ArubaOS Compliance Checks

Check Type

All ArubaOS compliance checks must be bracketed with the check_type encapsulation with the ArubaOS designation:

<check_type:"ArubaOS">

...

</check_type>

This is required to differentiate ArubaOS .audit files from those intended for other platforms.

Checks

The following sections describe the checks you can add to a single audit file.

BANNER_CHECK

This policy item checks if the registry item or file content matches the content provided by normalizing the values to use common newline, escaping patterns, and stripping white space from the beginning and end of policy text.

Usage

<custom item>

type: BANNER_CHECK

description: ["description"]

item: ["config item"]

content: ["banner content"]

(optional) is_substring: [YES|NO]

</custom item>

content

The content is what the expected banner should be. New lines in the banner are automatically processed through functions that determine delimiters and context.

is_substring

An optional flag that supports the possibility of location specific information being placed in a banner. If set to YES, the expected banner can be a substring of the file content, and not require a full match.

Examples

<custom item>

type : BANNER_CHECK

description : "banner motd is configured"

item : "banner motd"

content : "** No unauthorized access is allowed **"

This device is monitored and all activity is logged

Proceed with caution!"

</custom item>

<custom item>

type : BANNER_CHECK

description : "banner exec is configured"

item : "banner exec"

content : "No unauthorized access is allowed\nBy logging in you \"agree\" to the terms of usage.\All activity is monitored and logged."

</custom item>

CONFIG_CHECK and CONFIG_CHECK_NOT

The CONFIG_CHECK check analyzes the configuration for regular expressions to identify if a configuration is set.

The CONFIG_CHECK_NOT check gives the opposite result as CONFIG_CHECK, and analyzes the configuration to identify if a regular expression is not present, which indicates the configuration is not set.

Usage

<custom_item>

type : CONFIG_CHECK

description : ["description"]

(optional) context : ["regular expression to create contexts"]

(optional) regex : ["regular expression to reduce config options"]

item : ["regular expression of text that needs to be found"]

(optional) match_all : [YES|NO]

(optional) match_case : [YES|NO]

(optional) min_occurrences : ["numerical value"]

(optional) max_occurrences : ["numerical value"]

</custom_item>

context

(Optional) The context is a regular expression that returns one or more subsets of the configuration. When the context matches a line, it returns that line and any other lines directly below it that are indented more than the initial matching line. Multiple contexts can be used to narrow down then searchable configuration.

Contexts are evaluated independently. If one context fails, the entire check evaluation fails.

Contexts are defined as code in the following format:

context-1

line item 1

line item 2

context-2

line item 1

line item 2

regex

(Optional) The regex is used to filter the full configurations, or each of the context configurations, to a smaller set of lines of text based on the regular expression. Multiple regex can be used to narrow down the searchable configuration, and they are applied in the order that they are listed in the check.

item

The evaluation is based on item.

  • For CONFIG_CHECK, if the regular expression in the item matches a line of text, the check results as PASSED. If there are no matches, the check results as FAILED.
  • For CONFIG_CHECK_NOT, if the regular expression in the item matches a line of text, the check results as FAILED. If there are no matches, the check results as PASSED.

To indicate if all lines need to match or that lines are case-sensitive, use the modifiers match_all or match_case.

match_all

(Optional) Setting match_all to YES requires the item to match all lines of text, and not just a single line of text. If match_all is set to the default NO, only one line must match for the check to pass.

match_case

(Optional) Setting match_case to YES makes the comparison case sensitive. If match_case is set to the default NO, the comparison is case insensitve.

min_occurrences

Specifies the minimum number of occurrences of the configuration item required to pass the audit.

This is useful in cases where a minimum number of servers (NTP, DNS, etc.) should be present.

Example:

min_occurrences: "3"

max_occurrences

Specifies the maximum number of occurrences of the configuration item allowed to pass the audit.

This is useful in cases when checking items such as a single local account should exist (account of last resort).

Example:

max_occurrences: "1"

Example

<custom_item>

type : CONFIG_CHECK

description : "Ensure telnet is disabled"

item : "no telnet-server"

</custom_item>

<custom_item>

type : CONFIG_CHECK_NOT

description : "Verify common SNMP strings are not used"

regex : "snmp-server community"

item : "(public|readonly|write)"

match_case: NO

</custom_item>

CMD_EXEC

The CMD_EXEC check runs a command and analyze the output with regular expressions to identify if a command matches the expected output.

If CMD_EXEC is used in an offline scan, a warning states that the command is not able to run in offline mode.

Usage

<custom_item>

type : CMD_EXEC

description : ["description"]

cmd : ["command to run"]

(optional) regex : ["regular expression to reduce config options"]

expect : ["regular expression that passes if found"]

not_expect : ["regular expression that passes if not found"]

(optional) match_all : [YES|NO]

(optional) match_case : [YES|NO]

</custom_item>

Keywords

cmd

The cmd is the command that should be run on the target. Only show commands are supported.

regex

(Optional) (Optional) The regex is used to filter the full configurations, or each of the context configurations, to a smaller set of lines of text based on the regular expression. Multiple regex can be used to narrow down the searchable configuration, and they are applied in the order that they are listed in the check.

expect or not_expect

The evaluation is based on expect or not_expect. Use only one of these fields in a check.

  • For expect, if the regular expression matches a line of text, the check results as PASSED. If there are no matches, the check results as FAILED.
  • For not_expect, if the regular expression matches a line of text, the check results as FAILED. If there are no matches, the check results as PASSED.

To indicate if all lines need to match or that lines are case-sensitive, use the modifiers match_all or match_case.

match_all

(Optional) (Optional) Setting match_all to YES requires the item to match all lines of text, and not just a single line of text. If match_all is set to the default NO, only one line must match for the check to pass.

match_case

(Optional) (Optional) Setting match_case to YES makes the comparison case sensitive. If match_case is set to the default NO, the comparison is case insensitve.

Example

<custom_item>

type : CMD_EXEC

description : "Ensure '3ds-cbc' is disabled for SSH access"

cmd : "show running-config all"

regex : "ssh server encryption"

expect : "ssh server encryption 3des-cbc disable"

</custom_item>