX_DAYS option in /etc/login.defsResult: password aging limits are not configured

Set PASS_MAX_DAYS 180 in /etc/login.defs

2Performing test ID AUTH-9328 (Default umask values)Test: Checking umask value in /etc/login.defs
Result: found umask 022, which could be improved


Set UMASK 027 in /etc/login.defs

3Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)

Result: AllowUsers is not set
Result: AllowGroups is not set
Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine.
Hardening: assigned partial number of hardening points (0 of 1). Currently having 152 points (out of 223)
Security check: file is normal
Checking permissions of /home/ubuntu/lynis/include/tests_snmp
File permissions are OK

Configure AllowUsers, AllowGroups in /etc/ssh/sshd_config

4Test: checking for file /etc/network/if-up.d/ntpdateResult: file /etc/network/if-up.d/ntpdate does not exist
Result: Found a time syncing daemon/client.
Hardening: assigned maximum number of hardening points for this item (3). Currently having 161 points (out of 238)		OK
5Performing test ID KRNL-6000 (Check sysctl key pairs in scan profile) :  Following sub-tests requiredN/AN/A
5asysctl key fs.suid_dumpable contains equal expected and current value (0)sysctl key fs.suid_dumpable has a different value than expected in scan profile. Expected=0, Real=2
Hardening: assigned partial number of hardening points (0 of 1). Currently having 108 163 points (out of 157253)Security check: file is normal
Checking permissions of /home/pi/lynis/lynis/include/tests_snmp
File permissions are OKConfigure AllowUsers, AllowGroups in /etc/ssh/sshd_config
！要確認
→やり方を問い合わせ
4Test: checking for file /etc/network/if-up.d/ntpdateResult: file /etc/network/if-up.d/ntpdate does not exist
Result: Found a time syncing daemon/client.
Hardening: assigned maximum number of hardening points for this item (3). Currently having 117 points (out of 172)		OK
5Performing test ID KRNL-6000 (Check sysctl key pairs in scan profile) :  Following sub-tests requiredN/AN/A
5asysctl key fs.suid_dumpable

Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf

echo 'fs.suid_dumpable=0' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep suid

5bsysctl key kernel.dmesg_restrict contains equal expected and current value (1)Result: sysctl key kernel.dmesg_restrict has a different value than expected in scan profile. Expected=1, Real=0

Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf

echo 'kernel.dmesg_restrict=1' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep dmesg

5csysctl key net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)Result: sysctl key fs.suid_dumpable contains equal expected and current value (0)OK
5bsysctl key kernel.dmesg_restrict contains equal expected and current value (1)Result: sysctl key kernel.dmesg_restrict contains equal expected and current value (1)OK
5csysctl key net.ipv4.conf.default.accept_source_route has a different value than expected in scan profile. Expected=0, Real=1Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf

echo 'net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)Result: sysctl key net.ipv4.conf.all=0' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep ipv4.conf.default.accept_source_route contains equal expected and current value (0)OK
6Test: Check if one or more compilers can be found on the system

Performing test ID HRDN-7220 (Check if one or more compilers are installed)
Test: Check if one or more compilers can be found on the system
Result: no compilers found
Hardening: assigned maximum number of hardening points for this item (3). Currently having 138 points (out of 219)

OKsystemResult: found installed compiler. See top of logfile which compilers have been found or use /bin/grep to filter on 'compiler'
Hardening: assigned partial number of hardening points (1 of 3). Currently having 180 points (out of 286

Found known binary: as (compiler) - /usr/bin/as
Found known binary: cc (compiler) - /usr/bin/cc
Found known binary: g++ (compiler) - /usr/bin/g++
Found known binary: gcc (compiler) - /usr/bin/gcc

Uninstall gcc and remove /usr/bin/as, /usr/bin/cc