1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
<def-group>
<definition class="compliance" id="sudo_remove_nopasswd" version="1">
{{{ oval_metadata("Checks sudo usage without password", rule_title=rule_title) }}}
<criteria operator="AND">
<criterion comment="NOPASSWD is not configured in /etc/sudoers" test_ref="test_nopasswd_etc_sudoers" />
<criterion comment="NOPASSWD is not configured in /etc/sudoers.d" test_ref="test_nopasswd_etc_sudoers_d" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist /etc/sudoers" id="test_nopasswd_etc_sudoers" version="1">
<ind:object object_ref="object_nopasswd_etc_sudoers" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_nopasswd_etc_sudoers" version="1">
<ind:filepath>/etc/sudoers</ind:filepath>
<ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist in /etc/sudoers.d" id="test_nopasswd_etc_sudoers_d" version="1">
<ind:object object_ref="object_nopasswd_etc_sudoers_d" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_nopasswd_etc_sudoers_d" version="1">
<ind:path>/etc/sudoers.d</ind:path>
<ind:filename operation="pattern match">^.*$</ind:filename>
<ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
|
