* [Fedora] OVAL check for sshd disable empty passwords
Rewrite the rule checking if SSH logins from accounts
with empty passwords are allowed. Permit the rule to
succeed only if some of the following is met:
* sshd service is disabled,
* default sshd config is used (sshd defaults to 'PermitEmptyPasswords no'),
* in customized sshd config 'PermitEmptyPasswords no' (
disabling the access) is not preceded by (uncommented occurrence)
of 'PermitEmptyPasswords yes' (enabling access)
The comments were kept in the patch intentionally to:
* describe regular expressions used,
* mention sshd_config behaviour (so me / someone
else doesn't need to waste time on the format
in the future).
After testing at RHEL-6 could be probably moved to /shared dir.
* [Fedora] Unselect no shelllogin for systemaccounts rule from being run by default
Since it has been found to cause / have some issues. See e.g.:
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
FYI -- RHEL7 public beta is now out! Will be creating a new SSG branch
Lets kickoff the RHEL7 STIG process ASAP. How about a community call
next Weds, 18-DEC, at 1030 EST? This will give us the chance to chat
through how the RHEL7 STIG will be generated, start breaking down tasks,
and chatting through a rough project plan/deadline. Much of the
conversation will be driven by the RH/NSA/DISA FSO stakeholders, though
transparency will help drive community awareness/involvement.
I'll be damned if we don't get a RHEL7 STIG squared away prior to RHEL7
GA (yeah yeah, famous last words...).
-------- Original Message --------
Subject: Red Hat Enterprise Linux 7 Beta Now Available
Date: Wed, 11 Dec 2013 10:42:19 -0500 (EST)
Today marks an exciting milestone for Red Hat as we share news of the
beta availability of Red Hat Enterprise Linux 7. Since its introduction
more than a decade ago <http://www.redhat.com/10yearsofrhel/>, Red Hat
Enterprise Linux <http://rhel.redhat.com/> has become the world’s
leading enterprise Linux platform, and it has helped set industry
standards for performance <http://rhel.redhat.com/performance>, capacity
<http://rhel.redhat.com/capability> and security
Red Hat Enterprise Linux is a leading force in enterprise datacenters;
it spans nearly every industry and has advanced to deliver the original
cloud operating system
powering many of the world’s largest clouds.
With today’s announcement
we are inviting Red Hat customers, partners, and members of the public
to provide feedback on what we believe is our most ambitious release to
date. Red Hat Enterprise Linux 7 is designed to provide the underpinning
for future application architectures while delivering the flexibility,
scalability, and performance needed to deploy across bare metal, virtual
machines, and cloud infrastructure.
We believe that Red Hat Enterprise Linux 7 represents the future of IT.
As hypervisors and cloud deployments become increasingly common and face
integration with physical servers, Red Hat Enterprise Linux 7 continues
Red Hat's track record of cultivating a foundation upon which to build
next-generation IT infrastructure. No other Linux operating system
combines the flexibility and stability needed to handle critical
workloads across all environments with as extensive an ecosystem of
solutions and support.
Based on Fedora 19 and the upstream Linux 3.10 kernel, Red Hat
Enterprise Linux 7 will provide users with powerful new capabilities
that streamline and automate installation and deployment, simplify
management, and enhance ease-of-use, all while delivering the stability
that enterprises have come to expect from Red Hat. This further
solidifies Red Hat Enterprise Linux’s place as the world’s leading Linux
platform and a standard for the enterprise of the future. Whether
rolling out new applications, virtualizing environments or scaling the
business with cloud, Red Hat Enterprise Linux 7 delivers the keystone to
The beta release of Red Hat Enterprise Linux 7 adds value to new and
existing IT projects across industries by adding key capabilities to
improve critical but often cumbersome IT tasks like virtualization and
storage while offering a clear pathway to the open hybrid cloud
<http://www.redhat.com/solutions/open-hybrid-cloud/>. Red Hat Enterprise
Linux 7 Beta showcases hundreds of new features and enhancements, including:
*Linux Containers*- Enabling applications to be created and deployed
in isolated environments with allocated resources and permissions.
*Performance Management* – Using built in tools, you can optimize
*Physical and Hosted In-place Upgrades *- In-place upgrades for
common server deployment types are now supported. Additionally,
virtual machine migration from a Red Hat Enterprise Linux 6 host to
a Red Hat Enterprise Linux 7 host is possible, without virtual
machine modification or downtime.
*File Systems* – File systems continue to be a major focus of
development and innovation.
XFS is now the default file system, supporting file systems up
ext4 file systems are now supported to 50TB and include block
sizes up to 1MB
btrfs file systems are now available to test
*Networking* – Enhanced networking configuration and operation.
Added support for some of the latest networking standards, including:
40Gb Ethernet support
Improved channel bonding
TCP performance improvements
Low latency socket poll support
*Storage* – Expanded support for enterprise level storage arrays.
Improved scalable storage stack for deployments that are less disk
intensive. Improved storage management for heterogeneous storage
*Windows Interoperability* – Bridge Windows™ and Linux
infrastructure by integrating SAMBA 4.1 with existing Microsoft
Active Directory domains. Or, deploy Red Hat Enterprise Linux
Identity Management in a parallel trust zone with Active Directory.
*Subsystem Management* – Simplified configuration and administration
with uniform management tools for networking, storage, file systems,
performance, identities and security. Leveraging the OpenLMI
framework, enables use of scripts and APIs to automate management.
Today’s beta announcement marks the beginning of our public journey to
introduce our vision for the future of enterprise computing. We’re
excited to be starting this public journey, and look forward to sharing
our vision with you starting with these key highlights of new and
enhanced capabilities and continuing on our new Red Hat Enterprise
Linux-focused blog, located at http://rhelblog.redhat.com/.
The Red Hat Enterprise Linux 7 beta is available to Red Hat customers,
partners, and members of the public. Those interested in trying the Red
Hat Enterprise Linux 7 Beta can download and install it
and tell us
what interests them most about the Beta.
Please visit the below resources for more information about Red Hat
Enterprise Linux 7 Beta.
Access the Red Hat Enterprise Linux 7 Beta today:
Access documentation for Red Hat Enterprise Linux 7 Beta (requires
Red Hat Enterprise Linux 7 Beta release notes:
Red Hat Enterprise Linux 7 Beta technical notes:
Red Hat Enterprise Linux documentation:
Follow updates about the Beta via the Red Hat Enterprise Linux Blog:
Frequently asked questions (FAQ), collateral, presentations and more are
available on the Product and Technologies (PnT) Portal (requires login) at:
Red Hat Enterprise Linux 7 (Beta):
Red Hat Enterprise Linux:
Please encourage your customers and partners to download and try Red Hat
Enterprise Linux 7 Beta. For additional details, review the FAQs on the
PnT Portal or submit a question as a MOMENTUM ticket through the left
navigation of Salesforce.com.
The Red Hat Enterprise Linux Team
A new version of the OSCAP Anaconda Addon integrating the OpenSCAP
toolkit with the Anaconda installer is now available for testing. Links
and documentation are available at project's main page:
[new in version 0.3]
* prevent segfaults caused by putting None into xccdf_session_*
* improved tests and testing
* support for entering archive/RPM content URL in GUI and automatic
detection of SCAP content files in such archives/RPMs
* UX improvements -- double-click selects profile, ENTER in URL entry
starts content fetching, URL entry has focus when no content is found
* added support for RPM content
[plans for 0.4]
* automatic detection of scap-security-guide if it is available in the
* support for XCCDF Tailoring files and thus nice integration with the
SCAP Workbench project
* better error handling (report errors and let user fix them instead of
raising exceptions in case of invalid content, invalid URL, etc.)
Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic
While working a bit more on the sysctl issue with net.ipv4.ip_forward and net.ipv4.conf.all.accept_redirects found another interesting tidbit. My boxes are stock installs, which includes the libvirtd service as an enabled service. I noticed that my /etc/sysctl.conf file explicitly had 'net.ipv4.ip_forward = 0', but the output of 'sysctl net.ipv4.ip_forward' shows a running value of '1'. This makes sense, as libvirtd I believe needs to be able to forward packets potentially between any virtual NICs on the system.
My question - is there a STIG that requires this service to be disabled or not installed. If not, then RHEL-06-000082 will never be satisfied. Bear in mind, I'm still working from the published RHEL6 STIG, not the SSG document at this time.
I had the exact same issue: we required a document (call it a guide) clearly stating what rules each profile included for each of our customers/profiles.
I worked around it by creating a copy of the open-scap's /usr/share/openscap/xsl/, and tweaked 'security-guide.xsl' to match my needs. Next, run oscap against it, eg, by adding to SSG's Makefile:
oscap xccdf generate custom --stylesheet tweaked-security-guide.xsl --profile customer-profile-1 $(OUT)/unlinked-notest-rhel-xccdf-guide.xml > $(OUT)/Guide-customer-profile-1.html
You should have some knowledge of XSLT to customize the transform; I had none, but with a bit of trial and error the result was satisfactory.
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
From: open-scap-list-bounces(a)redhat.com [mailto:firstname.lastname@example.org] On Behalf Of Sven Vermeulen
Sent: quinta-feira, 12 de Dezembro de 2013 06:53
To: Shawn Wells
Subject: Re: [Open-scap] oscap generate guide ignores profile
On Dec 12, 2013 3:37 AM, "Shawn Wells" <shawn(a)redhat.com<mailto:email@example.com>> wrote:
> On 12/11/13, 4:34 PM, WARREN wrote:
>> One of the useful facilities in openscap is to generate a "security guide"
>> When I run:
>> # oscap xccdf generate --profile Baseline guide --output \
>> BaselineGuide.html solaris-xccdf.xml
>> the guide produced includes everything from the XCCDF file and not
>> just for the "--profile" specified. I see a table at the end telling
>> me what would be selected (or not) for the profile selected, but it
>> seems to me that having everything in the guide is confusing, as the
>> different profiles call different checks (obviously) and having them
>> all there whether they are used or not seems like not the best idea.
>> Is there some way to turn off this "feature"? perhaps by manipulating
>> a style sheet? or should I call it a bug?
> It'd be incredibly useful to generate a true guide, versus a checklist, per profile.
I don't think that is possible without changing the XCCDF schema. The content of a guide is provided by Group tags whereas the checks are Rule tags.
Profiles are used to toggle Rules, not Groups, so openscap cannot know which Groups to include and which don't.
At least, that is my feeble impression on the XCCDF standard. Might be wrong though.
This patch reverts the Fedora change performed by:
At our internal meeting it has been suggested to me we don't want
direct Fedora release name in the HTML version of the guide, and
want supported CPEs listed under "Applicable platforms" section
of the guide instead.
So make it to follow that requirement.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team