scap-security-guide June 2012

scap-security-guide@lists.fedorahosted.org

11 participants
24 discussions

[PATCH 00/26] More CCI Mappings
by Willy Santos 29 Jun '12

29 Jun '12

More CCI mappings in support of the OS SRG compliance efforts. Note that any mapping to requirement_unclear is meant for discussion by the group and all suggestions are welcome. Willy Santos (26): Changed mapping of CCI-000386 from requirement_unclear to met_inherently as suggested by Shawn Wells. Removed mapping of CCI-001092 from requirement_unclear, based on discussion/input from Shawn Wells. Mapped CCI-001092 to iptables_icmp_disabled and enable_iptables enable_ip6tables. Mapped CCI-001092 to password_retry. Mapped CCI-000024 to requirement_unclear. Mapped CCI-000025 to requirement_unclear. Mapped CCI-000026 to requirement_unclear. Mapped CCI-000027 to requirement_unclear. Mapped CCI-000028 to requirement_unclear. Mapped CCI-000029 to requirement_unclear. Mapped CCI-000030 to requirement_unclear. Mapped CCI-000032 to requirement_unclear. Mapped CCI-00034 to met_inherently. Mapped CCI-00035 to met_inherently. Mapped CCI-001250 to gconf_gnome_disable_automount. Mapped CCI-000085 to gconf_gnome_disable_automount. Mapped CCI-000085 to service_autofs_disabled. Mapped CCI-000085 to bios_disable_usb_boot. Mapped CCI-000085 to bootloader_nousb_argument. Mapped CCI-000085 to kernel_module_usb-storage_removed. Mapped CCI-000085 to gconf_gnome_disable_automount. Mapped CCI-000099 to requirement_unclear. Mapped CCI-000157 to met_inherently. Mapped CCI-000185 to network_ssl_enable_client_support. Made changes requested by Jeff Blank to accommodate changes made on his commit. Mapped CCI-000186 to met_inherently. rhel6/src/input/auxiliary/srg_support.xml | 10 +++++----- rhel6/src/input/system/accounts/pam.xml | 2 +- rhel6/src/input/system/network/iptables.xml | 6 +++--- rhel6/src/input/system/network/ssl.xml | 2 +- rhel6/src/input/system/permissions/mounting.xml | 12 ++++++------ 5 files changed, 16 insertions(+), 16 deletions(-) -- 1.7.7.6

2 53

[PATCH] new Rule and check for disabling local accounts
by Jeffrey Blank 29 Jun '12

29 Jun '12

this meets some OS SRG reqs as well Jeffrey Blank (1): added new Rule and check to disable inactive accounts * inactivity is defined as time following automatic password expiration * also added relevant CCI refs rhel6/src/input/auxiliary/srg_support.xml | 13 +++++- .../checks/accounts_disable_post_pw_expiration.xml | 39 +++++++++++++++++ rhel6/src/input/guide.xslt | 1 + rhel6/src/input/profiles/test.xml | 12 ++--- .../accounts/restrictions/account_expiration.xml | 46 ++++++++++++++++++++ 5 files changed, 102 insertions(+), 9 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_disable_post_pw_expiration.xml create mode 100644 rhel6/src/input/system/accounts/restrictions/account_expiration.xml

4 7

[PATCH 00/25] More CCI mappings
by Willy Santos 28 Jun '12

28 Jun '12

Another set of CCI mappings. Willy Santos (25): Mapped CCI-1127 to network_ssl. Mapped CCI-001154 to set_iptables_default_rule Mapped CCI-001250 to kernel_module_usb-storage_disabled. Mapped CCI-001250 to kernel_module_usb-storage_removed. Mapped CCI-001250 to bootloader_nousb_argument. Mapped CCI-001250 to kernel_module_usb-storage_removed. Mapped CCI-001250 to service_autofs_disabled. Mapped CCI-001343 to new_rule_needed. Mapped CCI-001348 to rsyslog_remote_loghost. Mapped CCI-001493 to met_inherently. Mapped CCI-001494 to met_inherently. Mapped CCI-001495 to met_inherently. Mapped CCI-001557 to service_rsyslog_enabled Mapped CCI-000017 to new_rule_needed. Mapped CCI-000052 to new_rule_needed. Mapped CCI-000053 to new_rule_needed. Mapped CCI-000226 to met_inherently. Mapped CCI-000386 to requirement_unclear. Mapped CCI-001092 to requirement_unclear. Mapped CCI-00197 to requirement_unclear. Mapped CCI-001096 to met_inherently. Mapped CCI-001128 to network_ssl. Mapped CCI-001135 to network_ssl. Mapped CCI-001135 to package_openswan_installed. Mapped CCI-001135 to sshd_allow_only_protocol2. rhel6/src/input/auxiliary/srg_support.xml | 5 +++-- rhel6/src/input/services/ssh.xml | 2 +- rhel6/src/input/system/logging.xml | 4 ++-- rhel6/src/input/system/network/ipsec.xml | 2 +- rhel6/src/input/system/network/iptables.xml | 2 +- rhel6/src/input/system/network/ssl.xml | 2 +- rhel6/src/input/system/permissions/mounting.xml | 10 +++++----- 7 files changed, 14 insertions(+), 13 deletions(-) -- 1.7.7.6

2 35

[PATCH] added more CCI references to Rules, to support documentation of OS SRG satisfaction
by Jeffrey Blank 26 Jun '12

26 Jun '12

Also, I need to add Rules for automatic account expiration to handle some of the OS SRG reqs. Oddly, we seem to have OVAL for this and it's in the USGCB but not in our XCCDF. (This means adding a Rule (plus Value) to discuss EXPIRE= in /etc/default/useradd.) Jeffrey Blank (1): added CCIs to move OS SRG mapping forward rhel6/src/input/auxiliary/srg_support.xml | 19 +++++++++++++------ rhel6/src/input/services/ssh.xml | 2 +- rhel6/src/input/system/auditing.xml | 7 ++++--- rhel6/src/input/system/software/updating.xml | 4 ++-- 4 files changed, 20 insertions(+), 12 deletions(-)

2 2

[PATCH 0/4] ability to view pre-release draft RHEL 6 STIG profile, prose cleanup
by Jeffrey Blank 24 Jun '12

24 Jun '12

The major goal of this commit is to provide the ability for consumers to easily view the project's Rules as "requirements" for the pre-release draft RHEL 6 STIG. This will help ensure productive consensus group meetings, by ensuring participants can view the Rules and generate feedback prior to the meetings. Usage of the project also ensures effective capture of consensus decisions. Mapping of the CCIs from the OS SRG continues (in parallel), which is an essential element for submitting the content as a STIG. Jeffrey Blank (4): added Makerule, transform to create table for RHEL 6 STIG Profile (Pre-release Draft) cleanup of prose for sysctl network parameter settings * expurgated weird CCE description text * introduced usage of new macros for XCCDF sysctl description cleanup of prose for rsyslog logging * OVAL for these remains difficult * can we grab a filename from a text file, and then run tests on it? cleanup of prose for iptables rhel6/src/Makefile | 8 +- rhel6/src/input/profiles/STIG-server.xml | 5 +- rhel6/src/input/system/logging.xml | 220 +++++++++++------- rhel6/src/input/system/network/iptables.xml | 51 +++-- rhel6/src/input/system/network/kernel.xml | 242 ++++++++++---------- rhel6/src/transforms/shorthand2xccdf.xslt | 15 ++ rhel6/src/transforms/xccdf-addprofiles.xslt | 1 + .../src/transforms/xccdf2table-profileccirefs.xslt | 170 ++++++++++++++ 8 files changed, 481 insertions(+), 231 deletions(-) create mode 100644 rhel6/src/transforms/xccdf2table-profileccirefs.xslt

2 5

[PATCH 0/8] More CCI Mappings
by Willy Santos 22 Jun '12

22 Jun '12

Another batch of CCI-Mappings. Willy Santos (8): Mapped CCI-001130 to install_openswan Mapped CCI-001130 to network_ssl Mapped CCI-001131 to install_openswan Mapped CCI-001131 to network_ssl Mapped CCI-001133 to sshd_idle_timeout Mapped CCI-001144 to sshd_use_approved_ciphers Mapped CCI-001145 to sshd_use_approved_ciphers Mapped CCI-001146 to sshd_use_approved_ciphers rhel6/src/input/services/ssh.xml | 4 ++-- rhel6/src/input/system/network/ipsec.xml | 2 +- rhel6/src/input/system/network/ssl.xml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) -- 1.7.7.6

2 9

[PATCH 0/5] More CCI mappings
by Willy Santos 21 Jun '12

21 Jun '12

More CCI Mappings. Willy Santos (5): Mapped CCI-000381 to principle-minimize-software Mapped CCI-000382 to principle-minimize-software Mapped CCI-000776 to sshd_allow_only_protocol2 Mapped CCI-000774 to sshd_allow_only_protocol2 Mapped CCI-000872 to met_inherently rhel6/src/input/auxiliary/srg_support.xml | 2 +- rhel6/src/input/intro/intro.xml | 1 + rhel6/src/input/services/ssh.xml | 1 + 3 files changed, 3 insertions(+), 1 deletions(-) -- 1.7.7.6

2 6

[PATCH 0/1] Broke apart auditd rules/prose for time changes
by Kevin Spargur 20 Jun '12

20 Jun '12

Broke apart the auditd rule for time changes into individual elements to better support being able to define these rules in a variety of ways. Also added a couple generic architecture tests. Note that the architecture tests have a class of miscellaneous rather than inventory. Per OVAL specification Version 5.10.1 Revision 1 an oval class of inventory "describes OVAL Definitions that check to see if a piece of software is installed on a system." Signed-off-by: Kevin Spargur <kspargur(a)redhat.com> Kevin Spargur (1): Broke apart auditd rules/prose for time changes, broke out architecture tests .../src/input/checks/audit_rules_time_adjtimex.xml | 57 +++++++++ .../checks/audit_rules_time_clock_settime.xml | 57 +++++++++ .../input/checks/audit_rules_time_settimeofday.xml | 57 +++++++++ rhel6/src/input/checks/audit_rules_time_stime.xml | 41 +++++++ .../checks/audit_rules_time_watch_localtime.xml | 33 +++++ .../input/checks/system_info_architecture_x86.xml | 30 +++++ .../checks/system_info_architecture_x86_64.xml | 30 +++++ rhel6/src/input/profiles/common.xml | 8 +- rhel6/src/input/system/auditing.xml | 126 ++++++++++++++++++-- 9 files changed, 427 insertions(+), 12 deletions(-) create mode 100644 rhel6/src/input/checks/audit_rules_time_adjtimex.xml create mode 100644 rhel6/src/input/checks/audit_rules_time_clock_settime.xml create mode 100644 rhel6/src/input/checks/audit_rules_time_settimeofday.xml create mode 100644 rhel6/src/input/checks/audit_rules_time_stime.xml create mode 100644 rhel6/src/input/checks/audit_rules_time_watch_localtime.xml create mode 100644 rhel6/src/input/checks/system_info_architecture_x86.xml create mode 100644 rhel6/src/input/checks/system_info_architecture_x86_64.xml -- 1.7.7.6

2 2

SCAP Security Guide conference bridge
by Shawn Wells 20 Jun '12

20 Jun '12

Hey Guys, I created a conference bridge we can use for SCAP Security Guide meetings (DoD concensus calls, project status, anything and everything). I've posted the details to https://fedorahosted.org/scap-security-guide/wiki/conferenceline. -Shawn

2 1

[PATCH 0/9] More CCI mappings
by Willy Santos 19 Jun '12

19 Jun '12

More mappings of current content to DISA CCI numbers. Created rule to set the maximum amount of concurrent logins per user in order to satisfy a OS SRG requirement. Willy Santos (9): Added Rule to set the maximum amount of concurrent login sessions per user. Mapped rule to CCI-000054 which requires the operating system to limit the number of concurrent sessions for each account. Fixed placement of Value tags for max login rule. OVAL check for maximum login sessions rule. Mapped CCI-000158 to enable_auditd_service in auditing.xml Mapped CCI-000213 to unmet_impractical_guidance in srg_support.xml Mapped CCI-000221 to unmet_impractical_guidance in srg_support.xml Mapped CCI-000347 to auditd_configure_rules in auditing.xml Mapped CCI-000345 to met_inherently in srg_support.xml Mapped CCI-000346 to met_inherently in srg_support.xml rhel6/src/input/auxiliary/srg_support.xml | 4 +- .../accounts_max_concurrent_login_sessions.xml | 34 ++++++++++++++++++++ rhel6/src/input/system/accounts/session.xml | 32 ++++++++++++++++++- rhel6/src/input/system/auditing.xml | 4 +- 4 files changed, 69 insertions(+), 5 deletions(-) create mode 100644 rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml -- 1.7.7.6

2 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2012