Message-ID: <2015917839.1133.1585775492048.JavaMail.confluence1@skald> Subject: Exported From Confluence MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_Part_1132_1670072606.1585775492048" ------=_Part_1132_1670072606.1585775492048 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Location: file:///C:/exported.html Baselines


*/#Baselines-Introduction#= Baselines-IntroductionHowDoesitWork?#Baselines-H">


Being able to determine which machines are configured in the same way is= a major part of systems administration and auditing =E2=80=93 and now repo= rting on that will be made simple and automated. Once you define your basel= ine it will automatically run against a set of devices on a predetermined s= chedule. The output of these executed baselines will be available for web v= iewing, importing into a third party system or even as a printed report.

How Does it Work?

Baselines enable you to combine audit data with a set of attributes you = have previously defined (your baseline) to determine compliance of devices.=

For example - you might create a baseline from a device running Centos 6= which acts as one of your Apache servers in a cluster. You know this parti= cular server is configured just the way you want it but you're unsure if ot= her servers in the cluster are configured exactly the same. Baselines enabl= es you to determine this.

You can create a baseline, run it against a group of devices and view th= e results, add scheduled execution, add more tables for comparison (current= ly only software, netstat ports and users are enabled), in place baseline e= diting, archiving of results and more.

WARNING - When creating a ba= seline using software policies, at present Centos and RedHat package the ke= rnel using the names 'kernel' and 'kernel-devel'. There can be multiple pac= kages with this name and different versions concurrently installed. Debian = based distributions use names like 'linux-image-3.13.0-24-generic', note th= e version number is included in the package name. Because RedHat based OS's= use this format and subsequently have multiple identical package names wit= h different versions we currently exclude 'kernel' and 'kernel-devel' from = software policies. This may be addressed in a future update.=


Baselines can compare netstat ports, users and software.


To compare software we check the name and= version. Because version numbers are not all standardised in format, when = we receive an audit result we create a new attribute called software_padded= which we store in the database along with the rest of the software details= for each package. For this reason, baselines using software policies will = not work when run against a device that has not been audited by 1.10 (at le= ast). Software policies can test against the version being "equal to", "gre= ater than" or "equal to or greater than".

Netstat Po= rts

Netstat Ports use a combination of port n= umber, protocol and program. If all are present the policy passes.


Users work similar to Netstat Ports. If a= user exists with a matching name, status and password details (changeable,= expires, required) then the policy passes.

Creating a Baseline Defini= tion

A baseline can be created using the web interface if a user has a role t= hat contains the baselines::create permission. Go to menu: Manage -> Bas= elines -> Create Baselines. There is also a create button on the collect= ion page.

You must enter a (preferably unique) name.

Type in a hostname and click Search to populate the dropdown to enable y= ou to choose a device to extract policies from.

Choose a device from the drop down, a table from the dropdown and a comp= arison operator.

The comparison operator only really works for software at this stage. Bo= th netstat ports and users work on the principle of it exists so it must ma= tch.

Software though compares the package name and version. If you would like= the policy to test for SSH "at least" version 1.2.3, click the "Equals or = Greater Than" comparison operator. Checking if a name and version match exa= ctly, click the "Equals" operator.

Once you click Submit, the baseline will be created and the policies wil= l be added. You will then be sent to the Edit Baseline screen where you can= add further policies from a device if required.

Executing a Baseline Defi= nition

Once you have created your baseline and added some policies, you can exe= cute it against a group of devices. When executing a baseline, bear in mind= that baselines will only really provide useful information when the polici= es are matched to the specific operating system the baseline is executed ag= ainst. IE - Don't create a baseline and add policies form a Windows Server = and expect a group of devices containing Debian computers to match anything= !

From the Baseline list page, click on the Execute button. The next scree= n will enable you to choose a group of devices to execute the baseline on.<= /p>

Once a baseline has been executed you will be directed to the baseline r= esults page. This page lists all the results from any given baseline.

Clicking the Results button will show you the results from this particul= ar baseline result.

From the result page you can click an individual policy or device to vie= w more details.

The policy detailed result is below.

The device detailed result is below.

The results can be exported by policy or by devices, a CSV file will be gen= erated.

API / Web Access

Baselines do not at this time support the JSON API. This will be enabled= in a future release.