crunchydata / pgstigcheck-inspec Goto Github PK

One of the controls has multiple CCIs (string array), however every other control is just a single string. This causes the output json to not be consistent and breaks JSON unmarshallers.

It needs to be an array with a single value on all others or just one CCI as a string in the control that's different.

This profile is written for the PostgreSQL 9.x STIGv1, the current version 4 has many new controls.

Could this profile be updated to reflect the new changes in the PostgreSQL 9.x STIGv4.

The following new controls would need to be added:

• V-72843
• V-72847
• V-72853
• V-72855
• V-72885
• V-72889
• V-72907
• V-72913
• V-72915
• V-72921
• V-72923
• V-72925
• V-72927
• V-72929
• V-72933
• V-72939
• V-72941
• V-72945
• V-72951
• V-72969
• V-72975
• V-72977
• V-72985
• V-72997
• V-73007
• V-73009
• V-73039
• V-73043
• V-73053
• V-73059

Sensitive resources
In some scenarios, you may be writing checks involving resources with sensitive content (e.g. a file resource). In the case of failures, it may be desired to suppress output. This can be done by adding the :sensitive flag to the resource definition

describe file('/tmp/mysecretfile'), :sensitive do
its('content') { should contain 'secret_info' }
end

In the controls, when we tag the controls with multiple cci's or nist 800-53 tags you must tag them in an array rather than individual controls.

The key/value pair will take the last value set.

  tag "cci": ["CCI-000382","CCI-001762"]
  tag "nist": ["CM-7 b", "CM-7 (1) (b)", "Rev_4"]

To ensure you are getting the right data.

I have a configuration that I am wondering if it is possible/wise to support for with profile. I am currently setting up postgres with no postgres password, and I have noticed that this makes it impossible to run this STIG check. Is this on purpose, since it is considered insecure to run in this configuration, or for a different reason?

In order to keep things clean, I suggest we move the hugo site to its own branch, such as 'web-src' or something along those lines. Then updates to the site, directions or whatnot can be pushed independent of the profile itself.

The defaults seem to have been dropped from the inspec controls. This is bad form. :) given that you will get 'nil' values if the user does not pass the 'attributes.yml' file and the run will fail. We should have default values if possible - skipping of course, users, pass, etc.