Skip to content

Commit 5e6f1e7

Browse files
authored
Fixing for ASB v2 default PAM modules location and logrotate.timer expectation for Ubuntu 16.04 and Ubuntu 18.04 (#754)
1 parent 29716f9 commit 5e6f1e7

5 files changed

Lines changed: 70 additions & 45 deletions

File tree

src/adapters/mc/asb/LinuxSecurityBaseline_DeployIfNotExists.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"version": "1.0.0",
1616
"contentType": "Custom",
1717
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSecurityBaseline.zip",
18-
"contentHash": "D0A9C2B0CD5851D0BB8C130A8F7DB554D2696E3322595E0D374F033DFA291C0F",
18+
"contentHash": "709F738A808DB79EF7253B1D3C2900F9753E373258F254CB8063A5C03772ACB4",
1919
"configurationParameter": {
2020
"accessPermissionsForSshdConfig": "Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue",
2121
"ignoreHosts": "Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue",
@@ -625,7 +625,7 @@
625625
"version": "1.0.0",
626626
"contentType": "Custom",
627627
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSecurityBaseline.zip",
628-
"contentHash": "D0A9C2B0CD5851D0BB8C130A8F7DB554D2696E3322595E0D374F033DFA291C0F",
628+
"contentHash": "709F738A808DB79EF7253B1D3C2900F9753E373258F254CB8063A5C03772ACB4",
629629
"assignmentType": "ApplyAndAutoCorrect",
630630
"configurationParameter": [
631631
{
@@ -716,7 +716,7 @@
716716
"version": "1.0.0",
717717
"contentType": "Custom",
718718
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSecurityBaseline.zip",
719-
"contentHash": "D0A9C2B0CD5851D0BB8C130A8F7DB554D2696E3322595E0D374F033DFA291C0F",
719+
"contentHash": "709F738A808DB79EF7253B1D3C2900F9753E373258F254CB8063A5C03772ACB4",
720720
"assignmentType": "ApplyAndAutoCorrect",
721721
"configurationParameter": [
722722
{
@@ -807,7 +807,7 @@
807807
"version": "1.0.0",
808808
"contentType": "Custom",
809809
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSecurityBaseline.zip",
810-
"contentHash": "D0A9C2B0CD5851D0BB8C130A8F7DB554D2696E3322595E0D374F033DFA291C0F",
810+
"contentHash": "709F738A808DB79EF7253B1D3C2900F9753E373258F254CB8063A5C03772ACB4",
811811
"assignmentType": "ApplyAndAutoCorrect",
812812
"configurationParameter": [
813813
{

src/adapters/mc/ssh/LinuxSshServerSecurityBaseline_DeployIfNotExists.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"version": "1.0.0",
1616
"contentType": "Custom",
1717
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSshServerSecurityBaseline.zip",
18-
"contentHash": "97DAEAE6E915A690FCF4D1BD533765F61C72DF4F840B57AA2742636B42F29C55",
18+
"contentHash": "BF3A9E6087B90ED493EF9BF54FC4D7C28FF97832FECB77906E1AA9AF45F182B7",
1919
"configurationParameter": {
2020
"accessPermissionsForSshdConfig": "Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue",
2121
"ignoreHosts": "Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue",
@@ -624,7 +624,7 @@
624624
"version": "1.0.0",
625625
"contentType": "Custom",
626626
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSshServerSecurityBaseline.zip",
627-
"contentHash": "97DAEAE6E915A690FCF4D1BD533765F61C72DF4F840B57AA2742636B42F29C55",
627+
"contentHash": "BF3A9E6087B90ED493EF9BF54FC4D7C28FF97832FECB77906E1AA9AF45F182B7",
628628
"assignmentType": "ApplyAndAutoCorrect",
629629
"configurationParameter": [
630630
{
@@ -715,7 +715,7 @@
715715
"version": "1.0.0",
716716
"contentType": "Custom",
717717
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSshServerSecurityBaseline.zip",
718-
"contentHash": "97DAEAE6E915A690FCF4D1BD533765F61C72DF4F840B57AA2742636B42F29C55",
718+
"contentHash": "BF3A9E6087B90ED493EF9BF54FC4D7C28FF97832FECB77906E1AA9AF45F182B7",
719719
"assignmentType": "ApplyAndAutoCorrect",
720720
"configurationParameter": [
721721
{
@@ -806,7 +806,7 @@
806806
"version": "1.0.0",
807807
"contentType": "Custom",
808808
"contentUri": "https://github.com/Azure/azure-osconfig/releases/download/test_policy_package/LinuxSshServerSecurityBaseline.zip",
809-
"contentHash": "97DAEAE6E915A690FCF4D1BD533765F61C72DF4F840B57AA2742636B42F29C55",
809+
"contentHash": "BF3A9E6087B90ED493EF9BF54FC4D7C28FF97832FECB77906E1AA9AF45F182B7",
810810
"assignmentType": "ApplyAndAutoCorrect",
811811
"configurationParameter": [
812812
{

src/common/asb/Asb.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1616,13 +1616,20 @@ static char* AuditEnsureLockoutForFailedPasswordAttempts(void* log)
16161616
{
16171617
const char* pamFailLockSo = "pam_faillock.so";
16181618
const char* pamTally2So = "pam_tally2.so";
1619+
const char* pamTallySo = "pam_tally.so";
16191620
char* reason = NULL;
16201621
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdSystemAuth, pamFailLockSo, '#', &reason, log));
16211622
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdPasswordAuth, pamFailLockSo, '#', &reason, log));
16221623
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdLogin, pamFailLockSo, '#', &reason, log));
16231624
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdSystemAuth, pamTally2So, '#', &reason, log));
16241625
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdPasswordAuth, pamTally2So, '#', &reason, log));
1625-
CheckLockoutForFailedPasswordAttempts(g_etcPamdLogin, pamTally2So, '#', &reason, log);
1626+
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdLogin, pamTally2So, '#', &reason, log));
1627+
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdSystemAuth, pamTallySo, '#', &reason, log));
1628+
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdPasswordAuth, pamTallySo, '#', &reason, log));
1629+
RETURN_REASON_IF_ZERO(CheckLockoutForFailedPasswordAttempts(g_etcPamdLogin, pamTallySo, '#', &reason, log));
1630+
FREE_MEMORY(reason);
1631+
reason = DuplicateString("Neither pam_faillock.so, pam_tally2.so or pam_tally.so PAM modules exist for this distribution. "
1632+
"Manually set lockout for failed password attempts following specific instructions for this distrubution. Automatic remediation is not possible");
16261633
return reason;
16271634
}
16281635

@@ -1787,7 +1794,7 @@ static char* AuditEnsureSyslogRotaterServiceIsEnabled(void* log)
17871794
char* reason = NULL;
17881795
RETURN_REASON_IF_NOT_ZERO(CheckPackageInstalled(g_logrotate, &reason, log));
17891796
RETURN_REASON_IF_NOT_ZERO(CheckFileAccess(g_etcCronDailyLogRotate, 0, 0, 755, &reason, log));
1790-
if (false == IsRedHatBased(log))
1797+
if ((false == IsRedHatBased(log)) && (false == IsCurrentOs(PRETTY_NAME_UBUNTU_16_04, log)) && (false == IsCurrentOs(PRETTY_NAME_UBUNTU_18_04, log)))
17911798
{
17921799
CheckDaemonActive(g_logrotateTimer, &reason, log);
17931800
}
@@ -3386,7 +3393,7 @@ static int RemediateEnsureSyslogRotaterServiceIsEnabled(char* value, void* log)
33863393
if ((0 == InstallPackage(g_logrotate, log)) && (0 == SetFileAccess(g_etcCronDailyLogRotate, 0, 0, 755, log)))
33873394
{
33883395
status = 0;
3389-
if (false == IsRedHatBased(log))
3396+
if ((false == IsRedHatBased(log)) && (false == IsCurrentOs(PRETTY_NAME_UBUNTU_16_04, log)) && (false == IsCurrentOs(PRETTY_NAME_UBUNTU_18_04, log)))
33903397
{
33913398
status = EnableAndStartDaemon(g_logrotateTimer, log) ? 0 : ENOENT;
33923399
}

src/common/asb/Asb.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
#define PRETTY_NAME_RHEL_9 "Red Hat Enterprise Linux 9"
2121
#define PRETTY_NAME_ROCKY_LINUX_9 "Rocky Linux 9"
2222
#define PRETTY_NAME_SLES_15 "SUSE Linux Enterprise Server 15"
23+
#define PRETTY_NAME_UBUNTU_16_04 "Ubuntu 16.04"
24+
#define PRETTY_NAME_UBUNTU_18_04 "Ubuntu 18.04"
2325
#define PRETTY_NAME_UBUNTU_20_04 "Ubuntu 20.04"
2426
#define PRETTY_NAME_UBUNTU_22_04 "Ubuntu 22.04"
2527

src/common/commonutils/PassUtils.c

Lines changed: 50 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -6,36 +6,17 @@
66
static const char* g_etcPamdCommonPassword = "/etc/pam.d/common-password";
77
static const char* g_etcSecurityPwQualityConf = "/etc/security/pwquality.conf";
88
static const char* g_etcPamdSystemAuth = "/etc/pam.d/system-auth";
9+
static const char* g_pamUnixSo = "pam_unix.so";
910
static const char* g_remember = "remember";
1011

11-
int CheckEnsurePasswordReuseIsLimited(int remember, char** reason, void* log)
12-
{
13-
int status = ENOENT;
14-
15-
if (0 == CheckFileExists(g_etcPamdCommonPassword, NULL, log))
16-
{
17-
// On Debian-based systems '/etc/pam.d/common-password' is expected to exist
18-
status = ((0 == CheckLineFoundNotCommentedOut(g_etcPamdCommonPassword, '#', g_remember, NULL, log)) &&
19-
(0 == CheckIntegerOptionFromFileLessOrEqualWith(g_etcPamdCommonPassword, g_remember, '=', remember, reason, log))) ? 0 : ENOENT;
20-
}
21-
else if (0 == CheckFileExists(g_etcPamdSystemAuth, NULL, log))
22-
{
23-
// On Red Hat-based systems '/etc/pam.d/system-auth' is expected to exist
24-
status = ((0 == CheckLineFoundNotCommentedOut(g_etcPamdSystemAuth, '#', g_remember, NULL, log)) &&
25-
(0 == CheckIntegerOptionFromFileLessOrEqualWith(g_etcPamdSystemAuth, g_remember, '=', remember, reason, log))) ? 0 : ENOENT;
26-
}
27-
else
28-
{
29-
OsConfigCaptureReason(reason, "Neither '%s' or '%s' found, unable to check for '%s' option being set",
30-
g_etcPamdCommonPassword, g_etcPamdSystemAuth, g_remember);
31-
}
32-
33-
return status;
34-
}
35-
3612
static char* FindPamModule(const char* pamModule, void* log)
3713
{
38-
const char* paths[] = {"/usr/lib/x86_64-linux-gnu/security/%s", "/lib/security/%s", "/usr/lib/security/%s", "/lib64/security/%s"};
14+
const char* paths[] = {
15+
"/usr/lib/x86_64-linux-gnu/security/%s",
16+
"/usr/lib/security/%s",
17+
"/lib/security/%s",
18+
"/lib64/security/%s",
19+
"/lib/x86_64-linux-gnu/security/%s" };
3920
int numPaths = ARRAY_SIZE(paths);
4021
char* result = NULL;
4122
int status = 0, i = 0;
@@ -78,6 +59,36 @@ static char* FindPamModule(const char* pamModule, void* log)
7859
return result;
7960
}
8061

62+
int CheckEnsurePasswordReuseIsLimited(int remember, char** reason, void* log)
63+
{
64+
int status = ENOENT;
65+
66+
if (0 == CheckFileExists(g_etcPamdCommonPassword, NULL, log))
67+
{
68+
// On Debian-based systems '/etc/pam.d/common-password' is expected to exist
69+
status = ((0 == CheckLineFoundNotCommentedOut(g_etcPamdCommonPassword, '#', g_remember, NULL, log)) &&
70+
(0 == CheckIntegerOptionFromFileLessOrEqualWith(g_etcPamdCommonPassword, g_remember, '=', remember, reason, log))) ? 0 : ENOENT;
71+
}
72+
else if (0 == CheckFileExists(g_etcPamdSystemAuth, NULL, log))
73+
{
74+
// On Red Hat-based systems '/etc/pam.d/system-auth' is expected to exist
75+
status = ((0 == CheckLineFoundNotCommentedOut(g_etcPamdSystemAuth, '#', g_remember, NULL, log)) &&
76+
(0 == CheckIntegerOptionFromFileLessOrEqualWith(g_etcPamdSystemAuth, g_remember, '=', remember, reason, log))) ? 0 : ENOENT;
77+
}
78+
else
79+
{
80+
OsConfigCaptureReason(reason, "Neither '%s' or '%s' found, unable to check for '%s' option being set",
81+
g_etcPamdCommonPassword, g_etcPamdSystemAuth, g_remember);
82+
}
83+
84+
if (status && (false == FindPamModule(g_pamUnixSo, log)))
85+
{
86+
OsConfigCaptureReason(reason, "The PAM module '%s' is not available. Automatic remediation is not possible", g_pamUnixSo);
87+
}
88+
89+
return status;
90+
}
91+
8192
static void EnsurePamModulePackagesAreInstalled(void* log)
8293
{
8394
const char* pamPackages[] = {"pam", "libpam-modules", "pam_pwquality", "libpam-pwquality", "libpam-cracklib"};
@@ -112,15 +123,15 @@ int SetEnsurePasswordReuseIsLimited(int remember, void* log)
112123
// While 'required' says that if this module fails, authentication fails.
113124

114125
const char* endsHereIfFailsTemplate = "password required %s sha512 shadow %s=%d retry=3\n";
115-
const char* pamUnixSo = "pam_unix.so";
116126
char* pamModulePath = NULL;
117127
char* newline = NULL;
118128
int status = 0, _status = 0;
119129

120130
EnsurePamModulePackagesAreInstalled(log);
121131

122-
if (NULL == (pamModulePath = FindPamModule(pamUnixSo, log)))
132+
if (NULL == (pamModulePath = FindPamModule(g_pamUnixSo, log)))
123133
{
134+
OsConfigLogError(log, "SetEnsurePasswordReuseIsLimited: cannot proceed without %s being present", g_pamUnixSo);
124135
return ENOENT;
125136
}
126137

@@ -198,8 +209,9 @@ int CheckLockoutForFailedPasswordAttempts(const char* fileName, const char* pamS
198209
{
199210
// Example of valid lines:
200211
//
201-
// 'auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900' in /etc/pam.d/login
202-
// 'auth required pam_faillock.so preauth silent audit deny=3 unlock_time=900' in /etc/pam.d/system-auth
212+
// 'auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900'
213+
// 'auth required pam_faillock.so preauth silent audit deny=3 unlock_time=900'
214+
// 'auth required pam_tally.so onerr=fail deny=3 unlock_time=900'
203215

204216
if ((commentCharacter == line[0]) || (EOL == line[0]))
205217
{
@@ -427,7 +439,7 @@ static int CheckRequirementsForCommonPassword(int retry, int minlen, int dcredit
427439
continue;
428440
}
429441
else if ((NULL != strstr(line, password)) && (NULL != strstr(line, requisite)) &&
430-
((NULL != strstr(line, pamPwQualitySo)) || (NULL != strstr(line, pamCrackLibSo))))
442+
((NULL != strstr(line, pamPwQualitySo)) || (NULL != strstr(line, pamCrackLibSo)) || (NULL != strstr(line, g_pamUnixSo))))
431443
{
432444
found = true;
433445

@@ -745,8 +757,10 @@ int SetPasswordCreationRequirements(int retry, int minlen, int minclass, int dcr
745757
int numEntries = ARRAY_SIZE(entries);
746758
bool pamPwQualitySoExists = false;
747759
bool pamCrackLibSoExists = false;
760+
bool pamUnixSoExists = false;
748761
char* pamModulePath = NULL;
749762
char* pamModulePath2 = NULL;
763+
char* pamModulePath3 = NULL;
750764
int i = 0, status = 0, _status = 0;
751765
char* line = NULL;
752766

@@ -756,13 +770,15 @@ int SetPasswordCreationRequirements(int retry, int minlen, int minclass, int dcr
756770

757771
pamPwQualitySoExists = (NULL != (pamModulePath = FindPamModule(pamPwQualitySo, log))) ? true : false;
758772
pamCrackLibSoExists = (NULL != (pamModulePath2 = FindPamModule(pamCrackLibSo, log))) ? true : false;
773+
pamUnixSoExists = (NULL != (pamModulePath3 = FindPamModule(g_pamUnixSo, log))) ? true : false;
759774

760-
if (pamPwQualitySoExists || pamCrackLibSoExists)
775+
if (pamPwQualitySoExists || pamCrackLibSoExists || pamUnixSoExists)
761776
{
762-
if (NULL != (line = FormatAllocateString(etcPamdCommonPasswordLineTemplate, pamPwQualitySoExists ? pamModulePath : pamModulePath2,
777+
if (NULL != (line = FormatAllocateString(etcPamdCommonPasswordLineTemplate,
778+
pamPwQualitySoExists ? pamModulePath : (pamCrackLibSoExists ? pamModulePath2 : pamModulePath3),
763779
retry, minlen, lcredit, ucredit, ocredit, dcredit)))
764780
{
765-
status = ReplaceMarkedLinesInFile(g_etcPamdCommonPassword, pamPwQualitySoExists ? pamPwQualitySo : pamCrackLibSo, line, '#', true, log);
781+
status = ReplaceMarkedLinesInFile(g_etcPamdCommonPassword, pamPwQualitySoExists ? pamPwQualitySo : (pamCrackLibSoExists ? pamCrackLibSo : g_pamUnixSo), line, '#', true, log);
766782
FREE_MEMORY(line);
767783
}
768784
else

0 commit comments

Comments
 (0)