[PATCH v3] Logging and Auditing
by Mike Palmiotto
Some edits to Logging and Auditing.
More granular auditd data retention.
Removed some logwatch checks.
Mike Palmiotto (1):
M1 Incomplete Guidance - Logging and Auditing
.../auditd_data_retention_admin_space_left.xml | 30 ++++++++
.../checks/auditd_data_retention_mail_acct.xml | 30 ++++++++
.../input/checks/auditd_data_retention_max_log.xml | 30 ++++++++
.../checks/auditd_data_retention_max_log_file.xml | 30 ++++++++
.../checks/auditd_data_retention_space_left.xml | 30 ++++++++
.../input/checks/logwatch_configured_hostlimit.xml | 29 ++++++++
.../checks/logwatch_configured_splithosts.xml | 27 ++++++++
rhel6/src/input/profiles/common.xml | 14 ++++
rhel6/src/input/system/auditing.xml | 69 +++++++++++++++++++-
rhel6/src/input/system/logging.xml | 71 ++++++++++++++++++++
10 files changed, 359 insertions(+), 1 deletions(-)
create mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml
create mode 100644 rhel6/src/input/checks/logwatch_configured_hostlimit.xml
create mode 100644 rhel6/src/input/checks/logwatch_configured_splithosts.xml
--
1.7.6.5
11 years, 11 months
[PATCH v2] Fixed titles for CCEs 14904-7 and 14697-5
by Mike Palmiotto
Signed-off-by: Michael Palmiotto <mpalmiotto(a)tresys.com>
---
.../src/input/checks/audit_rules_login_events.xml | 2 +-
.../input/checks/audit_rules_session_events.xml | 2 +-
rhel6/src/input/profiles/common.xml | 2 +
rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++
4 files changed, 34 insertions(+), 2 deletions(-)
diff --git a/rhel6/src/input/checks/audit_rules_login_events.xml b/rhel6/src/input/checks/audit_rules_login_events.xml
index 77a7661..06bbbff 100644
--- a/rhel6/src/input/checks/audit_rules_login_events.xml
+++ b/rhel6/src/input/checks/audit_rules_login_events.xml
@@ -1,7 +1,7 @@
<def-group>
<definition class="compliance" id="audit_rules_login_events" version="1">
<metadata>
- <title>Audit Logon/Logout Events</title>
+ <title>Record Attempts to Alter Logon and Logout Events</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
diff --git a/rhel6/src/input/checks/audit_rules_session_events.xml b/rhel6/src/input/checks/audit_rules_session_events.xml
index e1dfc43..b3b2595 100644
--- a/rhel6/src/input/checks/audit_rules_session_events.xml
+++ b/rhel6/src/input/checks/audit_rules_session_events.xml
@@ -1,7 +1,7 @@
<def-group>
<definition class="compliance" id="audit_rules_session_events" version="1">
<metadata>
- <title>Audit Session Initiation Information</title>
+ <title>Record Attempts to Alter Process and Session Initiation Information</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 20853f5..a628a5a 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -88,6 +88,8 @@
<select idref="audit_account_changes" selected="true"/>
<select idref="audit_network_modifications" selected="true"/>
<select idref="audit_mac_changes" selected="true"/>
+<select idref="audit_manual_logon_edits" selected="true" />
+<select idref="audit_manual_session_edits" selected="true" />
<select idref="audit_dac_actions" selected="true"/>
<select idref="audit_file_access" selected="true"/>
<select idref="audit_privileged_commands" selected="true"/>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index c79471f..b54ae64 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -206,6 +206,36 @@ anything other than administrator action. All changes to MAC policy should be au
<ref nist="AU-2" />
</Rule>
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description>
+The audit system already collects login info for all users and root. To watch for attempted manual edits of
+files involved in storing logon events, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/log/faillog -p wa -k logins
+-w /var/log/lastlog -p wa -k logins
+</pre>
+</description>
+<ident cce="14904-7" />
+<oval id="audit_rules_login_events" />
+<ref nist="TODO" />
+</Rule>
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation Information</title>
+<description>
+The audit system already collects process information for all users and root. To watch for attempted manual
+edits of files involved in storing such process information, add the following to <tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/run/utmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_events" />
+<ref nist="TODO" />
+</Rule>
<Rule id="audit_dac_actions">
<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
--
1.7.6.5
11 years, 11 months
RE: [PATCH 01/14] Mapped CCI-000056 to gui_screen_locking group and install_vlock_package
by Mike Palmiotto
>The following sections detail commands to enforce idle activation of the screen saver,
> screen locking, a blank-screen screensaver, and an idle
> activation time.
>+<ref disa="56" />
It appears that a ref tag snuck its way inside the gui_screen_locking group's description tag.
The tag has disa's 56, 57, and 60.
> <br /><br />
> Because users should be trained to lock the screen when they
>@@ -288,7 +289,7 @@ for users who may need to suspend console logins.
> </rationale>
> <ident cce="3910-7" />
> <oval id="package_vlock_installed" />
>-<ref nist="CM-6, CM-7" />
>+<ref nist="CM-6, CM-7" disa="56" />
> </Rule>
> </Group>
> </Group>
I think it should suffice to pull it down to the next <ref> tag, just before the end of the Rule.
Thoughts?
There was another error with the key-sequence 'inactivity_timeout_value'.
I checked the OVAL and XCCDF shorthand and everything seems to check out, yet this
error still pops up when trying to run a make validate:
"No match found for key-sequence ['inactivity_timeout_value'] of keyref '{http://checklists.nist.gov/xccdf/1.1}valueIdKeyRef'."
--Mike
11 years, 11 months
[PATCH] documenting SRG satisfaction (outside of Rule/Group references)
by Jeffrey Blank
The attached patch enables documentation of OS SRG satifaction (or
dissatisfaction) outside of the XCCDF content that will be "shipped" in the
guide or any baselines. It does so by inserting files in the new
input/auxiliary directory, and then removing their Groups (via a new transform,
xccdf-removeaux) following the generation of tables. This may not be the most
elegant solution, but it meets our needs. It does impose some ordering
requirements on the generation of some outputs, but Make handles such things as
long as we keep it in mind...
Jeffrey Blank (1):
added support for Groups that exist only for some outputs * this
is intended to allow documentation of SRG satisfaction, for
that table (but not final XCCDF output)
rhel6/src/Makefile | 2 +-
rhel6/src/input/auxiliary/srg_support.xml | 37 +++++++++++++++++++++++++++++
rhel6/src/input/guide.xslt | 2 +
rhel6/src/transforms/xccdf-removeaux.xslt | 22 +++++++++++++++++
4 files changed, 62 insertions(+), 1 deletions(-)
create mode 100644 rhel6/src/input/auxiliary/srg_support.xml
create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt
11 years, 11 months
Re: [PATCH] documenting SRG satisfaction (outside of Rule/Group references)
by Jeffrey Blank
Oh, git send-email... do what I mean, not what I say!
Here, "y" meant to accept my default email address, not invent a new
one. Anyway, patch for consideration. You know where it came from.
On 05/06/2012 02:23 PM, y(a)magellan.eclipse.ncsc.mil wrote:
> From: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
>
> The attached patch enables documentation of OS SRG satifaction (or
> dissatisfaction) outside of the XCCDF content that will be "shipped" in the
> guide or any baselines. It does so by inserting files in the new
> input/auxiliary directory, and then removing their Groups (via a new transform,
> xccdf-removeaux) following the generation of tables. This may not be the most
> elegant solution, but it meets our needs. It does impose some ordering
> requirements on the generation of some outputs, but Make handles such things as
> long as we keep it in mind...
>
>
> Jeffrey Blank (1):
> added support for Groups that exist only for some outputs * this
> is intended to allow documentation of SRG satisfaction, for
> that table (but not final XCCDF output)
>
> rhel6/src/Makefile | 2 +-
> rhel6/src/input/auxiliary/srg_support.xml | 37 +++++++++++++++++++++++++++++
> rhel6/src/input/guide.xslt | 2 +
> rhel6/src/transforms/xccdf-removeaux.xslt | 22 +++++++++++++++++
> 4 files changed, 62 insertions(+), 1 deletions(-)
> create mode 100644 rhel6/src/input/auxiliary/srg_support.xml
> create mode 100644 rhel6/src/transforms/xccdf-removeaux.xslt
>
>
11 years, 11 months
RE: [PATCH] Fixed OVAL Checks and XCCDF Content for CCEs 14904-7 and 14679-5
by Mike Palmiotto
I NACK myself. Some errors in the oval_id's and missing profile entries.
Correcting and sending out a revision patch.
--Mike
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Michael Palmiotto [mpalmiotto(a)tresys.com]
Sent: Friday, May 04, 2012 2:52 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: [PATCH] Fixed OVAL Checks and XCCDF Content for CCEs 14904-7 and 14679-5
Received an auto-ACK from Jeff. Going to go ahead and push these commits.
Michael Palmiotto (1):
Fixed titles for CCEs 14904-7 and 14697-5
.../src/input/checks/audit_rules_login_events.xml | 2 +-
.../input/checks/audit_rules_session_events.xml | 2 +-
rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++
3 files changed, 32 insertions(+), 2 deletions(-)
--
1.7.6.5
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide
11 years, 11 months
[PATCH] Fixed OVAL Checks and XCCDF Content for CCEs 14904-7 and 14679-5
by Mike Palmiotto
Received an auto-ACK from Jeff. Going to go ahead and push these commits.
Michael Palmiotto (1):
Fixed titles for CCEs 14904-7 and 14697-5
.../src/input/checks/audit_rules_login_events.xml | 2 +-
.../input/checks/audit_rules_session_events.xml | 2 +-
rhel6/src/input/system/auditing.xml | 30 ++++++++++++++++++++
3 files changed, 32 insertions(+), 2 deletions(-)
--
1.7.6.5
11 years, 11 months
[PATCH 00/14] Mapped more CCI numbers to SSG content
by Willy Santos
More CCI mappings to SSG content.
Willy Santos (14):
Mapped CCI-000056 to gui_screen_locking group and
install_vlock_package
Mapped CCI-000057 to gui_screen_locking group
Mapped CCI-000058 to install_vlock_package
Mapped CCI-000060 to gui_screen_locking
Mapped CCI-000068 to ssh_server group
Mapped CCI-000087 to mountopt_noexec_on_removable_partitions
Mapped CCI-000192 to password_require_uppercases
Mapped CCI-000193 to password_require_lowercases
Mapped CCI-001384 to set_system_login_banner and
set_gdm_login_banner_text
Mapped CCI-001385 to set_system_login_banner and
set_gdm_login_banner_text
Mapped CCI-001386 to set_system_login_banner and
set_gdm_login_banner_text
Mapped CCI-001387 to set_system_login_banner and
set_gdm_login_banner_text
Mapped CCI-001388 to set_system_login_banner and
set_gdm_login_banner_text
Mapped CCI-001069 to aide group
rhel6/src/input/services/ssh.xml | 2 +-
rhel6/src/input/system/accounts/banners.xml | 4 ++--
rhel6/src/input/system/accounts/pam.xml | 4 ++--
rhel6/src/input/system/accounts/physical.xml | 3 ++-
rhel6/src/input/system/permissions/partitions.xml | 2 +-
rhel6/src/input/system/software/integrity.xml | 2 +-
6 files changed, 9 insertions(+), 8 deletions(-)
--
1.7.7.6
11 years, 11 months
[PATCH v2 0/2] M1 Incomplete Guidance - Tickets #23, 26
by Mike Palmiotto
Here are the revisions to previous patches for Tickets #23,26.
Michael Palmiotto (1):
M1 Incomplete Guidance - Account and Access Control
Mike Palmiotto (1):
M1 Incomplete Guidance - Logging and Auditing
.../checks/accounts_disabled_after_expiration.xml | 24 ++++
...counts_login_shell_timeout_implemented_bash.xml | 45 ++++++++
...counts_login_shell_timeout_implemented_tcsh.xml | 25 +++++
.../input/checks/accounts_netrc_files_checked.xml | 25 +++++
.../accounts_user_dot_files_not_world_writable.xml | 33 ++++++
.../checks/audit_rules_logon_modification.xml | 34 ++++++
.../checks/audit_rules_session_modification.xml | 47 ++++++++
.../checks/libuser_login_defs_userdefaults.xml | 50 +++++++++
.../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++
.../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++
rhel6/src/input/profiles/common.xml | 42 +++++++-
rhel6/src/input/system/accounts/accounts.xml | 27 +++++
rhel6/src/input/system/accounts/pam.xml | 38 +++++++-
rhel6/src/input/system/accounts/physical.xml | 63 +++++++++++
.../system/accounts/restrictions/restrictions.xml | 114 ++++++++++++++++++++
rhel6/src/input/system/accounts/session.xml | 24 ++++
rhel6/src/input/system/auditing.xml | 77 +++++++++++++-
rhel6/src/input/system/logging.xml | 67 ++++++++++++
18 files changed, 873 insertions(+), 3 deletions(-)
create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expiration.xml
create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_bash.xml
create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_implemented_tcsh.xml
create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.xml
create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.xml
create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml
create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml
create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefaults.xml
create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml
create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
--
1.7.6.5
11 years, 11 months
[PATCH] fixed bug so that table-srgmap will also map Groups
by Jeffrey Blank
The idea here is that discussion inside a Group may provide
evidence that an OS SRG requirement is being met. Many Groups have already
gotten refs for OS SRG items.
A future patch will allow additional discussion to be included, from Groups in
an auxiliary file (that will not be part of any other output).
Jeffrey Blank (1):
fixed table-srgmap to also map Groups
rhel6/src/Makefile | 4 ++--
rhel6/src/transforms/table-srgmap.xslt | 17 +++++++++--------
2 files changed, 11 insertions(+), 10 deletions(-)
11 years, 12 months