Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

Audit default_off rulesets #9842

Closed
cschanaj opened this issue May 8, 2017 · 13 comments
Closed

Audit default_off rulesets #9842

cschanaj opened this issue May 8, 2017 · 13 comments
Labels
good volunteer task

Comments

@cschanaj
Copy link
Collaborator

cschanaj commented May 8, 2017 •
edited
Loading

Type: ruleset issue

Domain: *

Similar to #9582, I suspect 168 out of 537 default_off="self-signed" rulesets can be re-activated. I added a date to PRs which haven't been merge after being reviewed for a long time.

Self-signed

HSTS

Qualified but not preloaded

  • tr0n.net

HSTS Preloaded

HSTS

Strict-Transport-Security: max-age >= 10886400; includeSubDomains

HSTS

Strict-Transport-Security: max-age < 10886400; includeSubDomains

local issuser certificates
This was referenced May 8, 2017
Merged
Merged
Merged
Merged
Merged
@Bisaloo
Copy link
Collaborator

Bisaloo commented May 8, 2017

#9409

@Bisaloo
Copy link
Collaborator

Bisaloo commented May 8, 2017 •
edited
Loading

For your script, you should note that sometimes several reasons are listed for default_off. Do you currently catch such rulesets?

For example, WorkWithColor.xml (although it is maybe not the best example as it is still broken but you get the idea).

@cschanaj
Copy link
Collaborator Author

cschanaj commented May 8, 2017 •
edited
Loading

@Bisaloo You are right, the same hold true for #9582. The script I use now only check if default_off="self-signed" is a full-match.

I can make a generic script such that it works when we would like to audit on mismatch, cacert, self-signed etc (maybe tonight).

P.S. If you don't care about the terrible performance, you can do

grep -il 'default_off=\".*self-signed.*\"' *.xml

in the corresponding directory.

@cschanaj cschanaj mentioned this issue May 8, 2017
Merged
@cschanaj
Copy link
Collaborator Author

cschanaj commented May 8, 2017

You can now refer to the newly created script on GIST. (Performance-wise I believe it can be further optimized). To use the script, you need to set the KEYWORD variable, for example

$ export KEYWORD="self-signed"
$ ./audit.sh

P.S. I will update the above list accordingly.

@cschanaj cschanaj mentioned this issue May 8, 2017
Merged
@Bisaloo Bisaloo mentioned this issue May 8, 2017
Merged
This was referenced May 9, 2017
Merged
Merged
Merged
Merged
Merged
Merged
@Bisaloo Bisaloo mentioned this issue May 9, 2017
Merged
This was referenced May 9, 2017
Merged
Merged
Merged
Merged
Closed
@Bisaloo Bisaloo mentioned this issue May 10, 2017
Merged
This was referenced May 10, 2017
Merged
Merged
This was referenced May 10, 2017
Merged
Merged
Merged
This was referenced Jun 8, 2017
Merged
Merged
Merged
Merged
Merged
Merged
Merged
This was referenced Jun 13, 2017
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
@jeremyn jeremyn mentioned this issue Jun 21, 2017
Merged
@jeremyn jeremyn mentioned this issue Jul 1, 2017
Closed
@cschanaj cschanaj mentioned this issue Jul 2, 2017
Merged
This was referenced Jul 15, 2017
Merged
Merged
Merged
Merged
@Bisaloo Bisaloo mentioned this issue Jul 25, 2017
Merged
@jeremyn jeremyn mentioned this issue Dec 12, 2017
Closed
@https-everywhere-bot
Copy link

I still don't see the type of issue in your description. Can you edit your issue to add this (perhaps referring to the issue template?)

@https-everywhere-bot
Copy link

Thanks! Your edit helped me out. I'll take it from here now.

@J0WI
Copy link
Contributor

J0WI commented Jun 15, 2018

Can we close this in favor of smaller issues (e.g. #13290, #13176, #13088)?

@cschanaj
Copy link
Collaborator Author

@J0WI I agree. let's close this in favor of small issues 😄

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
good volunteer task
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@J0WI @Bisaloo @cschanaj