[PATCH] cleanup of comments, unnecessary Rules in DNS (bind) service
by Jeffrey Blank
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/services/dns.xml | 43 ++--------------------------------------
RHEL6/input/services/snmp.xml | 11 ++++-----
2 files changed, 8 insertions(+), 46 deletions(-)
diff --git a/RHEL6/input/services/dns.xml b/RHEL6/input/services/dns.xml
index 579520a..0a63e25 100644
--- a/RHEL6/input/services/dns.xml
+++ b/RHEL6/input/services/dns.xml
@@ -61,12 +61,9 @@ attacks on nameservers more difficult.</description>
a high-risk service which must frequently be made available to the entire
Internet, it is strongly recommended that no other services be offered by
machines which act as organizational DNS servers.</description>
-<!--<ident cce="27030-6" />-->
-<!--<oval id="dns_server_dedicated" />-->
-<!--<ref nist="CM-7" />-->
</Group>
-<Rule id="dns_server_chroot">
+<Group id="dns_server_chroot">
<title>Run DNS Software in a chroot Jail</title>
<description>Install the <tt>bind-chroot</tt> package:
<pre># yum install bind-chroot</pre>
@@ -97,31 +94,10 @@ configuration file. That is, when this guide recommends editing
<tt>/etc/named.conf</tt>, you should instead edit
<tt>/var/named/chroot/etc/named.conf</tt>.
</warning>
-<ident cce="26957-1" />
-<ident cce="27127-0" />
-<ident cce="26961-3" />
-<!--<oval id="dns_server_chroot" />-->
-<ref nist="CM-7" />
-</Rule>
-
-<Group id="dns_server_firewall">
-<title>Configure Firewalls to Protect the DNS Server</title>
-<description>
-By default, <tt>iptables</tt> blocks access to the ports used by the DNS
-server.
-<iptables-desc-macro proto="udp" port="53" />
-<iptables-desc-macro proto="tcp" port="53" />
-</description>
-<rationale>These lines are necessary in order to allow remote machines to
-contact the DNS server. If this server is only available to the local network,
-it may be appropriate to insert a -s flag into this rule to allow traffic only
-from packets on the local network.</rationale>
-<!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
-<!--<oval id="dns_server_firewall" />-->
-<ref nist="CM-7" />
</Group>
-</Group> <!--<Group id="dns_server_isolation">-->
+
+</Group>
<Group id="dns_server_protection">
<title>Protect DNS Data from Tampering or Attack</title>
@@ -179,9 +155,6 @@ to untrusted machines.
Separate machines should be used to fill these two functions whenever possible.
</rationale>
-<!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
-<!--<oval id="dns_server_separate_internal_external" />-->
-<!--<ref nist="CM-7" />-->
</Group>
<Group id="dns_server_partition_with_views">
@@ -226,9 +199,6 @@ required for recursion, such as the root hints file, must be available to any
clients which are allowed to make recursive queries. Under typical
circumstances, this includes only the internal clients which are allowed to use
this server as a general-purpose nameserver.</warning>
-<!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
-<!--<oval id="dns_server_partition_with_views" />-->
-<!--<ref nist="CM-7" />-->
</Group>
<Rule id="dns_server_disable_zone_transfers">
@@ -248,9 +218,6 @@ or if you have only one nameserver, it may be possible to use an external
configuration management mechanism to distribute zone updates. In that case, it
is not necessary to allow zone transfers within BIND itself, so they should be
disabled to avoid the potential for abuse.</rationale>
-<!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
-<!--<oval id="dns_server_disable_zone_transfers" />-->
-<ref nist="CM-7" />
</Rule>
<Rule id="dns_server_authenticate_zone_transfers">
@@ -305,8 +272,6 @@ create the shared secret string base64-key-string. Once this secret has been
obtained and inserted into named.conf on the primary and secondary servers, the
key files Kdns.example.com .+NNN +MMMMM .key and Kdns.example.com .+NNN +MMMMM
.private are no longer needed, and may safely be deleted.</warning>
-<!--<ident cce="3985-9, 4487-5, 4258-0" /> -->
-<!--<oval id="dns_server_authenticate_zone_transfers" />-->
<ref nist="CM-7" />
</Rule>
@@ -328,8 +293,6 @@ are easily spoofed. Instead, use TSIG keys (see the previous section for an
example), and consider using the update-policy directive to restrict changes to
only the precise type of change needed.</rationale>
<ident cce="27105-6" />
-<!--<oval id="dns_server_disable_dynamic_updates" />-->
-<!--<ref nist="CM-7" />-->
</Rule>
</Group> <!--<Group id="dns_server_protection">-->
diff --git a/RHEL6/input/services/snmp.xml b/RHEL6/input/services/snmp.xml
index eff0eb8..ec22a42 100644
--- a/RHEL6/input/services/snmp.xml
+++ b/RHEL6/input/services/snmp.xml
@@ -9,9 +9,9 @@ choices for the community string.</description>
<Group id="disabling_snmp_service">
<title>Disable SNMP Server if Possible</title>
-<description>The system includes an SNMP daemon that allows for its
-remote monitoring, though it not installed by default. If it was
-installed and activated, the software should be disabled and removed.
+<description>The system includes an SNMP daemon that allows for its remote
+monitoring, though it not installed by default. If it was installed and
+activated but is not needed, the software should be disabled and removed.
</description>
<Rule id="disable_snmpd">
@@ -66,8 +66,6 @@ stations</li>
<li>ensure that permissions on the <tt>snmpd.conf</tt> configuration file (by default, in <tt>/etc/snmp</tt>) are 640 or more restrictive</li>
<li>ensure that any MIB files' permissions are also 640 or more restrictive</li></ul>
</description>
-<!--<ident cce="26332-7" /> -->
-<!--<oval id="snmp_configure_server" /> -->
<Rule id="snmpd_use_newer_protocol" severity="medium">
<title>Configure SNMP Service to Use Only SNMPv3 or Newer </title>
@@ -100,7 +98,8 @@ To ensure the default password is not set, run the following command:
There should be no output.
</ocil>
<rationale>
-Presence of the default SNMP password enables querying of different system aspects and could result in unauthorized knowledge of the system.
+Presence of the default SNMP password enables querying of different system
+aspects and could result in unauthorized knowledge of the system.
</rationale>
<tested by="MAN" on="20121214"/>
</Rule>
--
1.7.1
10 years, 11 months
[Patch] Duplicate Check for Disabling IPv6
by Maura Dailey
The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a duplicate
of RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since
sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and
formatting of all the other sysctl checks, it seems that
sysctl_net_ipv6_disabled.xml is the one to delete.
- Maura Dailey
diff --git a/RHEL6/input/checks/sysctl_net_ipv6_disabled.xml
b/RHEL6/input/checks/sysctl_net_ipv6_disabled.xml
deleted file mode 100644
index bd2ba67..0000000
--- a/RHEL6/input/checks/sysctl_net_ipv6_disabled.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<def-group>
- <definition class="compliance" id="sysctl_net_ipv6_disabled" version="1">
- <metadata>
- <title>Disable IPv6 In /etc/sysctl.conf</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>If IPv6 networking is not required then it should be
disabled. One way to disable
- IPv6 is to set the kernel runtime parameter
"net.ipv6.conf.all.disable_ipv6" to 1 (true). This
- check examines /etc/sysctl.conf to see if this runtime parameter
has been set to true.</description>
- </metadata>
- <criteria>
- <criterion test_ref="test_20134"
comment="net.ipv6.conf.all.disable_ipv6 set to 1 (true) in
/etc/sysctl.conf"/>
- </criteria>
- </definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="net.ipv6.conf.all.disable_ipv6 set to 1 (true) in
/etc/sysctl.conf" id="test
- <ind:object object_ref="obj_20134" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20134" version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>sysctl.conf</ind:filename>
- <ind:pattern operation="pattern
match">^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-</def-group>
10 years, 11 months
any doc writer types around?
by Shawn Wells
This afternoon/evening some colleagues at RH hosted an internal tech
meetup, where we talked through projects and tech issues. I brought up
the need to author SSG guides in a cross-platform, multi-author format
and Gunnar Hellekson [1] suggested the following (thanks, Gunnar!):
> First, you should all be grokking [markdown].
>
> Second, take a look at the truly great [AsciiDoc], which is richer than markdown, and designed to make creating DocBook (our chosen source format for documentation) much easier.
>
> Third, you can make them both super-useful with [pandoc], available in your local yum repo.
>
> [Markdown]:http://daringfireball.net/projects/markdown/
> [AsciiDoc]:http://asciidoctor.org/
> [pandoc]:http://johnmacfarlane.net/pandoc/
The ability to transform content into multiple final outputs is
incredibly interesting. Has anyone played with these techs, either
individually or as part of some larger workflow?
Perhaps these could lay the foundation for authoring/updating the
workbooks, and could prove to be a great way to contribute for those who
aren't interested in writing OVAL code.
[1] His blog is pretty interesting,
http://atechnologyjobisnoexcuse.com/. Note his podcast mention SSG in
almost every episode!
10 years, 11 months
[PATCH 0/2] Small OVAL check push
by Maura Dailey
The first update is to add the necessary regex to support specifying the location of X with an absolute path. Other existing security guidance gives examples of how to disable X Forwarding in which the absolute path of X is specified in the config line. This will catch users that followed such security guidance.
The second update is super tiny. There was a slash at the end of the description that obviously shouldn't have been there.
- Maura Dailey
Maura Dailey (2):
Adding ability to check for absolute file paths for X, as seen in
some other published security guidance
Minor typo, removing slash at end of description
RHEL6/input/checks/xwindows_remote_listening.xml | 2 +-
.../checks/yum_gpgcheck_global_activation.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
10 years, 11 months
[PATCH 0/3] updates for services: smb, printing
by Jeffrey Blank
Trying to proofread/cleanup some very old text from the services sections.
Jeffrey Blank (3):
removing some unnecessary (for compliance-focus) text from cups
added some clarifying text to the intro
removed some now-obsolete advice from samba
RHEL6/input/guide.xml | 26 +++++---
RHEL6/input/services/printing.xml | 23 ++-----
RHEL6/input/services/smb.xml | 134 +++++++------------------------------
3 files changed, 46 insertions(+), 137 deletions(-)
10 years, 11 months