Inconsistent guidance and tests for disabling kernel modules (e.g. disable_protocol_dccp)
by Philip Shuman
A number of the kernel modules that need to be disabled have
inconsistent guidance and tests. The guidance says to add a file in
/etc/modprobe.d/ with the content:
"install <module> /bin/true"
However, the actual check in the scan tests for:
"install <module> /bin/false"
This is a list of the ones I found:
$ cd scap-security-guide/RHEL6/dist/content
$ grep -h install * | grep -E
"rds|ticp|usb-storage|cramfs|freevsfs|jffs2|hfs|hfsplus|squashfs|udf|dccp|sctp"
| grep -E "true|false"
<ind:pattern operation="pattern
match">^\s*install\s+hfs\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+sctp\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+rds\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+jffs2\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+cramfs\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+dccp\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+udf\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+hfsplus\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+squashfs\s+/bin/false$</ind:pattern>
<ind:pattern operation="pattern
match">^\s*install\s+usb-storage\s+/bin/false$</ind:pattern>
<xhtml:pre xml:space="preserve">install usb-storage /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install cramfs /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install freevsfs /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install jffs2 /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install hfs /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install hfsplus /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install squashfs /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install udf /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install dccp /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install sctp /bin/true</xhtml:pre>
<xhtml:pre xml:space="preserve">install rds /bin/true</xhtml:pre>
Either /bin/true or /bin/false should work to disable the modules.
Setting our files to /bin/false causes the scans to pass right now.
Thanks,
Philip
11 years, 1 month
[PATCH] Replace xsl:attribute name="xmlns" with xsl:element
by Gary Gapinski
libxslt 1.1.27 now (correctly) prohibits xsl:attribute with name="xmlns".
This change uses an explicit xsl:element with explicit namespace.
This change should be removed (in favor of just identity transform)
when input document has desired explicit namespace declaration.
Gary Gapinski (1):
Remove invalid attempt to use xsl:attribute to set xmlns. Replace
with xsl:element with explicit namespace (namely, XCCDF 1.1).
Note that this overrides any namespace set in input document.
This should be removed when input document has explicit namespace
declaration.
RHEL6/transforms/shorthand2xccdf.xslt | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--
1.7.10.4
11 years, 1 month
patch to the xccdf-addfixes.xslt to get it to work
by Brian Millett
RHEL-6, libxslt-1.1.26
Ok, so now when I try to make with fixes, the following errors happen:
Attribute nodes must be added before any child nodes to an element.
runtime error: file transforms/xccdf-addfixes.xslt line 37 element copy
The patch is
[root@localhost transforms]# diff -wruN xccdf-addfixes.xslt.orig
xccdf-addfixes.xslt
--- xccdf-addfixes.xslt.orig 2013-02-01 14:40:40.580808238 -0600
+++ xccdf-addfixes.xslt 2013-02-01 14:35:31.607797643 -0600
@@ -11,7 +11,8 @@
<xsl:template match="xccdf:Rule">
<xsl:copy>
<!-- deal with the fact that oscap demands fixes stand only before
checks -->
- <xsl:apply-templates select="@*|node()[not(self::xccdf:check)]"/>
+ <xsl:copy-of select="@*" />
+ <xsl:apply-templates select="node()[not(self::xccdf:check)]"/>
<xsl:variable name="rule_id" select="@id"/>
<xsl:for-each select="$fixgroup/xccdf:fix">
And it works.
Nice way to end the week!
--
Brian Millett
"Shifts in paradigms
often cause nose bleeds."
Greg Glenn
11 years, 1 month
Initial setup
by Christopher Anderson
Walking through the initial setup was pretty quick an easy. I had no problems with the main wiki page and the usage guide page. I did find what appear to be small errors here and there, which I'll walk through.
The page titled "Becoming an SCAP Security Guide Developer" (https://fedorahosted.org/scap-security-guide/wiki/becomeadeveloper) seems to have a few issues.
First, under "Establishing your Accounts", there are three items all numbered 1.
Second, under "Performing your first git clone", the command example shows acquiring the source via git and the ssh protocol. This should fail as the Fedora Account setup and request to join this group (and gaining ssh access) happens in step 6 of the next section. Consider changing the protocol to git:
git clone git://git.fedorahosted.org/git/scap-security-guide.git
Third, under "Submitting Proposed Changes" step 1, the command example asks the user to ensure their changes are valid by running "make; make validate" without specifying a directory. With a little experimentation it is easy to figure out that "make" will work from the top level directory in the source tree, but "make validate" must be run from the RHEL6 directory. I'm not sure if validate should be added to the top level Makefile, or if a rewording of the item to clarify would be better.
With the exception of that page, I haven't found anything else. The pages are well thought out and I have yet to find even a spelling error in the wiki.
Chris
11 years, 1 month
[PATCH] Correct prototype namespace and schema location
by Gary Gapinski
RHEL6/input/guide.xml lacked a namespace declaration for <Benchmark>
as well as citing a non-existent relative URI for schema location.
Gary Gapinski (1):
Correct xsi:schemalocation to cite XCCDF 1.1.4 schema. Place
<Benchmark> element in XCCDF namespace.
RHEL6/input/guide.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
1.7.10.4
11 years, 1 month
Account lockout problems in RHEL6.3
by Philip Shuman
I'm in the process of implementing lockdowns for RHEL 6.3 based on the draft
scap-security-guide as downloaded via git.
The account lockout timeouts in /etc/pam.d/ have proven problematic for me.
There are a couple issues I wanted to bring up.
First, the current security guide checks for unlock_time=100000000 in the
/etc/pam.d/ files; however, the max value that pam_faillock.so will accept
is 604800. Anything larger than this value results in unlock_time defaulting
back to 600 seconds.
>From Linux-PAM-1.1.1/modules/pam_faillock/pam_faillock.c:
...
#define MAX_TIME_INTERVAL 604800 /* 7 days */
...
else if (strncmp(argv[i], "unlock_time=", 12) == 0) {
unsigned int temp;
if (sscanf(argv[i]+12, "%u", &temp) != 1 ||
temp > MAX_TIME_INTERVAL) {
pam_syslog(pamh, LOG_ERR,
"Bad number supplied for unlock_time argument");
} else {
opts->unlock_time = temp;
}
}
Second, the STIG guidance asks for the authfail and authsucc lines to be
added directly below pam_env.so. I've found that causes login prompt to
never reach asking for a password, both on the console and when running X. I
am using the example provided below additionally uses the preauth line
before pam_unix.so and that is working as I would expect:
https://access.redhat.com/knowledge/solutions/62949
auth required pam_env.so
auth required pam_faillock.so preauth silent audit deny=3
unlock_time=600
auth sufficient pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=3
auth sufficient pam_faillock.so authsucc audit deny=3
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
(Tip: remove the "silent" from the preauth line for testing. faillock will
tell you when it is kicking in to block a user. Remove for production so you
don't leak valid usernames.)
Third, when implemented, this long lock time does not persist a reboot. A
locked user is able to login after rebooting the machine. Is this expected?
I apprciate any help or working example system-auth or password-auth files.
Best regards,
Philip
11 years, 1 month
libxslt-1.2.27 appears to be really brain dead
by Brian Millett
[bpm]$ rpm -qa | grep libxslt
libxslt-1.1.27-2.fc18.x86_64
libxslt-devel-1.1.27-2.fc18.x86_64
libxslt-python-1.1.27-2.fc18.x86_64
Ok, so I've been working really hard to understand why the xsltproc
commands just were not working as advertised in the make file for the
latest (20130201) git clone of scap-security-guide. I've got a fedora 18
system with the libxslt1.1.27-2 packages. Well, the build just breaks.
The following commands work, they just do not produce the desired output
xsltproc -stringparam notes "../input/auxiliary/transition_notes.xml" -o
output/table-rhel5-stig-manual-withnotes.html \
transforms/xccdf2table-stig.xslt \
references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml
xsltproc -stringparam profile "stig-rhel6-server" -stringparam testinfo "y"
-o output/table-stig-rhel6-server-shorttitles.html \
transforms/xccdf2table-profileccirefs.xslt \
output/unlinked-rhel6-xccdf.xml
xsltproc -stringparam alttitles "../input/auxiliary/alt-titles-stig.xml" -o
output/unlinked-stig-rhel6-xccdf.xml \
transforms/xccdf-alt-titles.xslt \
output/unlinked-rhel6-xccdf.xml
xsltproc -stringparam profile "stig-rhel6-server" -o
output/table-stig-rhel6-server.html \
transforms/xccdf2table-profileccirefs.xslt \
output/unlinked-stig-rhel6-xccdf.xml
xsltproc --html -o output/table-stig-rhel6-server.html
transforms/table-add-vulnids.xslt output/table-stig-rhel6-server.html
xsltproc -stringparam profile "stig-rhel6-server" -stringparam format
"flat" -o output/table-stig-rhel6-server-flat.html \
transforms/xccdf2table-profileccirefs.xslt \
output/unlinked-stig-rhel6-xccdf.xml
So I did a git clone on a new RHEL-6 box which has libxslt-1.1.26 and guess
what?? IT WORKS.
So, this is beyond my pay grade. But at least I know that for this, I'm
not insane. I had my doughts after spending 2 days staring at the
xccdf2table-profileccirefs.xslt and xccdf-addfixes.xslt wondering why they
were not working.
So, I'll stay on RHEL-6 for now to understand the build process better.
Thanks.
--
Brian Millett
"Shifts in paradigms
often cause nose bleeds."
Greg Glenn
11 years, 1 month
patch to the RHEL6/Makefile
by Brian Millett
When running make, I get the following error
Duplicate ID, which will not be added: state_mode_0000
Duplicate ID, which will not be added: state_uid_0
Duplicate ID, which will not be added: state_gid_0
xmllint --format --output output/unlinked-rhel6-oval.xml output/unlinked-rhel6-oval.xml
transforms/cpe_generate.py output/unlinked-rhel6-oval.xml input/checks/platform/rhel6-cpe-dictionary.xml ssg
transforms/relabelids.py unlinked-rhel6-xccdf.xml ssg
transforms/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml ssg
mkdir -p dist/guide dist/content dist/policytables
cp output/rhel6-guide.html dist/guide
cp output/ssg-rhel6-xccdf.xml dist/content
cp output/ssg-rhel6-oval.xml dist/content
cp: cannot stat ‘output/ssg-rhel6-oval.xml’: No such file or directory
patch to get it to make correctly
[bpm]$ diff -wruN Makefile.orig Makefile
--- Makefile.orig 2013-01-30 13:47:55.554661112 -0600
+++ Makefile 2013-01-30 13:48:07.914662435 -0600
@@ -109,6 +109,7 @@
$(TRANS)/cpe_generate.py $(OUT)/unlinked-rhel6-oval.xml $(IN)/checks/platform/rhel6-cpe-dictionary.xml $(ID)
$(TRANS)/relabelids.py unlinked-rhel6-xccdf.xml $(ID)
$(TRANS)/relabelids.py unlinked-ocilrefs-rhel6-xccdf.xml $(ID)
+ $(TRANS)/relabelids.py unlinked-rhel6-oval.xml $(ID)
# not ready until oscap resolve behavior resolved
content-stig: shorthand2xccdf guide checks
--
Brian Millett
"I'd like to live just long enough to be there when they cut off your
head and stick it on a pike as a warning to the next ten generations
that some favors some with too high a price. I want to look up into
your lifeless eyes and wave like this. Can you and your associates
arrange that for me, Mr. Morden?"
-- [ Vir (re: What do you want?), "In the Shadow of Z'Ha'Dum"]
11 years, 1 month