v2r4 delta

Author: pwong2021

controls/SV-238196.rb

@@ -1,7 +1,7 @@
 control 'SV-238196' do
-  title "The Ubuntu operating system must provision temporary user accounts with an expiration time
-of 72 hours or less. "
-  desc "If temporary user accounts remain active when no longer needed or for an excessive period,
+  title 'The Ubuntu operating system must provision temporary user accounts with an expiration time
+of 72 hours or less.'
+  desc 'If temporary user accounts remain active when no longer needed or for an excessive period,
 these accounts may be used to gain unauthorized access. To mitigate this risk, automated
 termination of all temporary accounts must be set upon account creation.
 
@@ -15,7 +15,7 @@
 
 To address
 access requirements, many operating systems may be integrated with enterprise-level
-authentication/access mechanisms that meet or exceed access control policy requirements. "
+authentication/access mechanisms that meet or exceed access control policy requirements.'
   desc 'check', "Verify that the Ubuntu operating system expires temporary user accounts within 72 hours or
 less.
 
@@ -32,25 +32,26 @@
 accounts has an expiration date set within 72 hours of account creation.
 
 If any temporary
-account does not expire within 72 hours of that account's creation, this is a finding. "
-  desc 'fix', "If a temporary account must be created, configure the system to terminate the account after a
+account does not expire within 72 hours of that account's creation, this is a finding."
+  desc 'fix', 'If a temporary account must be created, configure the system to terminate the account after a
 72-hour time period with the following command to set an expiration date on it.
 
 Substitute
-\"system_account_name\" with the account to be created.
+"system_account_name" with the account to be created.
 
-$ sudo chage -E $(date -d \"+3 days\"
-+%F) system_account_name "
+$ sudo chage -E $(date -d "+3 days"
++%F) system_account_name'
   impact 0.5
-  tag severity: 'medium '
-  tag gtitle: 'SRG-OS-000002-GPOS-00002 '
-  tag gid: 'V-238196 '
-  tag rid: 'SV-238196r653763_rule '
-  tag stig_id: 'UBTU-20-010000 '
-  tag fix_id: 'F-41365r653762_fix '
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000002-GPOS-00002'
+  tag gid: 'V-238196'
+  tag rid: 'SV-238196r958364_rule'
+  tag stig_id: 'UBTU-20-010000'
+  tag fix_id: 'F-41365r653762_fix'
   tag cci: ['CCI-000016']
   tag nist: ['AC-2 (2)']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   if input('temporary_accounts').empty?
     describe 'Temporary accounts' do

controls/SV-238197.rb

@@ -1,8 +1,8 @@
 control 'SV-238197' do
-  title "The Ubuntu operating system must enable the graphical user logon banner to display the
+  title 'The Ubuntu operating system must enable the graphical user logon banner to display the
 Standard Mandatory DoD Notice and Consent Banner before granting local access to the system
-via a graphical user logon. "
-  desc "Display of a standardized and approved use notification before granting access to the Ubuntu
+via a graphical user logon.'
+  desc %q(Display of a standardized and approved use notification before granting access to the Ubuntu
 operating system ensures privacy and security notification verbiage used is consistent
 with applicable federal laws, Executive Orders, directives, policies, regulations,
 standards, and guidance.
@@ -14,7 +14,7 @@
 The banner must be formatted in accordance with applicable DoD policy. Use the following
 verbiage for operating systems that can accommodate banners of 1300 characters:
 
-\"You are
+"You are
 accessing a U.S. Government (USG) Information System (IS) that is provided for
 USG-authorized use only.
 
@@ -41,15 +41,15 @@
 to PM, LE or CI investigative searching or monitoring of the content of privileged
 communications, or work product, related to personal representation or services by
 attorneys, psychotherapists, or clergy, and their assistants. Such communications and
-work product are private and confidential. See User Agreement for details.\"
+work product are private and confidential. See User Agreement for details."
 
 Use the
 following verbiage for operating systems that have severe limitations on the number of
 characters that can be displayed in the banner:
 
-\"I've read & consent to terms in IS user
-agreem't.\" "
-  desc 'check', "Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD
+"I've read & consent to terms in IS user
+agreem't.")
+  desc 'check', 'Verify the Ubuntu operating system is configured to display the Standard Mandatory DoD
 Notice and Consent Banner before granting access to the operating system via a graphical user
 logon.
 
@@ -65,12 +65,12 @@
 banner-message-enable=true
 
 If the line is
-commented out or set to \"false\", this is a finding. "
-  desc 'fix', "Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.
+commented out or set to "false", this is a finding.'
+  desc 'fix', 'Edit the "/etc/gdm3/greeter.dconf-defaults" file.
 
 Look for the
-\"banner-message-enable\" parameter under the \"[org/gnome/login-screen]\" section and
-uncomment it (remove the leading \"#\" characters):
+"banner-message-enable" parameter under the "[org/gnome/login-screen]" section and
+uncomment it (remove the leading "#" characters):
 
 Note: The lines are all near the bottom of
 the file but not adjacent to each other.
@@ -84,17 +84,18 @@
 
 $ sudo dconf
 update
-$ sudo systemctl restart gdm3 "
+$ sudo systemctl restart gdm3'
   impact 0.5
-  tag severity: 'medium '
-  tag gtitle: 'SRG-OS-000023-GPOS-00006 '
-  tag gid: 'V-238197 '
-  tag rid: 'SV-238197r653766_rule '
-  tag stig_id: 'UBTU-20-010002 '
-  tag fix_id: 'F-41366r653765_fix '
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000023-GPOS-00006'
+  tag gid: 'V-238197'
+  tag rid: 'SV-238197r958390_rule'
+  tag stig_id: 'UBTU-20-010002'
+  tag fix_id: 'F-41366r653765_fix'
   tag cci: ['CCI-000048']
   tag nist: ['AC-8 a']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   xorg_status = command('which Xorg').exit_status
 

controls/SV-238198.rb

@@ -1,103 +1,56 @@
 control 'SV-238198' do
-  title "The Ubuntu operating system must display the Standard Mandatory DoD Notice and Consent
-Banner before granting local access to the system via a graphical user logon. "
-  desc "Display of a standardized and approved use notification before granting access to the Ubuntu
-operating system ensures privacy and security notification verbiage used is consistent
-with applicable federal laws, Executive Orders, directives, policies, regulations,
-standards, and guidance.
-
-System use notifications are required only for access via logon
-interfaces with human users and are not required when such human interfaces do not exist.
-
-
-The banner must be formatted in accordance with applicable DoD policy. Use the following
-verbiage for operating systems that can accommodate banners of 1300 characters:
-
-\"You are
-accessing a U.S. Government (USG) Information System (IS) that is provided for
-USG-authorized use only.
-
-By using this IS (which includes any device attached to this IS),
-you consent to the following conditions:
-
--The USG routinely intercepts and monitors
-communications on this IS for purposes including, but not limited to, penetration testing,
-COMSEC monitoring, network operations and defense, personnel misconduct (PM), law
-enforcement (LE), and counterintelligence (CI) investigations.
-
--At any time, the USG may
-inspect and seize data stored on this IS.
-
--Communications using, or data stored on, this IS
-are not private, are subject to routine monitoring, interception, and search, and may be
-disclosed or used for any USG-authorized purpose.
-
--This IS includes security measures
-(e.g., authentication and access controls) to protect USG interests--not for your personal
-benefit or privacy.
-
--Notwithstanding the above, using this IS does not constitute consent
-to PM, LE or CI investigative searching or monitoring of the content of privileged
-communications, or work product, related to personal representation or services by
-attorneys, psychotherapists, or clergy, and their assistants. Such communications and
-work product are private and confidential. See User Agreement for details.\"
-
-Use the
-following verbiage for operating systems that have severe limitations on the number of
-characters that can be displayed in the banner:
-
-\"I've read & consent to terms in IS user
-agreem't.\" "
-  desc 'check', "Verify the Ubuntu operating system displays the Standard Mandatory DoD Notice and Consent
-Banner before granting access to the operating system via a graphical user logon.
-
-Note: If
-the system does not have a graphical user interface installed, this requirement is Not
-Applicable.
-
-Verify the operating system displays the exact approved Standard Mandatory
-DoD Notice and Consent Banner text with the command:
-
-$ grep ^banner-message-text
-/etc/gdm3/greeter.dconf-defaults
-
-banner-message-text=\"You are accessing a U.S.
-Government \\(USG\\) Information System \\(IS\\) that is provided for USG-authorized use
-only.\\s+By using this IS \\(which includes any device attached to this IS\\), you consent to the
-following conditions:\\s+-The USG routinely intercepts and monitors communications on
-this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring,
-network operations and defense, personnel misconduct \\(PM\\), law enforcement \\(LE\\), and
-counterintelligence \\(CI\\) investigations.\\s+-At any time, the USG may inspect and seize
-data stored on this IS.\\s+-Communications using, or data stored on, this IS are not private,
-are subject to routine monitoring, interception, and search, and may be disclosed or used for
-any USG-authorized purpose.\\s+-This IS includes security measures \\(e.g.,
-authentication and access controls\\) to protect USG interests--not for your personal
-benefit or privacy.\\s+-Notwithstanding the above, using this IS does not constitute
-consent to PM, LE or CI investigative searching or monitoring of the content of privileged
-communications, or work product, related to personal representation or services by
-attorneys, psychotherapists, or clergy, and their assistants. Such communications and
-work product are private and confidential. See User Agreement for details.\"
-
-If the
-banner-message-text is missing, commented out, or does not match the Standard Mandatory DoD
-Notice and Consent Banner exactly, this is a finding. "
-  desc 'fix', "Edit the \"/etc/gdm3/greeter.dconf-defaults\" file.
-
-Set the \"banner-message-text\" line
+  title 'The Ubuntu operating system must display the Standard Mandatory DOD Notice and Consent Banner before granting local access to the system via a graphical user logon.'
+  desc %q(Display of a standardized and approved use notification before granting access to the Ubuntu operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. 
+ 
+System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. 
+ 
+The banner must be formatted in accordance with applicable DOD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: 
+ 
+"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. 
+ 
+By using this IS (which includes any device attached to this IS), you consent to the following conditions: 
+ 
+-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. 
+ 
+-At any time, the USG may inspect and seize data stored on this IS. 
+ 
+-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. 
+ 
+-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. 
+ 
+-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." 
+ 
+Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: 
+ 
+"I've read & consent to terms in IS user agreem't.")
+  desc 'check', "Verify the Ubuntu operating system displays the Standard Mandatory DOD Notice and Consent Banner before granting access to the operating system via a graphical user logon. 
+ 
+Note: If the system does not have a graphical user interface installed, this requirement is Not Applicable. 
+ 
+Verify the operating system displays the exact approved Standard Mandatory DOD Notice and Consent Banner text with the command: 
+ 
+$ grep ^banner-message-text /etc/gdm3/greeter.dconf-defaults 
+ 
+banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.' 
+ 
+If the banner-message-text is missing, commented out, or does not match the Standard Mandatory DOD Notice and Consent Banner exactly, this is a finding."
+  desc 'fix', %q(Edit the "/etc/gdm3/greeter.dconf-defaults" file.
+
+Set the "banner-message-text" line
 to contain the appropriate banner message text as shown below:
 
 banner-message-text='You
 are accessing a U.S. Government (USG) Information System (IS) that is provided for
-USG-authorized use only.\\n\\nBy using this IS (which includes any device attached to this
-IS), you consent to the following conditions:\\n\\n-The USG routinely intercepts and
+USG-authorized use only.\n\nBy using this IS (which includes any device attached to this
+IS), you consent to the following conditions:\n\n-The USG routinely intercepts and
 monitors communications on this IS for purposes including, but not limited to, penetration
 testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM),
-law enforcement (LE), and counterintelligence (CI) investigations.\\n\\n-At any time, the
-USG may inspect and seize data stored on this IS.\\n\\n-Communications using, or data stored
+law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the
+USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored
 on, this IS are not private, are subject to routine monitoring, interception, and search, and
-may be disclosed or used for any USG-authorized purpose.\\n\\n-This IS includes security
+may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security
 measures (e.g., authentication and access controls) to protect USG interests--not for your
-personal benefit or privacy.\\n\\n-Notwithstanding the above, using this IS does not
+personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not
 constitute consent to PM, LE or CI investigative searching or monitoring of the content of
 privileged communications, or work product, related to personal representation or
 services by attorneys, psychotherapists, or clergy, and their assistants. Such
@@ -108,17 +61,18 @@
 
 $ sudo dconf update
 $ sudo
-systemctl restart gdm3 "
+systemctl restart gdm3)
   impact 0.5
-  tag severity: 'medium '
-  tag gtitle: 'SRG-OS-000023-GPOS-00006 '
-  tag gid: 'V-238198 '
-  tag rid: 'SV-238198r653769_rule '
-  tag stig_id: 'UBTU-20-010003 '
-  tag fix_id: 'F-41367r653768_fix '
+  tag severity: 'medium'
+  tag gtitle: 'SRG-OS-000023-GPOS-00006'
+  tag gid: 'V-238198'
+  tag rid: 'SV-238198r958390_rule'
+  tag stig_id: 'UBTU-20-010003'
+  tag fix_id: 'F-41367r653768_fix'
   tag cci: ['CCI-000048']
   tag nist: ['AC-8 a']
-  tag 'host', 'container'
+  tag 'host'
+  tag 'container'
 
   expected_banner_text = input('banner_text')
   clean_banner = expected_banner_text.gsub(/[\r\n\s]/, '')