[PATCH 00/26] More CCI Mappings
by Willy Santos
More CCI mappings in support of the OS SRG compliance efforts. Note that any mapping to requirement_unclear is meant for discussion by the group and all suggestions are welcome.
Willy Santos (26):
Changed mapping of CCI-000386 from requirement_unclear to
met_inherently as suggested by Shawn Wells.
Removed mapping of CCI-001092 from requirement_unclear, based on
discussion/input from Shawn Wells.
Mapped CCI-001092 to iptables_icmp_disabled and enable_iptables
enable_ip6tables.
Mapped CCI-001092 to password_retry.
Mapped CCI-000024 to requirement_unclear.
Mapped CCI-000025 to requirement_unclear.
Mapped CCI-000026 to requirement_unclear.
Mapped CCI-000027 to requirement_unclear.
Mapped CCI-000028 to requirement_unclear.
Mapped CCI-000029 to requirement_unclear.
Mapped CCI-000030 to requirement_unclear.
Mapped CCI-000032 to requirement_unclear.
Mapped CCI-00034 to met_inherently.
Mapped CCI-00035 to met_inherently.
Mapped CCI-001250 to gconf_gnome_disable_automount.
Mapped CCI-000085 to gconf_gnome_disable_automount.
Mapped CCI-000085 to service_autofs_disabled.
Mapped CCI-000085 to bios_disable_usb_boot.
Mapped CCI-000085 to bootloader_nousb_argument.
Mapped CCI-000085 to kernel_module_usb-storage_removed.
Mapped CCI-000085 to gconf_gnome_disable_automount.
Mapped CCI-000099 to requirement_unclear.
Mapped CCI-000157 to met_inherently.
Mapped CCI-000185 to network_ssl_enable_client_support.
Made changes requested by Jeff Blank to accommodate changes made on
his commit.
Mapped CCI-000186 to met_inherently.
rhel6/src/input/auxiliary/srg_support.xml | 10 +++++-----
rhel6/src/input/system/accounts/pam.xml | 2 +-
rhel6/src/input/system/network/iptables.xml | 6 +++---
rhel6/src/input/system/network/ssl.xml | 2 +-
rhel6/src/input/system/permissions/mounting.xml | 12 ++++++------
5 files changed, 16 insertions(+), 16 deletions(-)
--
1.7.7.6
11 years, 5 months
[PATCH] new Rule and check for disabling local accounts
by Jeffrey Blank
this meets some OS SRG reqs as well
Jeffrey Blank (1):
added new Rule and check to disable inactive accounts *
inactivity is defined as time following automatic password
expiration * also added relevant CCI refs
rhel6/src/input/auxiliary/srg_support.xml | 13 +++++-
.../checks/accounts_disable_post_pw_expiration.xml | 39 +++++++++++++++++
rhel6/src/input/guide.xslt | 1 +
rhel6/src/input/profiles/test.xml | 12 ++---
.../accounts/restrictions/account_expiration.xml | 46 ++++++++++++++++++++
5 files changed, 102 insertions(+), 9 deletions(-)
create mode 100644 rhel6/src/input/checks/accounts_disable_post_pw_expiration.xml
create mode 100644 rhel6/src/input/system/accounts/restrictions/account_expiration.xml
11 years, 5 months
[PATCH 00/25] More CCI mappings
by Willy Santos
Another set of CCI mappings.
Willy Santos (25):
Mapped CCI-1127 to network_ssl.
Mapped CCI-001154 to set_iptables_default_rule
Mapped CCI-001250 to kernel_module_usb-storage_disabled.
Mapped CCI-001250 to kernel_module_usb-storage_removed.
Mapped CCI-001250 to bootloader_nousb_argument.
Mapped CCI-001250 to kernel_module_usb-storage_removed.
Mapped CCI-001250 to service_autofs_disabled.
Mapped CCI-001343 to new_rule_needed.
Mapped CCI-001348 to rsyslog_remote_loghost.
Mapped CCI-001493 to met_inherently.
Mapped CCI-001494 to met_inherently.
Mapped CCI-001495 to met_inherently.
Mapped CCI-001557 to service_rsyslog_enabled
Mapped CCI-000017 to new_rule_needed.
Mapped CCI-000052 to new_rule_needed.
Mapped CCI-000053 to new_rule_needed.
Mapped CCI-000226 to met_inherently.
Mapped CCI-000386 to requirement_unclear.
Mapped CCI-001092 to requirement_unclear.
Mapped CCI-00197 to requirement_unclear.
Mapped CCI-001096 to met_inherently.
Mapped CCI-001128 to network_ssl.
Mapped CCI-001135 to network_ssl.
Mapped CCI-001135 to package_openswan_installed.
Mapped CCI-001135 to sshd_allow_only_protocol2.
rhel6/src/input/auxiliary/srg_support.xml | 5 +++--
rhel6/src/input/services/ssh.xml | 2 +-
rhel6/src/input/system/logging.xml | 4 ++--
rhel6/src/input/system/network/ipsec.xml | 2 +-
rhel6/src/input/system/network/iptables.xml | 2 +-
rhel6/src/input/system/network/ssl.xml | 2 +-
rhel6/src/input/system/permissions/mounting.xml | 10 +++++-----
7 files changed, 14 insertions(+), 13 deletions(-)
--
1.7.7.6
11 years, 5 months
[PATCH] added more CCI references to Rules, to support documentation of OS SRG satisfaction
by Jeffrey Blank
Also, I need to add Rules for automatic account expiration to handle some of the OS SRG reqs.
Oddly, we seem to have OVAL for this and it's in the USGCB but not in our XCCDF.
(This means adding a Rule (plus Value) to discuss EXPIRE= in /etc/default/useradd.)
Jeffrey Blank (1):
added CCIs to move OS SRG mapping forward
rhel6/src/input/auxiliary/srg_support.xml | 19 +++++++++++++------
rhel6/src/input/services/ssh.xml | 2 +-
rhel6/src/input/system/auditing.xml | 7 ++++---
rhel6/src/input/system/software/updating.xml | 4 ++--
4 files changed, 20 insertions(+), 12 deletions(-)
11 years, 5 months
[PATCH 0/4] ability to view pre-release draft RHEL 6 STIG profile, prose cleanup
by Jeffrey Blank
The major goal of this commit is to provide the ability for consumers to easily view
the project's Rules as "requirements" for the pre-release draft RHEL 6 STIG.
This will help ensure productive consensus group meetings, by
ensuring participants can view the Rules and generate feedback prior to the meetings.
Usage of the project also ensures effective capture of consensus decisions.
Mapping of the CCIs from the OS SRG continues (in parallel), which is an
essential element for submitting the content as a STIG.
Jeffrey Blank (4):
added Makerule, transform to create table for RHEL 6 STIG Profile
(Pre-release Draft)
cleanup of prose for sysctl network parameter settings *
expurgated weird CCE description text * introduced usage of
new macros for XCCDF sysctl description
cleanup of prose for rsyslog logging * OVAL for these remains
difficult * can we grab a filename from a text file, and then
run tests on it?
cleanup of prose for iptables
rhel6/src/Makefile | 8 +-
rhel6/src/input/profiles/STIG-server.xml | 5 +-
rhel6/src/input/system/logging.xml | 220 +++++++++++-------
rhel6/src/input/system/network/iptables.xml | 51 +++--
rhel6/src/input/system/network/kernel.xml | 242 ++++++++++----------
rhel6/src/transforms/shorthand2xccdf.xslt | 15 ++
rhel6/src/transforms/xccdf-addprofiles.xslt | 1 +
.../src/transforms/xccdf2table-profileccirefs.xslt | 170 ++++++++++++++
8 files changed, 481 insertions(+), 231 deletions(-)
create mode 100644 rhel6/src/transforms/xccdf2table-profileccirefs.xslt
11 years, 5 months
[PATCH 0/8] More CCI Mappings
by Willy Santos
Another batch of CCI-Mappings.
Willy Santos (8):
Mapped CCI-001130 to install_openswan
Mapped CCI-001130 to network_ssl
Mapped CCI-001131 to install_openswan
Mapped CCI-001131 to network_ssl
Mapped CCI-001133 to sshd_idle_timeout
Mapped CCI-001144 to sshd_use_approved_ciphers
Mapped CCI-001145 to sshd_use_approved_ciphers
Mapped CCI-001146 to sshd_use_approved_ciphers
rhel6/src/input/services/ssh.xml | 4 ++--
rhel6/src/input/system/network/ipsec.xml | 2 +-
rhel6/src/input/system/network/ssl.xml | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
--
1.7.7.6
11 years, 5 months
[PATCH 0/5] More CCI mappings
by Willy Santos
More CCI Mappings.
Willy Santos (5):
Mapped CCI-000381 to principle-minimize-software
Mapped CCI-000382 to principle-minimize-software
Mapped CCI-000776 to sshd_allow_only_protocol2
Mapped CCI-000774 to sshd_allow_only_protocol2
Mapped CCI-000872 to met_inherently
rhel6/src/input/auxiliary/srg_support.xml | 2 +-
rhel6/src/input/intro/intro.xml | 1 +
rhel6/src/input/services/ssh.xml | 1 +
3 files changed, 3 insertions(+), 1 deletions(-)
--
1.7.7.6
11 years, 5 months
[PATCH 0/1] Broke apart auditd rules/prose for time changes
by Kevin Spargur
Broke apart the auditd rule for time changes into individual elements
to better support being able to define these rules in a variety of ways.
Also added a couple generic architecture tests. Note that the architecture
tests have a class of miscellaneous rather than inventory. Per OVAL
specification Version 5.10.1 Revision 1 an oval class of inventory "describes
OVAL Definitions that check to see if a piece of software is installed on a
system."
Signed-off-by: Kevin Spargur <kspargur(a)redhat.com>
Kevin Spargur (1):
Broke apart auditd rules/prose for time changes, broke out
architecture tests
.../src/input/checks/audit_rules_time_adjtimex.xml | 57 +++++++++
.../checks/audit_rules_time_clock_settime.xml | 57 +++++++++
.../input/checks/audit_rules_time_settimeofday.xml | 57 +++++++++
rhel6/src/input/checks/audit_rules_time_stime.xml | 41 +++++++
.../checks/audit_rules_time_watch_localtime.xml | 33 +++++
.../input/checks/system_info_architecture_x86.xml | 30 +++++
.../checks/system_info_architecture_x86_64.xml | 30 +++++
rhel6/src/input/profiles/common.xml | 8 +-
rhel6/src/input/system/auditing.xml | 126 ++++++++++++++++++--
9 files changed, 427 insertions(+), 12 deletions(-)
create mode 100644 rhel6/src/input/checks/audit_rules_time_adjtimex.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_clock_settime.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_settimeofday.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_stime.xml
create mode 100644 rhel6/src/input/checks/audit_rules_time_watch_localtime.xml
create mode 100644 rhel6/src/input/checks/system_info_architecture_x86.xml
create mode 100644 rhel6/src/input/checks/system_info_architecture_x86_64.xml
--
1.7.7.6
11 years, 5 months
[PATCH 0/9] More CCI mappings
by Willy Santos
More mappings of current content to DISA CCI numbers. Created rule to set the maximum amount of concurrent logins per user in order to satisfy a OS SRG requirement.
Willy Santos (9):
Added Rule to set the maximum amount of concurrent login sessions per
user. Mapped rule to CCI-000054 which requires the operating system
to limit the number of concurrent sessions for each account.
Fixed placement of Value tags for max login rule.
OVAL check for maximum login sessions rule.
Mapped CCI-000158 to enable_auditd_service in auditing.xml
Mapped CCI-000213 to unmet_impractical_guidance in srg_support.xml
Mapped CCI-000221 to unmet_impractical_guidance in srg_support.xml
Mapped CCI-000347 to auditd_configure_rules in auditing.xml
Mapped CCI-000345 to met_inherently in srg_support.xml
Mapped CCI-000346 to met_inherently in srg_support.xml
rhel6/src/input/auxiliary/srg_support.xml | 4 +-
.../accounts_max_concurrent_login_sessions.xml | 34 ++++++++++++++++++++
rhel6/src/input/system/accounts/session.xml | 32 ++++++++++++++++++-
rhel6/src/input/system/auditing.xml | 4 +-
4 files changed, 69 insertions(+), 5 deletions(-)
create mode 100644 rhel6/src/input/checks/accounts_max_concurrent_login_sessions.xml
--
1.7.7.6
11 years, 5 months