FoXT BoKS support about rhel7-cis HOT 4 CLOSED

I'm not familiar with BoKS but will check it out. As far as making role updates to support using BoKS...maybe? We should see what the user community thinks but I think if done in the right way it could work.

One thought is...do you think its possible to parameterize the SSHD setting? i.e.
rhel7cis_ssh_daemon_config: /etc/ssh/sshd_config

Then for BoKS you could set it to:
rhel7cis_ssh_daemon_config: /opt/boks/etc/ssh/sshd_config

Also could we parameterize the daemon itself and then setup the restart ssh handlers to restart the correct daemon?

from rhel7-cis.

On BoKS, it's sshd_config file is largely left untouched. There are a few tweaks we have to make for sftp on certain hosts, but they aren't security oriented. All administrative work (policies, user admin, etc) is performed within a GUI interface on the BoKS master host. So basically that is the configuration portion.

With any new build RHEL7 hosts, I've always ran the CIS playbook on it first and then enabled BoKS afterwards. The majority of CIS changes do not affect BoKS.

In order to get the playbook to run, after BoKS has been enabled on a host, all I had to do was add this patch.

diff --git a/handlers/main.yml b/handlers/main.yml
index a680633..9cd5802 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -47,7 +47,7 @@
   service:
       name: sshd
       state: restarted
-
+  when: boks_sshd.stat.exists == False
 - name: reload dconf
   become: yes
   command: dconf update
diff --git a/tasks/prelim.yml b/tasks/prelim.yml
index 0c70d52..94e6c4e 100644
--- a/tasks/prelim.yml
+++ b/tasks/prelim.yml
@@ -203,3 +203,9 @@
   register: rhnsd_service_status
   changed_when: no
   check_mode: no
+
+- name: "PRELIM | Check for BoKS"
+  stat:
+    path: /opt/boksm
+  register: boks_sshd
+- debug: msg="{{ boks_sshd.stat.exists }}"
diff --git a/tasks/section5.yml b/tasks/section5.yml
index e9aa3c1..1d233f3 100644
--- a/tasks/section5.yml
+++ b/tasks/section5.yml
@@ -588,6 +588,7 @@
       dest: /etc/pam.d/su
       regexp: '^(#)?auth\s+required\s+pam_wheel\.so'
       line: 'auth           required        pam_wheel.so use_uid'
+  when: boks_sshd.stat.exists == False
   tags:
       - level1
       - level2

The only rule that introduces a conflict that I see so far is:

- name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted"
  lineinfile:
      state: present
      dest: /etc/pam.d/su
      regexp: '^(#)?auth\s+required\s+pam_wheel\.so'
      line: 'auth           required        pam_wheel.so use_uid'
  tags:
      - level1
      - level2
      - patch
      - rule_5.6

So basically there a few things to not to do on BoKS enabled host. This might mean to have register variable hold the BoKS status and act accordingly on these items.

from rhel7-cis.

I have seen BoKS in use in a large bank, I has fine-grained access rules where you can restrict the use of: remote execution, scp, sftp, and interactive shell. Also it manages every point-to-point connection from a security viewpoint.

Since BoKS is not open-source, it is hard to test in CI when we refactor. I suggest you maintain your own fork.

from rhel7-cis.

I agree. Thanks for the feedback.

from rhel7-cis.