The publicly accessible Dragos Platform application must display the Standard Mandatory DOD Notice and Consent Banner before granting access to Dragos Platform.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-270917	DRAG-OT-000220	SV-270917r1058026_rule		Medium

Description

STIG	Date
Dragos Platform 2.x Security Technical Implementation Guide	2024-12-23

Details

Check Text (C-74960r1057392_chk)

Verify that the Standard Mandatory DOD Notice and Consent Banner appears before being granted access to Dragos Platform UI.

If the Standard Mandatory DOD Notice is not presented, this is a finding.

Fix Text (F-74861r1058026_fix)

1. Download the following script and put it in the /root directory on the sitestore where the DOD Banner is to be applied (see below).

2. Run the script with the following syntax:
python3 DOD_Banner_Config_Utility.py, and go to the sitestore login page to verify the banner is present.

3. Schedule the cron with the following syntax to ensure the change survives reboots:
5 * * * * python3 /root/DOD_Banner_Config_Utility.py --persist-banner

DOD_Banner_Config_Utility.py

Utility: import os, json, sys, time
# Created by bdudley@dragos.com to assist with Dragos STIG implementation
# specifically related to DoD Banner for web UI before login
os.chdir("/root")
# version compatibility check
if 'Platform Version: 2.4.' not in os.popen("dragoscmd version").read():
print("This version of the Dragos platform is incompatible with this script.")
exit()
DOD_BANNER_JS = "alert('You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.');"
fstream = open('banner.js', 'w')
fstream.write(DOD_BANNER_JS)
fstream.close()
# get the platform-ui container id
platformui = os.popen("kubectl get pods | grep platform-ui | grep -v platform-ui-logger | awk '{print $1}'").read().strip()
BANNER_DIR = '/usr/share/nginx/html/source/'
HTML_DIR = '/usr/share/nginx/html/'
if "--restore-defaults" in sys.argv:
print("Restoring to default, no banner.")
os.system("kubectl -n dragos-sitestore cp ./index.html.bak "+platformui+":"+HTML_DIR+"index.html")
print("Done, reload the page to test changes.")
exit()
# this will check periodically to make sure the banner changes persisted, and re-apply them if not
if "--persist-banner" in sys.argv:
# check the current settings
current_html = os.popen("curl -k https://localhost").read()
if "./source/banner.js" in current_html:
print("Banner is currently set, taking no action.")
exit()
else:
fstream = open("banner.log", "a")
fstream.write("["+time.ctime().replace(" ", "")+"] banner was not set, setting banner now.\n")
fstream.close()
# put the banner js file in the appropriate directory
os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js")
# update the current version of index.html in the pod
os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html")
exit()
# is the sitestore up and running?
if "System is ready." not in os.popen("dragoscmd system k3s status").read():
print("System is not ready, wait until all pods are started before configuring banner.")
exit()
# is there a backup of the old index.html file
if os.path.exists('index.html.bak') == False:
print("Creating an index.html backup...")
os.system("kubectl -n dragos-sitestore cp "+platformui+":"+HTML_DIR+"index.html ./index.html.bak")
print("Done.")
# put the banner js file in the appropriate directory
os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js")
# perform appropriate patching on the index.html backup
fstream = open("index.html.bak", "r")
html = fstream.read()
fstream.close()
original = '<script nonce="**CSP_NONCE**" type="module" crossorigin'
replacement = '<script src="./source/banner.js" nonce="**CSP_NONCE**"></script><script nonce="**CSP_NONCE**" type="module" crossorigin'
fstream = open("index.html.patched", "w")
fstream.write(html.replace(original, replacement))
fstream.close()
# update the current version of index.html in the pod
os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html")
print("Banner configuration changes complete, reload the login page (or logout) to see the popup. If the formatting for the popup needs to be adjusted, make the changes in the banner block above and re-run this script.")
print("\nUse the below format to create a cron that makes the banner persist through reboots:\n\n*/5 * * * * python3 /root/DOD_Banner_Config_Utility.py --persist-banner\n\n")