12. Put it in Practice!

Getting Started on the RHEL8 Baseline

Let's practice writing a few 'real' controls using a security guidance document.

The Steps to write an InSpec Control

1. Read the Control - Go to the control (you made from the stub generator) and read the check text to understand the goal of the control
2. Look for Key Words and Resources - Look for key words that would indicate what resource to use. If you can't find it, look at the resources page and compare back to the control.
3. Read the documentation - Look at the documentation for the resource you need and understand the syntax and checkout some examples.
4. Write the test
5. Run the test
6. Troubleshoot errors If you have syntax errors or unexpected results, it's time to troubleshoot. The best first step in troubleshooting is to read the error message from the command line.

Example Control Using login_defs Resource:

Let's go through an example using control SV-230324 to see the above steps in practice.

1. Read the control - when referencing the control SV-230324 from the stub profile that was generated with the stub generator, look at the control, especially the check text, to understand the intention of the security guidance for this control.
   This control is talking about verifying all local interactive users are assigned a home directory upon creation.

Stub Generated Control

control "SV-230324" do
  title "All RHEL 8 local interactive user accounts must be assigned a home directory upon creation."
  desc "If local interactive users are not assigned a valid home directory, there is no place for the 
storage and control of files they should own."
  desc "check", "Verify all local interactive users on RHEL 8 are assigned a home directory upon creation with 
the following command:

$ sudo grep -i create_home /etc/login.defs

CREATE_HOME yes

If 
the value for \"CREATE_HOME\" parameter is not set to \"yes\", the line is missing, or the line is 
commented out, this is a finding."
  desc "fix", "Configure RHEL 8 to assign home directories to all new local interactive users by setting the 
\"CREATE_HOME\" parameter in \"/etc/login.defs\" to \"yes\" as follows.

CREATE_HOME yes"
  impact 0.5
  tag severity: "medium"
  tag gtitle: "SRG-OS-000480-GPOS-00227"
  tag gid: "V-230324"
  tag rid: "SV-230324r627750_rule"
  tag stig_id: "RHEL-08-010760"
  tag fix_id: "F-32968r567719_fix"
  tag cci: ["CCI-000366"]
  tag nist: ["CM-6 b"]
end

2. Look for Key Words and Resources - Dive more into what key words exist in the check text to determine what InSpec resources to use when writing the test. Most importantly, identify commands that are written in the check test like shown below. Find the what of the command. For this control, sudo is not the what. grep is also not the what. create_home looks like an attribute of the /etc/login.defs file, which looks like the what! Look for a resource named login_defs in the resource documentation.

  desc "check", "Verify all local interactive users on RHEL 8 are assigned a home directory upon creation with 
the following command:

$ sudo grep -i create_home /etc/login.defs
...

3. Read the documentation - Reference the syntax and examples to see if this resource is correct and how to use it.
   login defs resource page
   
4. Write the test! - Reference the documentation to write the test. Here we add the describe block to the control below.

Describe Block

  describe login_defs do
    its('CREATE_HOME') { should eq 'yes' }
  end

Full Control

control 'SV-230324' do
  title "All RHEL 8 local interactive user accounts must be assigned a home
directory upon creation."
  desc  "If local interactive users are not assigned a valid home directory,
there is no place for the storage and control of files they should own."
  desc  'rationale', ''
  desc  'check', "
    Verify all local interactive users on RHEL 8 are assigned a home directory
upon creation with the following command:
    $ sudo grep -i create_home /etc/login.defs
    CREATE_HOME yes
    If the value for \"CREATE_HOME\" parameter is not set to \"yes\", the line
is missing, or the line is commented out, this is a finding.
  "
  desc 'fix', "
    Configure RHEL 8 to assign home directories to all new local interactive
users by setting the \"CREATE_HOME\" parameter in \"/etc/login.defs\" to
\"yes\" as follows.
    CREATE_HOME yes
  "
  impact 0.5
  tag severity: 'medium'
  tag gtitle: 'SRG-OS-000480-GPOS-00227'
  tag gid: 'V-230324'
  tag rid: 'SV-230324r627750_rule'
  tag stig_id: 'RHEL-08-010760'
  tag fix_id: 'F-32968r567719_fix'
  tag cci: ['CCI-000366']
  tag nist: ['CM-6 b']

  describe login_defs do
    its('CREATE_HOME') { should eq 'yes' }
  end
end

Remember the matchers

Here, the login_defs resource shows examples using the includes and eq matcher. Here, we use eq because we are looking for only one result from the command, not an array of items.

5. Run the test!

inspec exec rhel8-baseline-stubs -t docker://redhat8

6. Troubleshoot errors - If you have syntax errors or unexpected results, it's time to troubleshoot. The best first step in troubleshooting is to read the error message from the command line.

Controls We Will Demonstrate

Control	Resource Used
SV-230324	login_defs resource
SV-230250	directory resource
SV-230243	directory looping & file resource
SV-230505	non applicable use case & package resource

Suggested Level 1 Controls

Control	Resource Used
SV-230383	login_defs resource
SV-230249	directory resource
SV-230471	directory looping & file resource
SV-230241	non applicable use case & package resource

Suggested Level 2 Controls

Control	Resource Used
SV-230281	parse config file
SV-230365	login_defs resource
SV-230264	file content

Strings

Single quotes are dumb strings. Double quotes are smart strings. Smart strings means they allow interpolation.

Suggested InSpec Resources to Review

• command
• file
• directory
• parse_config_file
• package
• login_defs

Completed RHEL8 Profile for Reference

Below is the url to the completed RHEL8 Inspec Profile for reference, and a few things to take note of.

1. redhat-enterprise-linux-8-stig-baseline

Key Elements in this Profile

• The use of impact 0 for NA & Container Aware Controls
• How we make the controls container aware, and
• The fail fast approach to testing execution.

Wait, does this mean that I can cheat on all of these exercises by looking up all the real controls?!

Yes. Feel free. We suggest you at least try thinking through how you'd write this test code without the real baseline, though.