Open-source DISA STIG remediation · RHEL 5 and 6 · 2011–2014
Aqueduct: DISA STIG remediation for RHEL 5 and 6, 2011–2014
Aqueduct (2011–2014) was an open-source project, created by Vincent Passaro on Fedora Hosted, that published Bash, Puppet and Ansible scripts to fix DISA STIG findings on Red Hat Enterprise Linux 5 and 6, one script per finding. It supplied the remediation half while SCAP Security Guide, now called ComplianceAsCode, supplied the checks.
Before SCAP Security Guide shipped its own Bash fixes, Aqueduct turned government security guidance into scripts an administrator could read, run and argue with, one finding at a time. It was built in public on Fedora’s infrastructure, and much of it lives on inside the tools that replaced it.
STIG a RHEL 5 box in five minutes with Aqueduct
That was the reputation. Red Hat’s government standards page listed Aqueduct among four projects of interest, “famous for their STIG a RHEL box in 5 minutes guide.”
In October 2012, Red Hat’s Shawn Wells measured Aqueduct on RHEL 5 against DISA’s RHEL 5 V1R1 STIG benchmark: passing checks rose from 198 (57%) to 278 (80%) of 350, with a script run of 3 minutes 12 seconds.
- Checks passing before
- 198 / 350
- After
- 278 / 350
- Script run
- 3m12s
[root@rhel5 ~]# svn export http://svn.fedorahosted.org/svn/aqueduct/trunk/compliance/Bash/STIG/rhel-5/ A rhel-5/prod/GEN000020.sh A rhel-5/prod/GEN000250.sh A rhel-5/prod/GEN000290-3.sh … [root@rhel5 ~]# oscap xccdf eval --profile stig-rhel5-server --results before.xml rhel5-stig-xccdf.xml Title The system must require authentication upon booting into single-user mode… Rule GEN000020 severity=medium Result fail Title The system must not have accounts configured with blank or null passwords… Rule GEN000560 severity=high Result pass … pass 198 fail 152 56.6% [root@rhel5 ~]# cd rhel-5/prod && for s in *.sh; do bash $s; done ran GEN000000-LNX00580.sh elapsed 3m12s [root@rhel5 ~]# oscap xccdf eval --profile stig-rhel5-server --results after.xml rhel5-stig-xccdf.xml Title System audit logs must be owned by root Rule GEN002680 severity=medium Result pass … pass 278 fail 72 79.4% +80 rules [root@rhel5 ~]#
Before SCAP Security Guide shipped its own Bash fixes
STIGs were documents, not code
A DISA (Defense Information Systems Agency) STIG, or Security Technical Implementation Guide, told you what a hardened RHEL system should look like. Getting there meant hundreds of manual changes per host, repeated by every program, contractor and agency that had to pass an audit.
Granular by design
Each Aqueduct script mapped to a single STIG finding ID, so the system owner could decide line by line what to apply. The wiki put it as “granular enough to allow the system owner to decide on changes at the line item level.”
Recognized by the vendor
Red Hat’s government standards page listed Aqueduct as one of four projects of interest, “famous for their STIG a RHEL box in 5 minutes guide.” Tresys shipped it as RPMs inside CLIP.
Bash, on purpose
Bash shipped on every RHEL disk, and more administrators could read and contribute to it than to Puppet. Vincent Passaro made that case on the mil-oss list in 2012, partly for DoD vendor-support reasons.
One STIG finding, one Bash script
DISA · UNIX STIG · RHEL 5
V-812 · GEN002680 · SV-38645r1_rule · medium
System audit logs must be owned by root
Failure to give ownership of system audit log files to root provides the designated owner and unauthorized users with the potential to access sensitive information.
Fix text Change the ownership of the audit log file(s).
######################################################################
#By Tummy a.k.a Vincent C. Passaro
#www.vincentpassaro.com
######################################################################
#| 1.0 | Initial Script | Vincent C. Passaro | 20-oct-2011|
#######################DISA INFORMATION###############################
# Group ID (Vulid): V-812
# Group Title: GEN002680
# Rule ID: SV-38645r1_rule
# Severity: medium
# Rule Title: System audit logs must be owned by root
#
# Fix Text: Change the ownership of the audit log file(s).
#######################DISA INFORMATION###############################
#Global Variables#
PDI=GEN002680
LOGFILES=$( grep "^log_file" /etc/audit/auditd.conf|sed s/^[^\/]*//|xargs stat -c %U:%n | cut -d ":" -f 2 )
BADELOGFILES=$(for line in $LOGFILES; do find $line ! -user root; done )
#Start-Lockdown
for file in $BADELOGFILES
do
chown root $file
doneEach Aqueduct script carried DISA’s own finding text in its header, so the change and its justification travelled together and the system owner could choose, line item by line item, what to apply.
Aqueduct by the numbers
| Content | Scripts | Breakdown |
|---|---|---|
| RHEL 5 STIG (Bash) | 734 | 493 production, 163 development, 78 manual checks |
| RHEL 6 STIG (Bash) | 256 | 56 production, 182 development, 18 manual checks |
| SCAP Security Guide rules (Bash) | 265 | Rule-named fixes written to plug into SCAP Security Guide |
| Puppet and Ansible | 23 + 1 | 23 Puppet modules for the RHEL 6 STIG (2013) and one Ansible hardening role (2014) |
| Total Bash scripts | 1,255 | BuddhaLabs/Aqueduct, last commit 17 October 2014 |
The project wiki listed DISA STIG, USGCB, CIS, NISPOM, PCI, HIPAA, DHS guidance. Only the STIG and SCAP Security Guide content survives in the Git repository.
Aqueduct and SCAP Security Guide, 2011–2014: one goal, two paths
SCAP Security Guide was built to check systems; Aqueduct was built to fix them. In 2013 SSG decided its fixes had to live inside its own XCCDF files as short Bash snippets, one per rule, “and not references to JSON” (Shawn Wells, Red Hat). Aqueduct’s scripts were larger and STIG-specific, so the projects went separate ways. In 2014 Wells wrote that “many of the remediation scripts originated from Aqueduct.”
- Origins2011 – mid 2012
Aqueduct opens on fedorahosted.org
A Trac wiki, an SVN repository and a mailing list on Fedora’s project hosting. The water-drop logo is attached to the wiki the same day.
Vincent Passaro
“RHEL STIG via Puppet” on mil-oss
Aqueduct isn't a tool per say. Its the remediation content. If there are puppet modules the community can take those and use them anyway they want.
The Military Open Source list asks how Aqueduct STIGs RHEL 5. The thread becomes the Bash-versus-Puppet argument.
Read “RHEL STIG via Puppet” (31 messages)Jeffrey Blank
SCAP Security Guide (SSG) introduces itself to the Aqueduct list
As Aqueduct provides deployment resources for compliance with security baselines from multiple organizations, we would like to maintain close coordination.
SSG will produce prose and OVAL checks from one source, and asks for “close coordination” with Aqueduct’s remediation.
Read “scap-security-guide: building SCAP content for RHEL 6” (2 messages)GEN002680.sh
# Rule ID: SV-38645r1_rule # Severity: medium # Rule Title: System audit logs must be owned by root # # Fix Text: Change the ownership of the audit log file(s).
The earliest dated script header in the code: “By Tummy a.k.a Vincent C. Passaro.” 550 of the 734 RHEL 5 STIG scripts name Vincent Passaro as initial author.
Jeffrey Blank
SSG decides to allow Bash <fix> content
In a recent meeting, it was decided to permit <fix> tags in scap-security-guide and for these to include Bash content.
After Red Hat’s David Egts points to Aqueduct’s production scripts as the model.
Read “coming soon: consistency checking scripts” (32 messages)- Building togetherJul – Dec 2012
Spencer R. Shimko
CLIP for RHEL 6.2: SSG checks, Aqueduct fixes
The SSG content is interpreted by SecState in the kickstart %post and findings are immediately remediated by SecState with content from the Aqueduct project.
Tresys ships a build where SSG content finds the problem and Aqueduct content remediates it during install.
Read “SCAP Security Guide and CLIP for RHEL 6.2 Alpha” (2 messages)Vincent Passaro
Aqueduct helps map RHEL 5 to RHEL 6
Be gentle, Aqueduct is all SVN, so still learning the oddities of GIt. That and my eyes started bleeding about 1/2 through this.
Vincent Passaro’s mapping patch feeds the content SSG sends to DISA for the RHEL 6 STIG.
Read “[PATCH] RHEL 5 => RHEL 6 Mapping + comments” (3 messages)198 278
of 350 DISA STIG checks passing
“So, you wanna STIG a RHEL5 box?”
Shawn Wells of Red Hat runs Aqueduct against DISA’s RHEL 5 benchmark: passing checks go from 198 to 278 of 350 in about three minutes.
- ConvergenceJan – Feb 2013
Vincent Passaro
“Rather than coming out of the bunker of DISA”
The RHEL 6 STIG is coming, the best part being that its being written in the Open Source Community rather than coming out of the bunker of DISA!
Vincent Passaro on Red Hat’s rhos-list: the RHEL 6 STIG is being written in the open-source community.
DISA posts the draft RHEL 6 STIG
- The splitFeb – Dec 2013
Shawn Wells
SSG opens its own remediation
I think it's important for our final XCCDF to contain the fully working scripts, and not references to JSON, so that OpenSCAP and other SCAP scanners can natively use the content.
Fixes will live inside the XCCDF, named per rule, “and not references to JSON.”
Read “Remediation Scripts” (34 messages)commit 2013-05-31 Author: Vincent Passaro Initial CommitAqueduct moves to Git
Vincent Passaro’s “Initial Commit.” June 2013 is the busiest month in the history: 80 commits, mostly RHEL 6 work with Leam Hall.
Vincent Passaro
“I’m confused.”
I'm confused. So remediation content into Scap? Not what was discussed on the Aqueduct call yesterday?
Vincent Passaro, on the list, the day after an Aqueduct call: “So remediation content into Scap?”
Read “[PATCH 4/4] Created service_*_disabled remediation scripts” (4 messages)
Buddha Labs
Vincent Passaro’s compliance work starts carrying the Buddha Labs name; the BuddhaLabs GitHub org follows in November.
BuddhaLabs / Aqueduct
-OFFICIAL REPO- DISA STIG Compliance Automation leveraging Puppet, Ansible, and Bash
BuddhaLabs/Aqueduct on GitHub
The repository that survived Fedora’s shutdown, marked “-OFFICIAL REPO-.”
- Aftermath2014
commit 2014-07-16 Author: Bill Carlson Ansible harden roleAnsible arrives
A hardening role from Bill Carlson joins the Bash and Puppet content.
Shawn Wells
“Integrate or forge ahead”
When it came to the matter of "integrate or forge ahead," and in order for progress to be made, I had to make a decision. It was to forge ahead.
On the SSG list, the split is finally discussed in the open, by the people who made it.
Read “Remediation advice for RHEL 5 and 6” (19 messages)commit 2014-10-17 Author: Bill Carlson Added iptables and other tags to harden main.Last commit
After 2014
Fedora retires fedorahosted.org
The wiki, Trac, SVN history and the project’s private list go with it. What survives is the GitHub repository, public list archives and Wayback captures.
The Aqueduct correspondence: 39 mailing-list threads, 2011–2014
Every public thread that survives: 39 conversations, 337 messages, recovered from list archives after Fedora shut down the project’s hosting. They are kept here as an archive, the historical record of the project. Email addresses, phone numbers and signature blocks are removed; message text is otherwise verbatim. Each thread links to its original archive.
A mil-oss question about Aqueduct's Puppet-based RHEL 5 STIG process turns, in 2012, into a long Puppet-vs-Bash argument: Kit Plummer pushes configuration management, while Vincent Passaro and Lee Kinser defend Bash, citing DoD vendor-support rules (SECNAVINST-5230.15).
Aqueduct isn't a tool per say. Its the remediation content. If there are puppet modules the community can take those and use them anyway they want.
scap-security-guide: building SCAP content for RHEL 6
Jeffrey Blank introduces the new scap-security-guide project to the Aqueduct list: prose guides, baselines, and OVAL checking content from one source. James Labocki offers time on the next Aqueduct community call.
As Aqueduct provides deployment resources for compliance with security baselines from multiple organizations, we would like to maintain close coordination.
coming soon: consistency checking scripts
A thread about consistency checks turns into the first big debate over remediation: Steve Grubb asks about <fix> tags, Red Hat's David Egts points to Aqueduct's scripts, Tresys argues for Puppet, and Jeff Blank reports the decision to allow Bash <fix> tags in SSG while Puppet content is developed elsewhere.
In a recent meeting, it was decided to permit <fix> tags in scap-security-guide and for these to include Bash content.
David Egts of Red Hat tries SSG and asks whether it will generate remediation. Jeff Blank says there are no concrete plans but it's doable, and the topic goes on the agenda of the Aqueduct community call.
Seems like the Aqueduct community would be interested in the availability <fix>-like content whether it was baked into SSG or provided separately via bash or puppet.
Petr Lautrbach of Red Hat adds SSG to an automated XCCDF test system. Jeff Blank names kickstart-generating <fix> tags as a goal, and says runtime remediation would be coordinated with Aqueduct and Tresys.
For other use cases (such as remediation during system operation, driven by administrators) we will want to coordinate with Aqueduct project and Tresys projects (e.g. secstate), and these may involve additional sets of <fix> tags.
SCAP Security Guide and CLIP for RHEL 6.2 Alpha
Spencer Shimko announces that Tresys's CLIP for RHEL 6.2 ships SSG: SecState scans with SSG content during kickstart and fixes findings with Aqueduct content. Shawn Wells calls it a huge validation.
The SSG content is interpreted by SecState in the kickstart %post and findings are immediately remediated by SecState with content from the Aqueduct project.
Content and profile management with SecState
Spencer Shimko walks through SecState: import an SSG profile, select rules, audit, then run 'secstate remediate' using Aqueduct content.
Remediate the findings (thanks to Aqueduct for the content!).
disa-stig-rhel5-v1r0.6-xccdf-manual.xml
Willem Bos asks where a RHEL 5 'manual' XCCDF file came from. Shannon Mitchell and Shawn Wells explain that it holds procedural checks OVAL can't automate. Vince complains that DISA's SCAP content now leaves more manual checks than the old SRR scripts did.
It’s sad to see DISA SCAP taking the community 3 steps forward 4 steps back.
Vince tells Jeff Blank that Aqueduct volunteers helping SSG can coordinate in #aqueduct on freenode, and gives his and Lee Kinser's handles.
For the helping out, we can use the Aqueduct channel for coordinating who's working on what.
Tresys proposes a 'manual' profile for checks that can't be automated. Shawn Wells asks whether Tresys plans to fork SSG, Spencer Shimko insists Tresys won't, and Steve Grubb restates Red Hat's upstream-first policy.
Tresys is adamantly against forking. We have been stuck by forks before
[PATCH] RHEL 5 => RHEL 6 Mapping + comments
Vince sends a patch mapping open RHEL 5 STIG items to RHEL 6 requirements. Jeff Blank acks and pushes it, thanking Aqueduct for its help.
Be gentle, Aqueduct is all SVN, so still learning the oddities of GIt. That and my eyes started bleeding about 1/2 through this.
[PATCH] more transition notes help
Jeff Blank pushes 'more transition notes help from Gary / Aqueduct', which finishes the RHEL 5→6 transition table. Shawn Wells acks.
And contributions via email are just fine from anybody if you have contributions but aren't familiar with git yet.
[PATCH 0/4] new transforms to enable CCE display, correction, generation
Jeff Blank posts transforms for displaying and checking CCE identifiers and notes that MITRE asked SSG not to ship RHEL 5 CCEs for RHEL 6. Vince acks the series.
Mitre have asked me not to do this and we will not release with these CCEs.
SSG Audit + Aqueduct Remediation Linking
Francisco Slavin of Tresys proposes a JSON-in-<fix> convention that would point SSG rules at external Aqueduct scripts. Steve Grubb wants a simple path from XCCDF to kickstart, Jeff Blank prefers XML, and Gary Gapinski weighs in on schema validity.
At this time our core target is enabling users to use SSG content to audit a system and Aqueduct content to remediate a system.
SSG Audit + Aqueduct Remediation Linking
James Ronayne replies in a separate thread, suggesting an id attribute on <fix> so it could later map onto CRE (Common Remediation Enumeration).
Adding an id (ideally an id unique across across all remediations) provides the option of adding fixtext and makes it easier for us to turn it into a CRE at a later point if we want.
Andrew Gilmore, from a Dept. of Interior agency, sends a drive-by typo patch. Shawn Wells welcomes him and recommends SecState, which does remediation by linking to Aqueduct.
The tool scans the box, can perform remediation (through linking to the Aqueduct project), and outputs pretty HTML to let you know if you have any findings.
SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
Someone pushes back on making SELinux a CAT I finding. Shawn Wells notes the DoD consensus call already lowered it to CAT II. Vince argues the burden belongs on software vendors, not the warfighter, and Tresys's Spencer Shimko calls the app-compatibility worry FUD.
You need to force the Software vendors to adopt Red Hat’s way of security, not the warfighter.
Legacy RHEL systems and SRR/SCAP
Robert Sanders asks how people lock down legacy RHEL 4 systems. Vince says current standards get applied manually at the CA/DAA's discretion, and Shawn Wells shares an old RHEL 4 kickstart.
This is definitely not a standard from DISA, as test plans are dictated by the individual CA / DAA on a case by case basis.
A placeholder for a Red Hat rhos-list thread, 'Aqueduct and RHEL 6', with Christopher M King (Boeing) and Vincent Passaro. No message bodies were recovered.
Brian Millett asks how to add fixes to SSG's XCCDF. Mike Palmiotto points to Tresys's Aqueduct-hosted SSG scripts. Jeff Blank says merging the projects is 'on the radar', and Shawn Wells proposes a native /fixes directory in SSG.
Merger or formal interoperation of the multiple projects involved is on the radar, but it's not there yet.
SCAP Compliance Checker 3.1 Final Release
Shawn Wells asks whether SSG should also ship as a zip for DISA's SCAP Compliance Checker, which can't read /usr/share/xml/scap. Vince and others say yes.
The SCC tool requires that content be packaged in a zip file, and has no current or planned capability to read files from the industry accepted location of /usr/share/xml/scap/*.
Shawn Wells announces DISA's draft RHEL 6 STIG, which grew out of SSG content submitted in October 2012. Vince and Rob Sanders send early feedback. Jeff Blank and Vince then argue over whether Aqueduct's scripts count as 'content'.
A possibility going forward is for RHEL 6 scripts from Aqueduct to be formatted into SCAP or SCAP-like formats (such as XCCDF <fix>es), at which time I'd be quite happy to call it remediation content.
[PATCH] [RFC] Modularized the fix scripts
Shawn Wells's RFC patch puts one fix script per XCCDF rule inside SSG and merges them into the build. Francisco Slavin argues again for external scripts referenced from XCCDF. Jeff Blank acks the patch, says JSON and Perl will meet resistance, and agrees to include simple Bash fixes.
remediation is not the raison d'etre of scap-security-guide. But we're happy to work closely together and include simple bash fixes inside the project.
Shawn Wells formally opens SSG remediation: Bash only, no checks inside scripts, one script per rule, built into the XCCDF, possibly reusing Aqueduct scripts. Over 34 messages the list settles that the final XCCDF must contain the full scripts, and OpenSCAP's <plain-text> handles shared functions.
I think it's important for our final XCCDF to contain the fully working scripts, and not references to JSON, so that OpenSCAP and other SCAP scanners can natively use the content.
Shawn Wells asks for an SSG domain name, floating an invented name 'ala Aqueduct and Accumulo', and says he hopes SSG becomes upstream SCAP content for any platform, with remediation patches welcome.
Currently SSG has RHEL and JBoss content, with the doors open for remediation patches.
[PATCH 0/4] Remediation Templates
Shawn Wells posts remediation templates. Jeff Blank asks to hold off until the OVAL validates, Shawn pushes back, and MITRE's Luis Nunez and Steve Grubb debate CRE.
But still: if the checks aren't any good, then nobody should trust the remediation scripts generated.
[PATCH 4/4] Created service_*_disabled remediation scripts
Shawn Wells posts generated service_*_disabled remediation scripts for SSG. Vince replies, confused, that this isn't what was discussed on the Aqueduct call the day before. Shawn bumps it for ack/nack as preparation for 'a larger remediation effort'.
I'm confused. So remediation content into Scap? Not what was discussed on the Aqueduct call yesterday?
question about fix-common code
Jeff Blank asks about the 'fix-common' function-reuse elements. Francisco Slavin traces them to Mike Palmiotto's SSG-targeted Aqueduct scripts. Asked whether Aqueduct's scripts take parameters, Vince replies that they are hard-coded for RHEL 5.
The scripts in Aqueduct are hard coded (rhel 5).
[PATCH] Removing '\' from audit rule lines to prevent confusion.
Maura Dailey patches the audit-rule prose to drop line-continuation backslashes that break copy-paste. Vince and Shawn ack.
I had caught this and removed the \ from all entries, but in the back of my mind is always, "If I change that, is it going to start failing due to regex looking for it"!
Few more false positives from the RPM content
Leam Hall reports STIG GEN IDs that give false positives. Shawn Wells thanks him and says he'll fork and merge Leam's Aqueduct remediation patches into SSG.
Also noted your remediation patches to Aqueduct. Will work on forking/merging them into the SSG content (great work on those!!)
[PATCH 08/22] Added remediation
In reply to one of Shawn Wells's SSG remediation patches, Leam Hall explains that Aqueduct makes backup copies of changed files. Jeff Blank and Shawn discuss kickstart generation and roughly 200 changes from a default install.
One of the things I'm doing with Aqueduct is ensuring that we make backup copies of files.
RHEL5 vs RHEL6 language on HBSS (UNCLASSIFIED)
A fragment of a larger HBSS thread: Randall Beavers and Vince agree that HBSS and SELinux together cause problems on real systems.
Having both SELinux and HBSS installed will often bring a system to its knees, it would be ideal to only require one or the other.
Frank Caviggia starts on SSG fixes and asks about whole-file replacement and backups. Shawn Wells prefers native tools and suggests Augeas suits Aqueduct, Chad Truhn sets out remediation requirements, and Steve Grubb previews OpenSCAP-Anaconda integration for RHEL 7.
Augeas and puppet would be great, their downside is they don't ship natively with RHEL :( Part of the goal is to enable the remediation with native tooling first. IMO, Augeas scripts would be *fantastic* for Aqueduct!
Shawn Wells opens the RHEL 7 kickoff call to the community; such calls were previously limited to Red Hat, NSA, and DISA FSO. Leam Hall asks what SSG's script remediation does that Aqueduct doesn't, and Steve Grubb answers: SSG fixes feed the Anaconda installer.
What is SSG doing for script based remediation that Aqueduct isn't?
Seeking feedback on GovReady - tools for government-ready configurations of software
Greg Elin, funded by the Knight Foundation, introduces GovReady. Shawn Wells asks how it differs from existing hardening scripts 'e.g. Aqueduct and github.com/redhatgov', and Greg answers at length.
More than anything I hoped that I could use SSG and Aquaduct to make it a snap to give people accreditation-ready virtual machines
RHEL 7 as guest in VMware Fusion 6 and Workstation 10 Environments
Christopher Kachigian reports RHEL 7 crashing on install under VMware Fusion and Workstation. Vince, now signing as founder of Buddha Labs, hit the same problem; others report KVM and VirtualBox work.
Ran into the same issue. Retrying ended up successfully installing.
Jared Jennings, a contractor at the US Air Force SEEK EAGLE Office, introduces CMITS, a Puppet-based STIG compliance kit, and offers to help with RHEL 7. Shawn Wells shares DISA FSO's OS SRG requirements for RHEL 7.
The actual RHEL 7 STIG, if it follows RHEL 6 timelines, will be out right before RHEL 8.
Remediation advice for RHEL 5 and 6
Asked where to start on STIG remediation, Vince recommends Aqueduct and asks why Red Hat employees forked Aqueduct's Bash into stig-fix. Frank Caviggia explains where the code came from, and Shawn Wells writes a long first-person account of deciding to 'forge ahead' without Aqueduct, with an apology. Vince replies with a code-based rebuttal.
When it came to the matter of "integrate or forge ahead," and in order for progress to be made, I had to make a decision. It was to forge ahead.
What carried forward from Aqueduct into ComplianceAsCode and CLIP
Aqueduct stopped in 2014. Its content didn’t. These are the places it went, in the words of their own commit logs.
- Bash
- 1,255 scripts
- Puppet
- 23 modules
- Ansible
- 1 role
Counts from the BuddhaLabs/Aqueduct repository, 2013–2014.
SCAP Security Guide (now ComplianceAsCode)
2011 → todaySCAP Security Guide, the project now called ComplianceAsCode, started as the checking half and left the fixing to Aqueduct. When it built its own per-rule Bash fixes in 2013, it built them so Aqueduct contributors could write them, and later fixes were based on Aqueduct scripts.
Tresys CLIP
2012Shipped Aqueduct inside hardened RHEL install media: SSG found the problem, Aqueduct fixed it during the kickstart.
Red Hat stig-fix-el6
2013–2014Red Hat public-sector hardening builds, now fcaviggia/hardening-script-el6. Their sources list the Aqueduct Project by name.
Forks and write-ups
2014Puppet forks and an Ansible how-to built on the RHEL 6 scripts.
Questions about Aqueduct
What was Aqueduct?
Aqueduct (2011–2014) was an open-source project, created by Vincent Passaro on Fedora Hosted, that published Bash, Puppet and Ansible scripts to fix DISA STIG findings on Red Hat Enterprise Linux 5 and 6, one script per finding. It supplied the remediation half while SCAP Security Guide, now called ComplianceAsCode, supplied the checks.
Who created Aqueduct?
Vincent Passaro created Aqueduct in 2011 on Fedora Hosted and wrote most of its DISA STIG Bash content: 550 of its 734 RHEL 5 scripts name him as initial author. Shannon Mitchell, Leam Hall, Maura Dailey and Bill Carlson also contributed.
How did Aqueduct relate to SCAP Security Guide (ComplianceAsCode)?
They started as partners. SCAP Security Guide wrote the checks and, in October 2011, removed its own deployment files because "Aqueduct is the place for that." In 2013 SSG chose to embed short per-rule Bash fixes inside its own XCCDF content instead of linking to Aqueduct's larger STIG scripts. Red Hat's Shawn Wells later wrote that "many of the remediation scripts originated from Aqueduct."
How much did Aqueduct improve STIG compliance?
In October 2012 Shawn Wells of Red Hat scanned a RHEL 5 system with oscap against DISA's RHEL 5 V1R1 benchmark (350 rules). Passing checks rose from 198 (57%) before Aqueduct to 278 (80%) after, and the script run took 3 minutes 12 seconds.
Why did Aqueduct use Bash instead of Puppet?
Bash shipped on every RHEL system, while Puppet needed a paid license to meet the vendor-support rule some Navy and Marine Corps programs followed. In 2012 Vincent Passaro wrote that "using bash encourages more contributions from the community." Puppet modules for the RHEL 6 STIG were added in 2013 and an Ansible role in 2014.
What happened to Aqueduct?
The code moved from Subversion to Git in May 2013 and to GitHub as BuddhaLabs/Aqueduct in December 2013. The last commit was on 17 October 2014. Fedora later retired fedorahosted.org, taking the wiki, Subversion history and private mailing list with it. The GitHub repository, public list archives and Wayback Machine captures survive.
Can I still use Aqueduct to STIG a RHEL system?
Aqueduct's scripts target the RHEL 5 and RHEL 6 STIGs and have not been updated since October 2014. Its approach of shipping a fix with each check continued in SCAP Security Guide, which first shipped in RHEL 6.6 in 2014 and is now maintained as ComplianceAsCode.
Aqueduct the STIG project is unrelated to the WRI Aqueduct water-risk atlas and to the software tools that share the name.
Sources
- · Shawn Wells, “So, you wanna STIG a RHEL5 box? Part 2: Using the Aqueduct Project” (Wayback Machine)
- · Red Hat, government standards page (Wayback Machine)
- · BuddhaLabs/Aqueduct on GitHub, Git history from 31 May 2013
- 2011–2014 · scap-security-guide mailing-list archive
- 2011–2014 · ComplianceAsCode/content commit history
- Wikidata · Aqueduct (Q142081065)