[PATCH 00/13] Added CCI references
by Willy Santos
This batch of commits adds rule references to CCI numbers.
Willy Santos (13):
Mapped CCI-000199 to password_max_age
Mapped CCI-000200 to limit_password_reuse
Mapped CCI-000205 to password_min_len
Mapped CCI-000206 to acccounts group.
Mapped CCI-000352 to ensure_gpgcheck_globally_activated and
ensure_gpgcheck_never_disabled
Mapped CCI-000416 to aide_periodic_cron_checking
Mapped CCI-000803 to sshd_use_approved_ciphers
Mapped CCI-000888 to ssh_server group.
Mapped CCI-000195 to password_require_diffchars
Mapped CCI-000196 to no_hashes_outside_shadow
Mapped CCI-000197 to ssh_server group
Mapped CCI-000198 to password_min_age
Mapped CCI-001118 to enable_iptables and enable_ip6tables rules
rhel6/src/input/services/ssh.xml | 3 +++
rhel6/src/input/system/accounts/accounts.xml | 1 +
rhel6/src/input/system/accounts/pam.xml | 2 ++
.../accounts/restrictions/password_expiration.xml | 3 +++
.../accounts/restrictions/password_storage.xml | 1 +
rhel6/src/input/system/network/iptables.xml | 2 ++
rhel6/src/input/system/software/integrity.xml | 1 +
rhel6/src/input/system/software/updating.xml | 2 ++
8 files changed, 15 insertions(+), 0 deletions(-)
--
1.7.7.6
10 years, 11 months
[PATCH] edits to httpd guidance
by Jeffrey Blank
These edits reflect Shawn's feedback.
Jeffrey Blank (1):
significant httpd guidance (consolidated, edited)
rhel6/src/input/services/http.xml | 789 +++++++++++++++++++++++++++++++++++++
1 files changed, 789 insertions(+), 0 deletions(-)
10 years, 11 months
[PATCH] consolidated httpd XCCDF commit
by Jeffrey Blank
This patch is a consolidation of Willy's commits for XCCDF content for Apache
configuration. I believe this captures the information, and will make the
commit log a bit clearer.
Aside from consolidation, I made the following modifications: mod_auth_digest
was experimental in apache 2.0, not in 2.2, so i updated the text. Same thing
for ditto for mod_cache. The Apache docs are an excellent resource, especially
since 1.3 was originally shipped/supported on RHEL 5 (and we are updating
for 2.2 on RHEL 6).
mod_disk_cache, mod_file_cache, mod_mem_cache all require mod_cache, so
I changed the rule to only require that mod_cache not exist, as our
goal is to provide a compliance check against caching.
It appears that chroot capability is now supported out of the box (not
just via mod_security), so this is noted in the httpd_chroot section.
I added a style note to the wiki (XCCDF Rule-writing section) about
Rule titles: they should be imperative when possible. I also updated
many of the Rule titles with initial caps, which is consistent with the
rest of the document.
Grammatical pet peeve: removed instances of "and/or".
Minor note: using <tt> tags inside a title is fine, but it gets
stripped out by shorthand2xccdf.xslt. For some reason, the XCCDF spec
does not allow for XHTML tags inside a title (and despite the
aesthetic loss, we should try to derive all human-readable output from
valid XCCDF).
I changed a few Rules to Groups. This occurred when it wasn't clear that
it would be practical to create a granular check (using any mechanism) or when
helpful information was being provided (versus potential compliance
requirements). Some Groups may later be broken out into several Rules
if there is motivation.
The default permissions on /var/log/httpd are more restrictive (at 700) than
what the RHEL 5 guide originally suggested (750), and so I updated this Rule.
(I have not yet updated the OVAL, however.)
The original Apache guidance in the SNAC guide was definitely not written in a
manner that was easy to translate to XCCDF. I suspect that another round of
edits may be called for, but this has already gotten two rounds of
translation/edits, so I'm offering it for a commit...
Jeffrey Blank (1):
added significant body of apache configuration guidance
rhel6/src/input/services/http.xml | 789 +++++++++++++++++++++++++++++++++++++
1 files changed, 789 insertions(+), 0 deletions(-)
10 years, 11 months
[PATCH 0/1] Added 800-53 content to partition rules.
by Willy Santos
This commit was missed this morning when others of the kind got
committed and ACKd by Shawn Wells. In the interest of preserving this
information and working from the the same base, I'm submitting for ACK.
See Shawn's commment below on the previous ACK:
"Given that we're converting the mappings from NIST over to the CCIs
(which get us things like NIST 800-53 and OS SRG for free) these patches
will have a short lifespan, however they do provide us with a foundation
for identifying what potential CCIs the rules apply to. Ack for the
patchset, so that these can provide a base for mapping to appropriate CCIs."
Willy Santos (1):
Added 800-53 references where missing.
rhel6/src/input/system/permissions/partitions.xml | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
--
1.7.7.6
10 years, 11 months
[PATCH 0/1] M1 IMAP content - Corrections
by Willy Santos
This patch makes the necessary corrections to previously submitted IMAP
content.
Willy Santos (1):
Corrected Dovecot content and OVAL checks for version 2 relevancy.
.../checks/dovecot_disable_plaintext_auth.xml | 4 +-
rhel6/src/input/checks/dovecot_enable_ssl.xml | 28 ++++
.../checks/dovecot_login_process_per_conn_yes.xml | 28 ----
.../dovecot_mail_drop_priv_before_exec_yes.xml | 28 ----
rhel6/src/input/services/imap.xml | 130
++++++++------------
5 files changed, 81 insertions(+), 137 deletions(-)
create mode 100644 rhel6/src/input/checks/dovecot_enable_ssl.xml
delete mode 100644
rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
delete mode 100644
rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
--
1.7.7.6
10 years, 11 months
[PATCH 4/4] OVAL check for Dovecot setting mail_drop_priv_before_exec.
by Willy Santos
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
.../dovecot_mail_drop_priv_before_exec_yes.xml | 28
++++++++++++++++++++
1 files changed, 28 insertions(+), 0 deletions(-)
create mode 100644
rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
diff --git
a/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
b/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
new file mode 100644
index 0000000..edb721a
--- /dev/null
+++ b/rhel6/src/input/checks/dovecot_mail_drop_priv_before_exec_yes.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <definition class="compliance"
+ id="dovecot_mail_drop_priv_before_exec_yes" version="1">
+ <metadata>
+ <title>Enable login_process_per_connection in Dovecot</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-4410-7" source="CCE" />
+ <description>login_process_per_connection should be
enabled.</description>
+ </metadata>
+ <criteria comment="Enable login_process_per_connection in Dovecot">
+ <criterion test_ref="test_dovecot_mail_drop_priv_before_exec_yes" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Tests the value of the
mail_drop_priv_before_exec[\s]*(<:nocomment:>*) setting in the
/etc/dovecot.conf file"
+ id="test_dovecot_mail_drop_priv_before_exec_yes" version="1">
+ <ind:object object_ref="obj_dovecot_mail_drop_priv_before_exec_yes" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="obj_dovecot_mail_drop_priv_before_exec_yes"
+ version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>dovecot.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]*mail_drop_priv_before_exec[\s]*=[\s]*yes\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
--
1.7.7.6
10 years, 11 months
[PATCH 3/4] OVAL check for Dovecot setting login_process_per_connection.
by Willy Santos
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
.../checks/dovecot_login_process_per_conn_yes.xml | 28
++++++++++++++++++++
1 files changed, 28 insertions(+), 0 deletions(-)
create mode 100644
rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
diff --git
a/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
b/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
new file mode 100644
index 0000000..d1569ea
--- /dev/null
+++ b/rhel6/src/input/checks/dovecot_login_process_per_conn_yes.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <definition class="compliance"
+ id="dovecot_login_process_per_conn_yes" version="1">
+ <metadata>
+ <title>Enable login_process_per_connection in Dovecot</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-4410-7" source="CCE" />
+ <description>login_process_per_connection should be
enabled.</description>
+ </metadata>
+ <criteria comment="Enable login_process_per_connection in Dovecot">
+ <criterion test_ref="test_dovecot_login_process_per_conn_yes" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Tests the value of the
login_process_per_connection[\s]*(<:nocomment:>*) setting in the
/etc/dovecot.conf file"
+ id="test_dovecot_login_process_per_conn_yes" version="1">
+ <ind:object object_ref="obj_dovecot_login_process_per_conn_yes" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_dovecot_login_process_per_conn_yes"
+ version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>dovecot.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]*login_process_per_connection[\s]*=[\s]*yes\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
--
1.7.7.6
10 years, 11 months
[PATCH 2/4] OVAL check for disabling plaintext authentication in Dovecot.
by Willy Santos
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
.../checks/dovecot_disable_plaintext_auth.xml | 28
++++++++++++++++++++
1 files changed, 28 insertions(+), 0 deletions(-)
create mode 100644
rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
diff --git a/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
b/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
new file mode 100644
index 0000000..ecc4795
--- /dev/null
+++ b/rhel6/src/input/checks/dovecot_disable_plaintext_auth.xml
@@ -0,0 +1,28 @@
+<def-group>
+ <definition class="compliance"
+ id="dovecot_disable_plaintext_auth" version="1">
+ <metadata>
+ <title>Disable Plaintext Authentication in Dovecot</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-4552-6" source="CCE" />
+ <description>Plaintext authentication of mail clients should be
disabled.</description>
+ </metadata>
+ <criteria comment="Disable Plaintext Authentication in Dovecot">
+ <criterion test_ref="test_dovecot_disable_plaintext_auth" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
+ comment="Tests the value of the
disable_plaintext_auth[\s]*(<:nocomment:>*) setting in the
/etc/dovecot.conf file"
+ id="test_dovecot_disable_plaintext_auth" version="1">
+ <ind:object object_ref="obj_dovecot_disable_plaintext_auth" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_dovecot_disable_plaintext_auth"
+ version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>dovecot.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
--
1.7.7.6
10 years, 11 months
[PATCH 1/4] Added content referenced in Trac ticket #38.
by Willy Santos
Signed-off-by: Willy Santos <wsantos(a)redhat.com>
---
rhel6/src/input/services/imap.xml | 172
++++++++++++++++++++++++++++++++++++-
1 files changed, 170 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/services/imap.xml
b/rhel6/src/input/services/imap.xml
index 93dedce..cb6c644 100644
--- a/rhel6/src/input/services/imap.xml
+++ b/rhel6/src/input/services/imap.xml
@@ -40,6 +40,174 @@ removing it provides a safeguard against its activation.
<oval id="package_dovecot_removed" />
</Rule>
-</Group>
-</Group>
+</Group> <!-- <Group id="disabling_dovecot"> -->
+
+<Group id="configure_dovecot">
+<title>Configure Dovecot if Necessary</title>
+<description>If the system will operate as an IMAP or
+POP3 server, the dovecot software should be configured securely by
following
+the recommendations below.
+</description>
+
+<Rule id="dovecot_support_necessary_protocols">
+<title>Support Only the Necessary Protocols</title>
+<description>Dovecot supports the IMAP and POP3 protocols, as well as
+SSL-protected versions of those protocols. Configure the Dovecot server
+to support only the protocols needed by your site. Edit
<tt>/etc/dovecot.conf</tt>. +Add or correct the following lines,
replacing <tt>PROTOCOL</tt> with +only the subset of protocols
(<tt>imap</tt>, <tt>imaps</tt>, +<tt>pop3</tt>, <tt>pop3s</tt>) required:
+<pre>protocols = PROTOCOL</pre>
+If possible, require SSL protection for all transactions. The SSL
+protocol variants listen on alternate ports (995 instead of 110 for
+pop3s, and 993 instead of 143 for imaps), and require SSL-aware
clients. +An alternate approach is to listen on the standard port and
require the +client to use the STARTTLS command before authenticating.
+</description>
+
+<rationale>
+Configuring Dovecot to only support the protocols the protocols needed by
+your site reduces the risk of an attacker using one of the unused protocols
+to base an attack.</rationale>
+<ident cce="4384-4" />
+<ident cce="3887-7" />
+<ident cce="4530-2" />
+<ident cce="4547-6" />
+<!-- <oval id="dovecot_support_necessary_protocols" /> -->
+</Rule>
+
+<Group id="dovecot_enable_ssl">
+<title>Enable SSL Support</title>
+<description>SSL should be used to encrypt network traffic between the
+Dovecot server and its clients. Users must authenticate to the Dovecot
+server in order to read their mail, and passwords should never be
+transmitted in clear text. In addition, protecting mail as it is
+downloaded is a privacy measure, and clients may use SSL certificates
+to authenticate the server, preventing another system from
impersonating +the server.
+</description>
+
+<Rule id="dovecot_configure_ssl_cert">
+<title>Configure Dovecot to Use the SSL Certificate</title>
+<description>These options tell Dovecot where to find the TLS
+configuration, allowing clients to make encrypted connections.
+<br /><br />
+Edit <tt>/etc/dovecot.conf</tt> and add or correct the following +lines
(ensuring they reference the appropriate files):
+<pre>ssl_cert_file = /etc/pki/tls/imap/servercert.pem
+ssl_key_file = /etc/pki/tls/imap/serverkey.pem
+ssl_ca_file = /etc/pki/tls/CA/cacert.pem
+</pre>
+</description>
+<rationale>
+SSL certificates are used by the client to authenticate the identity
+of the server, as well as to encrypt credentials and message traffic.
+Not using SSL to encrypt mail server traffic could allow unauthorized
+access to credentials and mail messages since they are sent in plain
+text over the network.
+</rationale>
+<!-- <ident cce="4239-0" /> -->
+<!-- <oval id="dovecot_configure_ssl_cert" /> -->
+</Rule>
+
+<Rule id="dovecot_disable_plaintext_auth">
+<title>Disable Plaintext Authentication</title>
+<description>To prevent Dovecot from attempting plaintext
+authentication of clients, edit <tt>/etc/dovecot.conf</tt> and add
+or correct the following line:
+<pre>disable_plaintext_auth = yes</pre>
+</description>
+<rationale>
+Using plain text authentication to the mail server could allow an
+attacker access to credentials by monitoring network traffic.
+</rationale>
+<ident cce="4552-6" />
+<oval id="dovecot_disable_plaintext_auth" />
+</Rule>
+
+</Group> <!-- <Group id="dovecot_enable_ssl" -->
+
+<Group id="dovecot_enable_code_flaw_protect">
+<title>Enable Dovecot Options to Protect Against Code Flaws</title>
+<description>IMAP and POP3 are remote authenticated protocols, meaning
that +the server must accept remote connections from anyone, but provide
substantial +services only to clients who have successfully
authenticated. To protect +against security problems, Dovecot splits
these functions into separate +server processes. The <tt>imap-login</tt>
and/or <tt>pop3-login</tt> +processes accept connections from
unauthenticated users, and only spawn +<tt>imap</tt> or <tt>pop3</tt>
processes on successful authentication.
+<br /><br />
+However, the <tt>imap-login</tt> and <tt>pop3-login</tt> processes
+themselves may contain vulnerabilities. Since each of these processes
+operates as a daemon, handling multiple sequential client connections
+from different users, bugs in the code could allow unauthenticated
users +to steal credential data. If the
<tt>login_process_per_connection</tt> option +is enabled, then a
separate <tt>imap-login</tt> or <tt>pop3-login</tt> +process is created
for each new connection, protecting against this class +of problems.
This option has an efficiency cost, but is strongly recommended.
+<br /><br />
+If the <tt>mail_drop_priv_before_exec</tt> option is on, the
<tt>imap-login</tt> +or <tt>pop3-login</tt> process will drop privileges
to the userâs ID after +authentication and before executing the
<tt>imap</tt> or <tt>pop3</tt> +process itself. Under some very limited
circumstances, this could protect +against privilege escalation by
authenticated users. However, if the +mail executable option is used to
run code before starting each userâs session, +it is important to drop
privileges to prevent the custom code from running as root.
+</description>
+
+<Rule id="dovecot_login_process_per_conn_yes">
+<title>login_process_per_connection set to yes</title>
+<description>Setting <tt>login_process_per_connection = yes</tt>, prevents
+possible bugs in the code from allowing unauthenticated users to steal
+credential data when handling multiple sequential client connections
+from different users by creating a separate <tt>imap-login</tt> or
+<tt>pop3-login</tt> process for each new connection.
+<br /><br />
+Edit <tt>/etc/dovecot.conf</tt> and add or correct the following line:
+<pre>login_process_per_connection = yes</pre>
+</description>
+<rationale>
+This setting could protect against an attacker trying to exploit a bug in
+the dovecot code.</rationale>
+<ident cce="4410-7" />
+<oval id="dovecot_login_process_per_conn_yes" />
+</Rule>
+
+<Rule id="dovecot_mail_drop_priv_before_exec_yes">
+<title>mail_drop_priv_before_exec set to yes</title>
+<description>Setting <tt>mail_drop_priv_before_exec = yes</tt>, causes
+the <tt>imap-login</tt> or <tt>pop3-login</tt> process will drop
+privileges to the userâs ID after authentication and before executing
+the <tt>imap</tt> or <tt>pop3</tt> process itself.
+<br /><br />
+Edit <tt>/etc/dovecot.conf</tt> and add or correct the following line:
+<pre>mail_drop_priv_before_exec = yes</pre>
+</description>
+<rationale>
+This setting could protect against privilege escalation by authenticated
+users.</rationale>
+<ident cce="4371-1" />
+<oval id="dovecot_mail_drop_priv_before_exec_yes" />
+</Rule>
+
+</Group> <!-- <Group id="dovecot_enable_code_flaw_protect"> -->
+
+<Group id="dovecot_allow_imap_access">
+<title>Allow IMAP Clients to Access the Server</title>
+<description>The default iptables configuration does not allow inbound
+access to any services. This modification will allow remote hosts to
+initiate connections to the IMAP daemon, while keeping all other ports
+on the server in their default protected state. +<br /><br />
+Edit <tt>/etc/sysconfig/iptables</tt>. Add the following line, ensuring
+that it appears before the final <tt>LOG</tt> and <tt>DROP</tt> lines
+for the <tt>RH-Firewall-1-INPUT</tt> chain:
+<pre>-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 143 -j
ACCEPT</pre>
+</description>
+
+</Group> <!-- <Group id="dovecot_allow_imap_access"> -->
+
+</Group> <!-- <Group id="configure_dovecot"> -->
+
+</Group> <!-- <Group id="imap"> -->
-- 1.7.7.6
10 years, 11 months