Check Type: CONFIG_CHECK
NetApp compliance checks are bracketed in custom_item
encapsulation and CONFIG_CHECK. This is treated like any other .audit
files and work for systems running the NetApp Data ONTAP system. The CONFIG_CHECK check consists of two or more keywords. Keywords type
and description
are mandatory, which are followed by one or more keywords. The check works by auditing the “options” command output.
Keywords
The following table indicates how each keyword in the NetApp Data ONTAP compliance checks can be used:
Keyword |
Example Use and Supported Settings |
---|---|
type |
“CHECK_CONFIG” determines if the specified config item exists in the NetApp Data ONTAP “show configuration” output. |
description |
This keyword provides the ability to add a brief description of the check that is being performed. It is strongly recommended that the Example: description: "1.0 Require strong Password Controls - 'min-password-length >= 8'" |
info |
The Note: Each Example: info: "Enable palindrome-check on passwords" |
severity |
The Example: severity: MEDIUM The severity can be set to HIGH, MEDIUM, or LOW. |
regex |
The Example: regex: "set snmp .+" The following meta-characters require special treatment: Escape these characters out twice with two backslashes “\\” or enclose them in square brackets “[]” if you wish for them to be interpreted literally. Other characters such as the following need only a single backslash to be interpreted literally: . ? " ' This has to do with the way that the compiler treats these characters. If a check has “regex” tag set, but no “expect” or “not_expect” or “number_of_lines” tag is set, then the check simply reports all lines matching the regex. |
expect |
This keyword allows auditing the configuration item matched by the The check passes as long as the config line found by Example: regex: "set password-controls complexity" expect: "set password-controls complexity [1-4]" In the above case, the |
not_expect |
This keyword allows searching the configuration items that should not be in the configuration. It acts as the opposite of Example: regex: "set password-controls password-expiration" not_expect: "set password-controls password-expiration never" In the above case, the |
Example
The following is an example of using CONFIG_CHECK against a NetApp Data ONTAP device:
<custom_item>
type: CONFIG_CHECK
description: "1.2 Secure Storage Design, Enable Kerberos with NFS - 'nfs.kerberos.enable = on'"
info: "NetApp recommends the use of security features in IP storage protocols to secure client access"
solution: "Enable Kerberos with NFS"
reference: "PCI|2.2.3"
regex: "nfs.kerberos.enable[\\s\\t]+"
expect: "nfs.kerberos.enable[\\s\\t]+on"
</custom_item>