The publicly accessible Dragos Platform application must display the Standard Mandatory DOD Notice and Consent Banner before granting access to Dragos Platform.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-270917	SRG-APP-000070	DRAG-OT-000220	SV-270917r1058026_rule	2024-12-23	1

Description
Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for desktops, laptops, and other devices accommodating banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

Description

Display of a standardized and approved use notification before granting access to the publicly accessible application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for desktops, laptops, and other devices accommodating banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

ℹ️ Check
Verify that the Standard Mandatory DOD Notice and Consent Banner appears before being granted access to Dragos Platform UI. If the Standard Mandatory DOD Notice is not presented, this is a finding.

✔️ Fix
1. Download the following script and put it in the /root directory on the sitestore where the DOD Banner is to be applied (see below). 2. Run the script with the following syntax: python3 DOD_Banner_Config_Utility.py, and go to the sitestore login page to verify the banner is present. 3. Schedule the cron with the following syntax to ensure the change survives reboots: 5 * * * * python3 /root/DOD_Banner_Config_Utility.py --persist-banner DOD_Banner_Config_Utility.py Utility: import os, json, sys, time # Created by bdudley@dragos.com to assist with Dragos STIG implementation # specifically related to DoD Banner for web UI before login os.chdir("/root") # version compatibility check if 'Platform Version: 2.4.' not in os.popen("dragoscmd version").read(): print("This version of the Dragos platform is incompatible with this script.") exit() DOD_BANNER_JS = "alert('You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.');" fstream = open('banner.js', 'w') fstream.write(DOD_BANNER_JS) fstream.close() # get the platform-ui container id platformui = os.popen("kubectl get pods \| grep platform-ui \| grep -v platform-ui-logger \| awk '{print $1}'").read().strip() BANNER_DIR = '/usr/share/nginx/html/source/' HTML_DIR = '/usr/share/nginx/html/' if "--restore-defaults" in sys.argv: print("Restoring to default, no banner.") os.system("kubectl -n dragos-sitestore cp ./index.html.bak "+platformui+":"+HTML_DIR+"index.html") print("Done, reload the page to test changes.") exit() # this will check periodically to make sure the banner changes persisted, and re-apply them if not if "--persist-banner" in sys.argv: # check the current settings current_html = os.popen("curl -k https://localhost").read() if "./source/banner.js" in current_html: print("Banner is currently set, taking no action.") exit() else: fstream = open("banner.log", "a") fstream.write("["+time.ctime().replace(" ", "")+"] banner was not set, setting banner now.\n") fstream.close() # put the banner js file in the appropriate directory os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js") # update the current version of index.html in the pod os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html") exit() # is the sitestore up and running? if "System is ready." not in os.popen("dragoscmd system k3s status").read(): print("System is not ready, wait until all pods are started before configuring banner.") exit() # is there a backup of the old index.html file if os.path.exists('index.html.bak') == False: print("Creating an index.html backup...") os.system("kubectl -n dragos-sitestore cp "+platformui+":"+HTML_DIR+"index.html ./index.html.bak") print("Done.") # put the banner js file in the appropriate directory os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js") # perform appropriate patching on the index.html backup fstream = open("index.html.bak", "r") html = fstream.read() fstream.close() original = '<script nonce="CSP_NONCE" type="module" crossorigin' replacement = '<script src="./source/banner.js" nonce="CSP_NONCE"></script><script nonce="CSP_NONCE" type="module" crossorigin' fstream = open("index.html.patched", "w") fstream.write(html.replace(original, replacement)) fstream.close() # update the current version of index.html in the pod os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html") print("Banner configuration changes complete, reload the login page (or logout) to see the popup. If the formatting for the popup needs to be adjusted, make the changes in the banner block above and re-run this script.") print("\nUse the below format to create a cron that makes the banner persist through reboots:\n\n/5 * * * python3 /root/DOD_Banner_Config_Utility.py --persist-banner\n\n")

✔️ Fix

1. Download the following script and put it in the /root directory on the sitestore where the DOD Banner is to be applied (see below). 2. Run the script with the following syntax: python3 DOD_Banner_Config_Utility.py, and go to the sitestore login page to verify the banner is present. 3. Schedule the cron with the following syntax to ensure the change survives reboots: 5 * * * * python3 /root/DOD_Banner_Config_Utility.py --persist-banner DOD_Banner_Config_Utility.py Utility: import os, json, sys, time # Created by bdudley@dragos.com to assist with Dragos STIG implementation # specifically related to DoD Banner for web UI before login os.chdir("/root") # version compatibility check if 'Platform Version: 2.4.' not in os.popen("dragoscmd version").read(): print("This version of the Dragos platform is incompatible with this script.") exit() DOD_BANNER_JS = "alert('You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.');" fstream = open('banner.js', 'w') fstream.write(DOD_BANNER_JS) fstream.close() # get the platform-ui container id platformui = os.popen("kubectl get pods | grep platform-ui | grep -v platform-ui-logger | awk '{print $1}'").read().strip() BANNER_DIR = '/usr/share/nginx/html/source/' HTML_DIR = '/usr/share/nginx/html/' if "--restore-defaults" in sys.argv: print("Restoring to default, no banner.") os.system("kubectl -n dragos-sitestore cp ./index.html.bak "+platformui+":"+HTML_DIR+"index.html") print("Done, reload the page to test changes.") exit() # this will check periodically to make sure the banner changes persisted, and re-apply them if not if "--persist-banner" in sys.argv: # check the current settings current_html = os.popen("curl -k https://localhost").read() if "./source/banner.js" in current_html: print("Banner is currently set, taking no action.") exit() else: fstream = open("banner.log", "a") fstream.write("["+time.ctime().replace(" ", "")+"] banner was not set, setting banner now.\n") fstream.close() # put the banner js file in the appropriate directory os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js") # update the current version of index.html in the pod os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html") exit() # is the sitestore up and running? if "System is ready." not in os.popen("dragoscmd system k3s status").read(): print("System is not ready, wait until all pods are started before configuring banner.") exit() # is there a backup of the old index.html file if os.path.exists('index.html.bak') == False: print("Creating an index.html backup...") os.system("kubectl -n dragos-sitestore cp "+platformui+":"+HTML_DIR+"index.html ./index.html.bak") print("Done.") # put the banner js file in the appropriate directory os.system("kubectl -n dragos-sitestore cp ./banner.js "+platformui+":"+BANNER_DIR+"banner.js") # perform appropriate patching on the index.html backup fstream = open("index.html.bak", "r") html = fstream.read() fstream.close() original = '<script nonce="**CSP_NONCE**" type="module" crossorigin' replacement = '<script src="./source/banner.js" nonce="**CSP_NONCE**"></script><script nonce="**CSP_NONCE**" type="module" crossorigin' fstream = open("index.html.patched", "w") fstream.write(html.replace(original, replacement)) fstream.close() # update the current version of index.html in the pod os.system("kubectl -n dragos-sitestore cp ./index.html.patched "+platformui+":"+HTML_DIR+"index.html") print("Banner configuration changes complete, reload the login page (or logout) to see the popup. If the formatting for the popup needs to be adjusted, make the changes in the banner block above and re-run this script.") print("\nUse the below format to create a cron that makes the banner persist through reboots:\n\n*/5 * * * * python3 /root/DOD_Banner_Config_Utility.py --persist-banner\n\n")