mitre / oracle-mysql-ee-5.7-cis-baseline Goto Github PK

Some final tests showed that all the answers it pulls back seem to be nul. Please check.

Applies to control 7.3:

If client password isn't defined in the my.cnf file, current logic gives a profile error:

undefined method password' for nil:NilClass`

The logic should capture this as one of the conditions for a passing test result instead of an error.

(updated baseline readme link:)
https://github.com/mitre/docs-mitre-inspec/blob/master/templates/baseline_readme.md

Please look into aligning the README.md to the style of the above template, for baseline InSpec profiles.

See examples in the baseline Windows 2012, IIS, and MS SQL baseline profiles.

Thanks! - Eugene.

Rubocop found issues in the profile. Nothing that stops the profile from running properly, just style guidelines.
rubocop_issues.txt

Currently this code does not parse the history_file variable and does not test correctly:

 history_file = command("find / -name '.mysql_history'").stdout.strip.split("\n")

  describe "The MySql history file: #{history_file}" do
    subject { file(history_file.to_s) }
    its('link_path') { should eq '/dev/null' }
  end

Recommend update to:

history_file = command("find / -name '.mysql_history'").stdout.strip.split("\n")

history_file.each do |files|
  describe "The MySql history file: #{files}" do
    subject { file(files) }
    its('link_path') { should eq '/dev/null' }
  end
  only_if { os.linux? }
end

For the following 12 controls, when determining that the test is not applicable, do not change the desc field. only set the skip message:

2.3
5.1
5.2
5.3
5.4
5.5
5.6
5.7
5.8
5.9
8.2
9.2

See the attached to create NIST 800-53 tags based on CIS controls
NIST80053_to_CIS_SC6.1_Mapping_September2017.xlsx

If "select @@log_error" returns nil or "stderr", require a manual review instead:

 describe "Since the @@log_error destination is either not set or set to stderr, perform a manual review to ensure permissions on the final destination are secured."  do
      skip "Since the @@log_error destination is either not set or set to stderr, perform a manual review to ensure permissions on the final destination are secured."

Add folder with sample data for hardened and unhardened results

Applies to controls 3.3, and 6.5 through 6.9

Currently, if the "audit_"* parameters are not defined (i.e., auditing isn't installed or the profile is run against a community rather than enterprise edition, the describe block is not contained and produces a profile error, for example:
ERROR 1193 (HY000) at line 1: Unknown system variable 'audit_log_file'

If this happens, add logic similar to this:

describe "Since the audit parameter is not defined, perform a manual review to ensure auditing is configured."  do
      skip "Since the audit parameter is not defined, perform a manual review to ensure auditing is configured."