Aqueduct IRC Channel
by Vincent Passaro
Jeff,
For the helping out, we can use the Aqueduct channel for coordinating who's working on what.
IRC: #aqueduct on freenode.net
Vince = tummy
Lee Kinser = [~syn]
R/
Vincent C. Passaro
CISSP, L|PT, E|CSA, C|EH, CEPT, CPT, LPIC-3 (Core/Security), RHCSA, Novell CLA, MCP, Security+, A+
CELL: 760-846-1812
Office: 888-75-FOTIS
Fax: 617-454-1121
vincent.passaro(a)fotisnetworks.com<mailto:vincent.passaro@fotisnetworks.com>
www.fotisnetworks.com<http://www.fotisnetworks.com>
11 years, 8 months
People page updated
by Shawn Wells
for those tracking/watching the changes, I've just refreshed my people
page (which updates the content linked from the wiki). The new updates
contain the following change sets:
$ git pull
remote: Counting objects: 97, done.
remote: Compressing objects: 100% (79/79), done.
remote: Total 79 (delta 62), reused 0 (delta 0)
Unpacking objects: 100% (79/79), done.
From ssh://git.fedorahosted.org/git/scap-security-guide
2de2cf5..c0cab13 master -> origin/master
Updating 2de2cf5..c0cab13
Fast-forward
RHEL6/input/auxiliary/srg_support.xml | 6 +-
.../accounts_passwords_pam_faillock_deny.xml | 50 ++++++++
.../checks/securetty_root_login_console_only.xml | 2 +-
RHEL6/input/profiles/STIG-server.xml | 2 +
RHEL6/input/system/accounts/banners.xml | 3 +-
RHEL6/input/system/accounts/pam.xml | 25 +++-
RHEL6/input/system/permissions/execution.xml | 134
++++++++++----------
RHEL6/input/system/permissions/files.xml | 4 +-
RHEL6/input/system/software/integrity.xml | 29 +++++
9 files changed, 173 insertions(+), 82 deletions(-)
create mode 100644
RHEL6/input/checks/accounts_passwords_pam_faillock_deny.xml
11 years, 8 months
[PATCH] prose cleanup for execution.xml's XCCDF
by Jeffrey Blank
Looking for volunteer to deal with ticket 103 (and to inspect other OVAL associated with
XCCDF in execution.xml).
Jeffrey Blank (1):
prose cleanup for execshield, daemon umask, core dumps * note
that a ticket was also issued for the OVAL, which had problems
RHEL6/input/system/permissions/execution.xml | 134 +++++++++++++-------------
1 files changed, 66 insertions(+), 68 deletions(-)
11 years, 8 months
[PATCH] Fixed root virtual console logins check.
by Mike Palmiotto
Shouldn't we be doing a "none_exist" check on this one?
Signed-off-by: Michael Palmiotto <mpalmiotto(a)tresys.com>
---
.../checks/securetty_root_login_console_only.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/securetty_root_login_console_only.xml b/RHEL6/input/checks/securetty_root_login_console_only.xml
index c3472e6..1bb1de3 100644
--- a/RHEL6/input/checks/securetty_root_login_console_only.xml
+++ b/RHEL6/input/checks/securetty_root_login_console_only.xml
@@ -15,7 +15,7 @@
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="virtual consoles /etc/securetty" id="test_virtual_consoles_etc_securetty" version="1">
+ <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="test_virtual_consoles_etc_securetty" version="1">
<ind:object object_ref="object_virtual_consoles_etc_securetty" />
</ind:textfilecontent54_test>
--
1.7.1
11 years, 8 months
[PATCH 0/3] More updates based on DISA FSO feedback
by Willy Santos
Updates based on DISA FSO feedback for STIG profile.
Willy Santos (3):
Added value selector for dod_short and commented value selector for
any_text; as reference in trac ticket #95
Mapped CCI-224 to no_files_unowned_by_user and
no_files_unowned_by_group.
Created group and added prose for use of antivirus.
RHEL6/input/auxiliary/srg_support.xml | 4 ++--
RHEL6/input/system/accounts/banners.xml | 3 ++-
RHEL6/input/system/permissions/files.xml | 4 ++--
RHEL6/input/system/software/integrity.xml | 14 ++++++++++++++
4 files changed, 20 insertions(+), 5 deletions(-)
--
1.7.7.6
11 years, 8 months
Content and profile management with SecState
by Spencer R. Shimko
Hi,
I wanted show off some of the features that are unique to SecState and are very relevant to this project. All of you are likely familiar with oscap. This tool is great if your use case includes interpreting entire sets of content described in a profile. However, if you want to tweak a profile you must adjust the XML by hand. SecState is capable of content management. You can cherry pick elements relevant to your environment.
What follows is an example of using SecState for the purpose.
First you import a profile (thanks to SSG for the content!):
# secstate import /usr/local/scap-security-guide/RHEL6/output/rhel6-xccdf-scap-security-guide.xml
Next you disable content you don't want to interpret. This is great when you want to enter a continuous monitoring mode and you want to trim down the result sets.
# secstate select -r RHEL-6 intro
Then you run the audit:
# secstate audit
Remediate the findings (thanks to Aqueduct for the content!).
# secstate remediate -y
I would recommend re-running the audit to ensure the findings are fixed:
# secstate audit
The reports it generates can be seen here:
http://oss.tresys.com/spencer/audit-localhost.localdomain-Sun-July-15-23_...
I've uploaded some packages from CLIP here and created a yum repo:
http://oss.tresys.com/files/clip/secstate-ssg-aqueduct-alpha/
My rationale for this email is that I need others, particularly those developing SCAP content, to use and advocate the use of this tool. It provides a great feature set not available in other tools.
Thanks,
--Spencer
11 years, 8 months