nickanderson/cfengine-cve-2016-2118An example detection and remediation policy.
#+Title: CVE-2016-2118 Inventory and Remediation #+SETUPFILE: ~/src/org-html-themes/setup/theme-readtheorg.setup
[[file:./media/badlock.png]]
This policy detects hosts vulnerable to [[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2118][CVE-2016-2118]] (commonly known as [[http://badlock.org][Badlock]]) by checking if a known vulnerable package version is currently installed. The remediation policy keeps =samba= at the =latest= version available.
Note: This policy currently covers centos 5 and 6. Please consider contributing support for more platforms.
This policy installs using a traditionally (but horribly written) [[file:Makefile][Makefile]] To
install simply clone this repository, and then run make install
MASTERFILES=</path/to/policy_root>.
For example: #+BEGIN_SRC sh :results raw :wrap EXAMPLE make install MASTERFILES=/tmp/example-a10042 #+END_SRC
#+RESULTS: #+BEGIN_EXAMPLE mkdir -p /tmp/example-a10042/services/cfengine-CVE-2016-2118/cfengine-CVE-2016-2118 rsync -avz --exclude /home/nickanderson/vagrant/tmp/eia/CVE/masterfiles/services/cfengine-CVE-2016-2118/* /tmp/example-a10042/services/cfengine-CVE-2016-2118/ sending incremental file list Makefile README.org main.cf data/ data/centos_5.json data/centos_6.json media/ media/badlock.png
sent 19,776 bytes received 165 bytes 39,882.00 bytes/sec total size is 29,079 speedup is 1.46 find /tmp/example-a10042/services/cfengine-CVE-2016-2118/ -type f | xargs chmod 600 find /tmp/example-a10042/services/cfengine-CVE-2016-2118/ -type d | xargs chmod 700 #+END_EXAMPLE
After installing the policy into your policy set you need to add it to inputs so that it will be parsed.
If your running CFEngine =3.7.3=, =3.8.1= or greater. You can use the [[https://docs.cfengine.com/docs/master/reference-language-concepts-augments.html][augments file]] to add it to inputs.
For example: #+BEGIN_SRC json { "inputs": [ "services/cfengine-CVE-2016-2118/main.cf" ] } #+END_SRC
** =inventory_CVE_2016_2118= This bundle checks to see if the installed version of samba matches a known vulnerable version as defined in =data/$(sys.flavor).json= for example: =data/centos_6.json=. There are of course other methods like a package manager itself that could be used to look for vulnerable versions.
This is an autorun bundle, so if your running the [[https://github.com/cfengine/masterfiles/][Masterfiles Policy Framework]], (the default policy CFEngine ships with) you can simply define the =services_autorun= class.
#+BEGIN_SRC json { "inputs": [ "services/cfengine-CVE-2016-2118/main.cf" ], "classes": { "services_autorun": [ "any" ] } } #+END_SRC
NOTE: When the policy runs and detects a vulnerable host it emits a report and defines the class =CVE_2016_2118=.
For example:
#+BEGIN_EXAMPLE R: Detected Vulnerability: CVE-2016-2118 #+END_EXAMPLE
CFEngine Enterprise users will see the Inventory Reporting interface in Mission Portal augmented with a new =Vulnerable CVE(s)= attribute.
For example:
[[file:./media/vulnerable_cves_inventory_attribute.png]]
[[file:./media/inventory_report_vulnerable_cves.png]]
[[file:./media/inventory_report_vulnerable_cves_chart.png]]
[[file:./media/define_alert.png]]
[[file:./media/alert_status_vulnerable_hosts.png]]
** =remediate_CVE_2016_2118= =remediate_CVE_2016_2118= is also an autorun bundle, but only when the the =remediate_CVE_2016_2118= class is defined.
There are numerous ways you can flexibly express which hosts and during what time periods automatic remediation is allowed.
If your running =3.7.3=, =3.8.1= or greater you can enable it for your entire infrastructure by adding it to the [[https://docs.cfengine.com/docs/master/reference-language-concepts-augments.html][augments file]].
#+BEGIN_SRC json { "inputs": [ "services/cfengine-CVE-2016-2118/main.cf" ], "classes": { "services_autorun": [ "any" ], "remediate_CVE_2016_2118": [ "any" ] } } #+END_SRC
The policy looks for the list of packages that are known to be vulnerable in a json data file named for the systems flavor as identified by =$(sys.flavor)=, for example [[file:data/centos_6.json][=centos_6=]].
