last day (14 days later) » 

13:18
room topic changed to nessus room : nessus stuff (no tags)
<custom_item>
system : "Linux"
type : FILE_CONTENT_CHECK
description : "Debian found"
file : "/etc/debian_version"
regex : "^5|6"
expect : "^5|6"
</custom_item>
was the check
I was thinking if I change that to something perhaps from /etc/issue
that ubuntu always has
Oh sure
So the FILE_CONTENT_CHECK does exactly what you'd think. You give it a filename and it looks in it for the provided regex
and then the rest of the compliance file does or doesn't run based on the result?
So that's literally just doing a "grep -e '^5|6' /etc/debian_version"
Every check gets run every time
that's what it kind of looked like but the other end of the conditional will be miles away so hard to tell if that was the only spot I needed to change.
That's true, there are conditionals, so they could write the audit to not run if that check fails
The conditional language part is....ugh
It's messy.
I'm almost positive Tenable has internal tools to make writing these things easier.
13:23
the reason I reckoned that is that I tried runing with that audit enabled on a ubuntu server and it didn't seem to do anything
so I guessed that there must be a check to make sure it's an ubuntu server before it runs
It's possible that it is a conditional precheck then.
yeah I'll try that and run it on a home server first before trying the customer :)
FYI
cat /etc/debian_version
wheezy/sid
cat /etc/issue
Ubuntu 13.10 \n \l
So you could change that check to be
So I'm thinking
regex : "^Ubuntu"
expect : "^Ubuntu"
might do it
as a generic check for ubuntu
on /etc/issue that is
<custom_item>
system : "Linux"
type : FILE_CONTENT_CHECK
description : "Debian found"
file : "/etc/issue"
regex : "^Ubuntu 13.10"
expect : "^Ubuntu 13.10"
</custom_item>
13:25
this is interesting
You may need to go find the end match of that conditional and see what it's doing
@LucasKauffman where's Simon to yell nerd at this point..?
@LucasKauffman Ever dealt with the audit files before?
@ScottPack yeah that will be the fun bit. I should really see if I can strip out the content and do one check first and build it up like that. but I may try some empirical "try one, try the other" stuff first as a short cut
13:27
I would definitely recommend getting the Debian audit that matches the Ubuntu version you're using.
as the file is 220K of text
Yeah, those files are messy.
@ScottPack unfort there is only one....
Figures
yeah redhat/suse is easy
windows has loads
debian/ubuntu, not so much
13:28
@ScottPack I've always been lucky, most machines either were running windows or red hat
@LucasKauffman But have you ever run the audits?
and those have DISA/STIG files readily available
@ScottPack yea I have
never wrote them myself
@RоryMcCune I had to try to convert the el5 audit to work on el6 once. That fucking sucked.
@LucasKauffman They're worth looking at just so you get a feel for what they're doing. Individually they're not complicated, just messy.
I will admit there's a temptation to look at writing a ruby DSL to generate the checks, doing it manually just seems like it's going to be error prone as heck
Tenable does (or used to) provide a tool that you could run on a Windows server and generate an audit file from it. The idea being that you ran it on your gold master image.
@RоryMcCune What version of Ubuntu are you looking at?
13:30
@ScottPack 12.04 LTS so at least I have the manual CIS stuff I can look at :)
@RоryMcCune Since you're a pro feed user you could submit a support request
@ScottPack yeah I might ask when they're planning to do a .audit for it, I'd have thought that they would have that as a priority given the quantity of ubuntu boxes these days...
I wonder how many licenses you should have before they consider you important enough
@LucasKauffman You'd be surprised. We only had 1 license for a long time and I felt well taken care of, the few times I had to get involved.
Hell, I remember posting a question on the forums once. We had just purchased a second license and I was trying to copy users from one scanner to the other so I wouldn't have to recreate and reset passwords.
It kind of went sideways and within an hour I had a response from Renaud telling me what to do.
@ScottPack he does seem to hang out on the forums quite a bit...
13:39
It'd be worth at least asking where it is on their queue.
@ScottPack good point..
14:02
What makes me nervous about the CIS side is that the 12.04 benchmark was released in April of 2014.

last day (14 days later) »