openstack/ansible-hardening
Code Issues Proposed changes
ansible-hardening/doc/metadata/rhel7/RHEL-07-010020.rst
Major Hayden 0a7a9932a0 Security: Add tasks for RHEL-07-010020 
This patch adds tasks which check for files that have been modified
since their packages were installed. This can sometimes be sign
of compromise.

Any files failing checksum validation are displayed for the deployer
to review.

Implements: blueprint security-rhel7-stig
Change-Id: I5ccc375ecb08e51c51dab80b47a190050731f700
2016-10-20 15:44:31 +00:00

670 B
Raw Blame History

---id: RHEL-07-010020 status: implemented tag: packages ---

Ansible tasks will check the rpm -Va output (on CentOS and RHEL) or the output of debsums (on Ubuntu) to see if any files installed from packages have been altered. The tasks will print a list of files that have changed since their package was installed.

Deployers should be most concerned with any checksum failures for binaries and their libraries. These are most often a sign of system compromise or poor system administration practices.

Configuration files may appear in the list as well, but these are often less concerning since some of these files are adjusted by the security role itself.