diff --git a/secrules/rules10.py b/secrules/rules10.py new file mode 100644 index 0000000000000000000000000000000000000000..688474a7cdacb9cbd7048767c859b20b7dbfe230_c2VjcnVsZXMvcnVsZXMxMC5weQ== --- /dev/null +++ b/secrules/rules10.py @@ -0,0 +1,176 @@ +# -*- coding: iso-8859-1 -*- +__version__ = '1.0' + +from common import level_rule +import os + +@level_rule(2) +def rule1001(fo, fmt): + """ This prevents accounting history from being recorded.""" + + if not fmt: + print >>fo, 'RULE 1001' + print >>fo, '=========' + with os.popen('SHOW ACCOUNTING') as p: + r = [x[:-1] for x in p] + + for a in r: + if 'enable' in a: + break + if 'disable' in a: + if fmt: + print >>fo, '1001�2� Accounting is disable' + else: + print >>fo, 'Accounting is disable' + break + +@level_rule(2) +def rule1002(fo, fmt): + """ The related processes and events are not being recorded. If system +level access is not recorded, there is no way to track if an attack is being +made to gain unauthorized access to the system.""" + + if not fmt: + print >>fo, 'RULE 1002' + print >>fo, '=========' + f = False + with os.popen('SHOW ACCOUNTING') as p: + r = [x[:-1] for x in p] + + for a in r: + if 'LOGIN_FAILURE' in a: + f = True + if not f: + if fmt: + print >>fo, '1002�2� LOGIN_FAILURE not accounted' + else: + print >>fo, 'LOGIN_FAILURE not accounted' + +@level_rule(1) +def rule1003(fo, fmt): + """ All system security alarms are currently disabled.""" + + if not fmt: + print >>fo, 'RULE 1003' + print >>fo, '=========' + with os.popen('SHOW AUDIT/ALARM') as p: + r = [x[:-1] for x in p] + + for a in r: + if 'enable' in a: + break + if 'disable' in a: + if fmt: + print >>fo, '1003�1� Alarms auditing is disable' + else: + print >>fo, 'Alarms auditing is disable' + break + +@level_rule(2) +def rule1004(fo, fmt): + """ Some security alarms are not being reported.""" + + if not fmt: + print >>fo, 'RULE 1004' + print >>fo, '=========' + with os.popen('SHOW AUDIT/ALARM') as p: + r = [x[:-1] for x in p] + brk = False + acl = False + for a in r: + if 'Breakin:' in a: + brk = True + if 'ACL' in a: + acl = True + if not brk: + if fmt: + print >>fo, '1004�2� Breakin not audited (alarm)' + else: + print >>fo, 'Breakin not audited (alarm)' + if not acl: + if fmt: + print >>fo, '1004�2� ACL not audited (alarm)' + else: + print >>fo, 'ACL not audited (alarm)' + +@level_rule(1) +def rule1006(fo, fmt): + """ Security alarms are not being reported. Security infractions are not +being recorded.""" + + if not fmt: + print >>fo, 'RULE 1006' + print >>fo, '=========' + with os.popen('SHOW AUDIT/AUDIT') as p: + r = [x[:-1] for x in p] + + for a in r: + if 'enable' in a: + break + if 'disable' in a: + if fmt: + print >>fo, '1006�1� Report auditing is disable' + else: + print >>fo, 'Report auditing is disable' + break + +@level_rule(2) +def rule1007(fo, fmt): + """ Some security infractions are not being recorded.""" + + if not fmt: + print >>fo, 'RULE 1007' + print >>fo, '==============' + with os.popen('SHOW AUDIT/AUDIT') as p: + r = [x[:-1] for x in p] + + brk = False + brk_lst = 'Breakin not audited' + acl = False + aut = False + lgf = False + lgf_list = 'Logfailure not audited' + + for a in r: + if 'ACL' in a: + acl = True + if 'Authorization' in a: + aut = True + if 'Breakin:' in a: + brk_lst = a + if 'dialup,local,remote,network,detached,server' in a: + brk = True + if 'Logfailure' in a: + lgf_list = a + if 'batch,dialup,local,remote,network,subprocess,detached,server' in a: + lgf = True + if not brk: + if fmt: + print >>fo, '1007�2�', brk_lst + else: + print >>fo, brk_lst + if not acl: + if fmt: + print >>fo, '1007�2� ACL not audited' + else: + print >>fo, 'ACL not audited' + if not aut: + if fmt: + print >>fo, '1007�2� Authorization not audited' + else: + print >>fo, 'Authorization not audited' + if not lgf: + if fmt: + print >>fo, '1007�2�', lgf_list + else: + print lgf_list + +if __name__ == '__main__': + import sys + fo = open(sys.argv[1], 'w') if len(sys.argv) > 1 else sys.stdout + rule1001(fo, len(sys.argv) > 2) + rule1002(fo, len(sys.argv) > 2) + rule1003(fo, len(sys.argv) > 2) + rule1004(fo, len(sys.argv) > 2) + rule1006(fo, len(sys.argv) > 2) + rule1007(fo, len(sys.argv) > 2)