Skip to content

Fix remediation for rule configure_opensc_nss_db #4776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ggbecker wants to merge 2 commits into from
Closed

Fix remediation for rule configure_opensc_nss_db #4776

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8468a83
Use modutil to handle NSS database configuration.
ggbecker Aug 30, 2019
56d2559
Add couple of test scenarios for rule configure_opensc_nss_db.
ggbecker Aug 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 10 additions & 11 deletions ...ounts-physical/screen_locking/smart_card_login/configure_opensc_nss_db/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,16 @@
# strategy = configure
# complexity = low
# disruption = low
- name: Check existence of pkcs11-switch
stat:
path: /usr/bin/pkcs11-switch
register: pkcs11switch
- name: Check existence of modutil
stat:
path: /usr/bin/modutil
register: modutil_bin

- name: Get NSS database smart card configuration
command: /usr/bin/pkcs11-switch
changed_when: True
register: pkcsw_output
when: pkcs11switch.stat.exists
- name: Remove coolkey module if exists
command: modutil -delete "CoolKey PKCS {{ '#' }}11 Module" -dbdir sql:/etc/pki/nssdb/ -force
when: modutil_bin.stat.exists
ignore_errors: True

- name: "{{{ rule_title }}}"
command: /usr/bin/pkcs11-switch opensc
when: pkcs11switch.stat.exists and pkcsw_output.stdout != "opensc"
command: /usr/bin/modutil -add "OpenSC PKCS {{ '#' }}11 Module" -dbdir sql:/etc/pki/nssdb/ -libfile opensc-pkcs11.so -force
when: modutil_bin.stat.exists
7 changes: 2 additions & 5 deletions .../accounts-physical/screen_locking/smart_card_login/configure_opensc_nss_db/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,5 @@
# complexity = low
# disruption = low

PKCSSW=$(/usr/bin/pkcs11-switch)

if [ ${PKCSSW} != "opensc" ] ; then
${PKCSSW} opensc
fi
modutil -delete "CoolKey PKCS #11 Module" -dbdir sql:/etc/pki/nssdb/ -force || true # ignore errors
modutil -add "OpenSC PKCS #11 Module" -dbdir sql:/etc/pki/nssdb/ -libfile opensc-pkcs11.so -force
Copy link
Copy Markdown
Member Author

@ggbecker ggbecker Aug 30, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might need some kind of condition to test if it is already setup correctly.

4 changes: 2 additions & 2 deletions ...counts/accounts-physical/screen_locking/smart_card_login/configure_opensc_nss_db/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ description: |-
<tt>Coolkey PKCS#11</tt> module in the NSS database. To configure the
NSS database ot use the <tt>opensc</tt> module, run the following
command:
<pre>$ sudo pkcs11-switch opensc</pre>
<pre>$ sudo modutil -add "OpenSC PKCS {{ '#' }}11 Module" -dbdir sql:/etc/pki/nssdb/ -libfile opensc-pkcs11.so</pre>

rationale: |-
Smart card login provides two-factor authentication stronger than
Expand Down Expand Up @@ -39,5 +39,5 @@ ocil_clause: 'opensc is not in use by the nss database'
ocil: |-
To verify that <tt>opensc</tt> is configured in the NSS database,
run the following command:
<pre>$ pkcs11-switch</pre>
<pre>$ modutil -rawlist -dbdir sql:/etc/pki/nssdb/ | grep "^library=\"opensc-pkcs11.so\""</pre>
The output should return <pre>opensc</pre>
8 changes: 8 additions & 0 deletions ...reen_locking/group_smart_card_login/rule_configure_opensc_nss_db/correct_settings.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
#!/bin/bash

# profiles = xccdf_org.ssgproject.content_profile_ncp

yum install -y opensc nss-utils

modutil -delete "CoolKey PKCS #11 Module" -dbdir sql:/etc/pki/nssdb/ -force
modutil -add "OpenSC PKCS #11 Module" -dbdir sql:/etc/pki/nssdb/ -libfile opensc-pkcs11.so -force
9 changes: 9 additions & 0 deletions ...screen_locking/group_smart_card_login/rule_configure_opensc_nss_db/wrong_settings.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#!/bin/bash

# profiles = xccdf_org.ssgproject.content_profile_ncp

yum install -y opensc nss-utils

# notice the absence of prefix sql: in -dbdir parameter value, this cause modutil to write in old dabatase format
# which does not write into /etc/pki/nssdb/pkcs11.txt file (our OVAL checks this file)
modutil -add "OpenSC PKCS #11 Module" -dbdir /etc/pki/nssdb/ -libfile opensc-pkcs11.so -force