[PATCH] [bugfixes] additional changes from STIG feedback
by David Smith
The following issues are addressed in this patch:
1) applicability statements for xinetd, IPv6, and ip6tables
2) added trailing spaces when using grep to check disk partition information
3) modified permissions check for grub.conf (now uses "ls -lL")
4) specified "-type f" when looking for library files not owned by root
David Smith (1):
additional patches following STIG feedback
RHEL6/input/services/obsolete.xml | 10 ++++++++--
RHEL6/input/system/accounts/physical.xml | 7 ++++++-
RHEL6/input/system/network/iptables.xml | 10 ++++++++--
RHEL6/input/system/network/ipv6.xml | 2 ++
RHEL6/input/system/permissions/files.xml | 2 +-
RHEL6/input/system/software/disk_partitioning.xml | 10 +++++-----
6 files changed, 30 insertions(+), 11 deletions(-)
11 years, 1 month
[PATCH 0/2] [bugfixes] following STIG feedback
by David Smith
Included are a number of content modifications following yesterday's meeting with FSO and Red Hat:
1) alt-titles-stig was changed to allow a Rule title to match its requirement
2) shorthand2xccdf was changed to modify the service enable macro so runlevels are now specified (2-5)
3) the other file changes largely involved allowing Fix and Check content to stand independently, as well as recommended wording changes
David Smith (2):
content changes reflective of FSO feedback
modified macro to specify runlevels with chkconfig
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +-
RHEL6/input/system/accounts/session.xml | 4 ++--
RHEL6/input/system/logging.xml | 14 ++++++++++++--
RHEL6/input/system/network/kernel.xml | 6 +++---
RHEL6/input/system/permissions/files.xml | 20 ++++++++++++++++++++
RHEL6/transforms/shorthand2xccdf.xslt | 2 +-
6 files changed, 39 insertions(+), 9 deletions(-)
11 years, 1 month
[PATCH 0/2] [bugfixes] addressing FSO feedback
by David Smith
These patches address tickets 281 (add library directories to Check text) and 295 (pwck invocation).
David Smith (2):
modified pwck invocation
added library directories to check text
.../accounts/restrictions/account_expiration.xml | 2 +-
.../accounts/restrictions/password_storage.xml | 2 +-
RHEL6/input/system/permissions/files.xml | 10 ++++++++--
3 files changed, 10 insertions(+), 4 deletions(-)
11 years, 1 month
Register Now: STIG & SCAP Workshop, Tues 26-MAR-2013
by Shawn Wells
With the recent DISA publication of the draft STIG, the timing seems
right to host a STIG workshop. NSA IAD and Red Hat will be hosting a
public STIG and SCAP workshop on _Tuesday 26-MAR-2013_. Additionally,
DISA FSO will be in attendance to hear feedback from the community. You
can register here:
https://engage.redhat.com/forms/stig-workshop
In the March 26th workshop we will:
* Share knowledge on the installation of SCAP Security Guide (SSG).
How to run a scan, how to customize settings, how to get a report that
you can show your ISSE/ISSM, and hw to generate a certification test
plan based on your customized rules.
* Go a bit deeper, and understand how the code works. Answering
questions like: "What is XCCDF, OVAL, and OCIL?" "How can you add your
own custome rules?"
* Prep your environment to submit patches back to SSG, including
learning how to setup git and how to create a Fedora Hosted account.
* Chat about what additional profiles are needed. How should we
handle CNSSI 12-53? What about PCI compliance?
We'll go through Red Hat Enterprise Linux 6 SCAP content, including the
STIG, performing scans, and generating C&A artifacts. Attendees can take
this setup home and use it to start providing feedback against the RHEL6
STIG.
Sign up for the workshop!
Date: Tuesday March 26, 2013, with three 2-hour workshop intervals to
choose from. Limited availability per session!
MORNING SESSION: Red Hat Office, 8260 Greensboro Drive, Suite 300,
McLean, VA
Morning 0800-1000
AFTERNOON SESSIONS: NSA unclassified facility in the BWI area. Address
will be sent to registered attendees.
Afternoon: 1200 - 1400
Afternoon: 1430 - 1630
Registration at: https://engage.redhat.com/forms/stig-workshop
11 years, 1 month
[PATCH 0/3] [bugfixes] based on STIG feedback
by David Smith
This patchset resolves tickets based on STIG feedback.
David Smith (3):
[bugfix] ticket 285 - added Check language allowing forwarding for
routers
[bugfix] ticket 337 - added language to make Rules NA if no NFS
[bugfix] ticket 334 - added text allowing for Postfix to not be
installed if CDS
RHEL6/input/services/mail.xml | 6 ++----
RHEL6/input/services/nfs.xml | 6 ++++--
RHEL6/input/system/network/kernel.xml | 1 +
3 files changed, 7 insertions(+), 6 deletions(-)
11 years, 1 month
[PATCH 0/5] [bugfixes] more ticket resolution
by David Smith
pushing more fixes to resolve tickets
David Smith (5):
[bugfix] ticket 297 - added maxlogins value
[bugfix] ticket 334 - added text exempting CDSes from Postfix
requirement
[bugfix] ticket 293 - added info to Ctrl-Alt-Del Rule
[bugfix] ticket 299 - added finding statement
[bugfix] ticket 332 - cleaned up file deletion audit Rule
RHEL6/input/services/mail.xml | 5 ++++-
RHEL6/input/system/accounts/physical.xml | 8 ++++----
.../accounts/restrictions/account_expiration.xml | 3 ++-
RHEL6/input/system/accounts/session.xml | 8 +++-----
RHEL6/input/system/auditing.xml | 2 --
5 files changed, 13 insertions(+), 13 deletions(-)
11 years, 1 month
[PATCH 0/4] [bugfixes] various changes for ticket resolution
by David Smith
Resolved a number of tickets with these.
David Smith (4):
changed Rule to enable postfix
changed LSM to SELinux
changed unwieldy check command
specified "-type f" for permissions check
RHEL6/input/auxiliary/alt-titles-stig.xml | 8 ++++----
RHEL6/input/services/mail.xml | 2 +-
RHEL6/input/system/auditing.xml | 2 +-
RHEL6/input/system/permissions/files.xml | 2 +-
4 files changed, 7 insertions(+), 7 deletions(-)
11 years, 1 month
RE: scap-security-guide 0.1-10 help
by Rodrian, Logan P (IS)
Has this always been the case that the CPE/Dictionary is needed for oscap execution? I ask because if this is a new feature, I will ping the SecState list about when they will be including the Dictionary as an argument to their program. Currently, secstate imports only an xccdf and will not work with the SSG v0.1-10....trying to resolve why this is.
Logan Rodrian
________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org [scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Shawn Wells [shawn(a)redhat.com]
Sent: Thursday, March 07, 2013 11:05
To: scap-security-guide(a)lists.fedorahosted.org
Subject: EXT :Re: scap-security-guide 0.1-10 help
On 3/7/13 8:51 AM, Rodrian, Logan P (IS) wrote:
It appears that the full command is needed. The scan won't run without the cpe/dictionary reference. The minimal command needed is as follows:
oscap xccdf eval --profile <profile> \
--cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
Ah, yes. The --cpe is *very* much needed as it provides some platform checks. The others (--report, etc) are optional.
11 years, 1 month
SSG v0.1-10 Bugs/Notes
by Rodrian, Logan P (IS)
I have done some testing with the SSG v0.1-10 release (using openscap 0.9.4) and have found some bugs/notes. Each of the following seems to be an issue with the OVAL content/test.
* Ensure All Files Are Owned by a User
* This reports PASS for me, but is a false positive. Running 'find / -xdev -nouser -print' reveals files that have a user owner that is not local to the system.
* Ensure All Files Are Owned by a Group
* This reports PASS for me, but is a false positive. Running 'find / -xdev -nogroup -print' reveals files that have a group that is not local to the system.
* Set Daemon Umask
* The test states it is looking for a umask of 022 or 027. In my /etc/init.d/functions, the umask is 022, but the test reports FAIL. This is a false positive.
* Set GNOME Login Inactivity Timeout
* GNOME Desktop Screensaver Mandatory Use
* Enable Screen Lock Activation After Idle Period
* Implement Blank Screen Saver
* Enable GUI Warning Banner Text
* Each of these tests assume that the execution is on an X system. My system does not have X installed or running, so the tests report FAIL. The test should first check if it is applicable to the test system and if not report NOT APPLICABLE or something similar versus FAIL.
* Modify the System Login Banner
* This test appears to check for exactly the DoD banner text. Since the verbage states "a message compliant with the local site policy", suggest modifying the test to check for the presence of content in /etc/issue, but perhaps not an exact match, as not all deployments may be DoD systems.
* Ensure Host Logs Sent to Remote Host
* For TCP, this checks for the following in the rsyslog file:
*.* @(a)loghost.example.com
* Is the intent that absolutely ALL logs be sent remotely (with the *.*) or that in general they are? In my configuration, I have *.info versus the *.* and the test reports FAIL. I would like to understand the intent on this one so I can comply.
* Additionally, my filter portion excludes some logs marked via other ways (read in from files) with the string "*.info;local0.none @@dest-ip" and I want to make sure that even if my string needs to be modified to "*.*;local0.none @@dest-ip" to comply that the test will pass. i.e. that the test is robust enough to understand the negation in the rsyslog configuration and report the correct assessment value.
* Configure auditd space_left Action on Low Disk Space
* Configure auditd admin_space_left Action on Low Disk Space
* For both of these, the contents of /etc/audit/auditd.conf contain the correct key with a case-insensitive value (all caps value of one of the possible values) and the test reports FAIL. THis is a false negative. Suggest making the test case-insensitive in the value match portion.
* Disable Network Console (netconsole)
* Disable Network Router Discovery Daemon (rdisc)
* For both of these, the service is not active/installed, but the test reports FAIL. This is a false negative.
* Disable SSH Support for .rhosts Files
* Disable Host-Based Authentication
* Disable SSH Root Login
* For all of these, the required value is present in its entirety, but is preceeded by the comment character, making it inactive. The test reports PASS, which is a false positive.
* Additionally, for the SSH Root Login test, the commented value is incorrect and the test reports PASS.
In addition to these bugs, I found that the following items did not have any check content ref specified in the XCCDF, thus reported NOTCHECKED. I realize some of the check cannot be performed automatically, but each of these can be, but is not.
* Disable Ctrl-Alt-Del Reboot Activation
* Install the screen Package
* Set GUI Warning Banner Text
* Set Default IPTables Policy for Forwarded Packets
* Disable ntpdate Service (ntpdate)
* Ensure Insecure File Locking is Not Allowed
* Verify No netrc Files Exist
* Ensure All Accounts on the System Have Unique Names
* Set Password to Maximum of Three Consecutive Repeating Characters
* Set Password Hashing Algorithm in /etc/pam.d/system-auth
* Set Password Hashing Algorithm in /etc/login.defs
* Set Password Hashing Algorithm in /etc/libuser.conf
* Verify that Shared Library Files Have Restrictive Permissions
* Verify that Shared Library Files Have Root Ownership
* Verify that System Executables Have Restrictive Permissions
* Verify that System Executables Have Root Ownership
* Ensure No World-Writable Files Exist
* Each of the 5 above can be tested using one of:
* `find $dir -xdev -perm /o=w ! \( -type d -perm /o=t \) ! -type l -print`
* `find $dir -xdev ! -user root ! -type d ! -type l -print`
* Limit the Number of Concurrent Login Sessions Allowed Per User
* For this one, perhaps check that the key is present, as the value is up to the system owner.
* Uninstall Sendmail Package
* Additionally, suggest naming this "Ensure sendmail not installed" or something of that flavor more indicative of what the test is checking for, versus an action.
* Enable Logging of All FTP Transactions
* Create Warning Banners for All FTP Users
* Configure SNMP Service to Use Only SNMPv3 or Newer
* Ensure Default Password Is Not Used
* For the previous 4, the test must first check applicability (much like the GNOME tests), as my system does not have/support FTP or SNMP and should not have FAIL reported.
And the last item--each of the following reports UNKNOWN as the check-content-ref element in the XCCDF references a non-existent id in the OVAL.
* Ensure Log Files Are Owned By Appropriate Group
* Ensure System Log Files Have Correct Permissions
* Ensure Logrotate Runs Periodically
--Logan Rodrian
11 years, 1 month