bug in use audit with goss >0.4.x

[sysop200]

There are plans to rework the audit to work with goss version >0.4.x
When using version >0.4.x, the field does not contain the correct queries:
"matcher-result": {

"Actual": "object: *bytes.Reader",

"Expected": [
"/^MaxAuthTries [1-4]/",
"!/^MaxAuthTries [5-9]/"
],
"ExtraElements": null,
"Message": "to have patterns",
"MissingElements": [
"/^MaxAuthTries [1-4]/"

created an issue in the developer's repository
goss-org/goss#845

[uk-bolly]

hi @sysop200

Thank you for raising this issue. We are currently working on other repositories. We are aware of the 0.4 change.
We have already rewritten one audit to allow this to work.
I will test and look at this further and discuss with goss owner to go through with them.

Many thanks

uk-bolly

[sysop200]

Hi, I am very glad that this is not only my problem and you are also interested in it. I will wait for this decision.
Best regards!

[sysop200]

Hmm... With the new version of goss this test does not work at all. it's a pity. We need to review all the tests again.
audit_sysop.4check.ru_1700413601.json

[uk-bolly]

I'm working my way through the audits. The priority currently is client requirements. Hopefully not much longer we can get this done. Thanks uk-bolly

…

On Sun, 19 Nov 2023, 17:11 Michael Nekhoroshev, ***@***.***> wrote: Hmm... With the new version of goss this test does not work at all. it's a pity. We need to review all the tests again. audit_sysop.4check.ru_1700413601.json <https://github.com/ansible-lockdown/RHEL8-CIS-Audit/files/13403926/audit_sysop.4check.ru_1700413601.json> — Reply to this email directly, view it on GitHub <#53 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQQCCXLEQJFSFOGNQBRQAWTYFI4THAVCNFSM6AAAAAA5T4HDQGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJXHEYTSNBZHA> . You are receiving this because you were assigned.Message ID: ***@***.***>

[sysop200]

I do not insist. Thank you so much for the inspiration with your set of scripts. Very necessary in the work of a security officer

[uk-bolly]

hi @sysop200

Apologies it has taken so long to get back to you. There was a new release of CIS shortly after our discussion, there is a new benchmark v3.0, which required an almost complete rewrite of both this audit and the remediate this is compatible with the 0.4x version of the goss binary.

Kindest regards

uk-bolly

[sysop200]

Thanks a lot! I had to edit the configurations myself. But I’ll take your version and compare it with mine again, maybe I missed any mistakes on my part. There is a very lack of language support. I'm working on it now.

[uk-bolly]

hi @sysop200

Ive seen the discussions on the goss repo. We happy to close this issue off, while the source is fixed?

many thanks

uk-bolly

[uk-bolly]

HI @sysop200

Great update from on the goss issue. Looks like a fix that we can try to add in. goss-org/goss#845

Already got the ball rolling internally to assign the time.

Will try and make this the first repo and see how we get on.

Thanks

uk-bolly