[PATCH 0/5] Additional profile, two new rules, one modified rule, and a modified transform
by David Smith
I needed to build an example custom profile, which led to the following:
1) a new profile
2) two new rules added specifically for the new profile
3) an additional option for selecting the number of max concurrent logins
4) modifications to the xccdf-addprofiles transform, to include the new profile in the build process
David Smith (5):
added example of a custom profile
modified transform to include new profile
Added rule regarding anonymous NFS connections
Additional option for number of max concurrent logins
Added rule for disabling interface use of IPv6
RHEL6/input/profiles/CS2.xml | 380 +++++++++++++++++++++++++++++++
RHEL6/input/services/nfs.xml | 11 +
RHEL6/input/system/accounts/session.xml | 1 +
RHEL6/input/system/network/ipv6.xml | 9 +-
RHEL6/transforms/xccdf-addprofiles.xslt | 1 +
5 files changed, 401 insertions(+), 1 deletions(-)
create mode 100644 RHEL6/input/profiles/CS2.xml
10 years, 9 months
[PATCH] Updated rationale for SSH Idle Timeout
by Andrew Gilmore
The text of this rationale overstates the issue, as well as being
difficult to understand.
I had to fix this for my own use, so why not share?
Signed-off-by: Andrew Gilmore <agilmore2(a)gmail.com>
---
RHEL6/input/services/ssh.xml | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 59330ab..c3b97cc 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -163,9 +163,8 @@ If properly configured, the output should be:
<pre>ClientAliveInterval 900</pre>
</ocil>
<rationale>
-Causing idle users to be automatically logged out
-guards against compromises one system leading trivially
-to compromises on another.
+Automatically logging out idle users guards against one
+compromised system leading to access on another.
</rationale>
<ident cce="26919-1" />
<oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/>
--
1.7.1
10 years, 9 months
[PATCH] DHCP section referred to the wrong file location for dhcpd.conf
by Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
RHEL6/input/services/dhcp.xml | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index 4190c07..a611adc 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -75,7 +75,7 @@ accidentally reactivated and disrupt network operation.
<description>If the system must act as a DHCP server, the configuration
information it serves should be minimized. Also, support for other protocols
and DNS-updating schemes should be explicitly disabled unless needed. The
-configuration file for dhcpd is called <tt>/etc/dhcpd.conf</tt>. The file
+configuration file for dhcpd is called <tt>/etc/dhcp/dhcpd.conf</tt>. The file
begins with a number of global configuration options. The remainder of the file
is divided into sections, one for each block of addresses offered by dhcpd,
each of which contains configuration options specific to that address
@@ -84,7 +84,7 @@ block.</description>
<Rule id="dhcp_server_disable_ddns">
<title>Do Not Use Dynamic DNS</title>
<description>To prevent the DHCP server from receiving DNS information from
-clients, edit <tt>/etc/dhcpd.conf</tt>, and add or correct the following global
+clients, edit <tt>/etc/dhcp/dhcpd.conf</tt>, and add or correct the following global
option: <pre>ddns-update-style none;</pre>
</description>
<rationale>The Dynamic DNS protocol is used to remotely update the data served
@@ -107,7 +107,7 @@ best practice).</warning>
<Rule id="dhcp_server_deny_decline">
<title>Deny Decline Messages</title>
-<description>Edit <tt>/etc/dhcpd.conf</tt> and add or correct the following
+<description>Edit <tt>/etc/dhcp/dhcpd.conf</tt> and add or correct the following
global option to prevent the DHCP server from responding the DHCPDECLINE
messages, if possible: <pre>deny declines;</pre> </description>
<rationale>The DHCPDECLINE message can be sent by a DHCP client to indicate
@@ -137,7 +137,7 @@ vectors against the DHCP server.
<Group id="dhcp_server_minimize_served_info">
<title>Minimize Served Information</title>
-<description>Edit /etc/dhcpd.conf. Examine each address range section within
+<description>Edit /etc/dhcp/dhcpd.conf. Examine each address range section within
the file, and ensure that the following options are not defined unless there is
an operational need to provide this information via DHCP:
<pre>option domain-name
@@ -173,7 +173,7 @@ usually static across machines at a given site.</warning>
<Rule id="dhcp_server_configure_logging">
<title>Configure Logging</title>
<description>Ensure that the following line exists in
-<tt>/etc/syslog.conf</tt>:
+<tt>/etc/rsyslog.conf</tt>:
<pre>daemon.* /var/log/daemon.log</pre>
Configure logwatch or other log monitoring tools to summarize error conditions
reported by the dhcpd process.</description>
@@ -246,7 +246,7 @@ successfully distribute. For more information on configuring dhclient, see the
<Group id="dhcp_client_restrict_options">
<title>Minimize the DHCP-Configured Options</title>
-<description>Create the file <tt>/etc/dhclient.conf</tt>, and add an
+<description>Create the file <tt>/etc/dhcp/dhclient.conf</tt>, and add an
appropriate setting for each of the ten configuration settings which can be
obtained via DHCP. For each setting, do one of the following:
<br/>
@@ -277,7 +277,7 @@ system on a network. It is recommended that almost all configuration options be
assigned statically, and only options which must vary on a host-by-host basis
be assigned via DHCP. This limits the damage which can be done by a rogue DHCP
server. If appropriate for your site, it is also possible to supersede the
-host-name directive in <tt>/etc/dhclient.conf</tt>, establishing a static
+host-name directive in <tt>/etc/dhcp/dhclient.conf</tt>, establishing a static
hostname for the machine. However, dhclient does not use the host name option
provided by the DHCP server (instead using the value provided by a reverse DNS
lookup).</rationale>
--
1.7.1
10 years, 9 months
[PATCH] Last item in Avahi file feels like it's supposed to be a Rule, not a Group
by Maura Dailey
The rendered Avahi section looked off. I think the last Avahi section should be a rule, not its own group.
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
RHEL6/input/services/avahi.xml | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/services/avahi.xml b/RHEL6/input/services/avahi.xml
index debc26b..acdc23a 100644
--- a/RHEL6/input/services/avahi.xml
+++ b/RHEL6/input/services/avahi.xml
@@ -102,7 +102,7 @@ that port on the system.
<ref nist="CM-7" />
</Rule>
-<Group id="avahi_restrict_published_information">
+<Rule id="avahi_restrict_published_information">
<title>Restrict Information Published by Avahi</title>
<description>
If it is necessary to publish some information to the network, it should not be joined
@@ -129,6 +129,6 @@ the types of published information in the event that some information
must be published.
</rationale>
<ref nist="CM-7" />
-</Group>
+</Rule>
</Group>
</Group>
--
1.7.1
10 years, 9 months
[PATCH] Correct telnet service disabled checks
by Andrew Gilmore
I altered the pattern match to use the same one as the other xinetd
based services, then retested.
This is both fixes, the rpm present fix, and the pattern match.
Since I've not had telnet installed, never tested the pattern match.
Andrew
10 years, 9 months
Call for last minute patches -- doing another build tonight/tomorrow
by Shawn Wells
Over the past few weeks there's been a marked improvement in the OVAL
code, and a number of bash remediations added. Time for a new release!
Are there any outstanding patches that need acking, or anyone working on
these they'd like to see in the next RPM release? Ideally we could cut a
new RPM around COB today.
10 years, 9 months
Remediation: XCCDF BCP draft
by Nunez, Luis K
In anticipation of Developer Days 2013, a draft whitepaper "Using XCCDF for
Remediation: Best Current Practice", is attached for your review. The paper
provides a perspective on remediation and explores current XCCDF elements
related to remediation. The paper also highlights Red Hat's effort to
introduce scripting content into XCCDF.
All comments and suggestions are welcome.
Luis Nunez
G022 - IA Industry Collaboration
The MITRE Corporation
703-983-4428
www.mitre.org
10 years, 9 months
Remediation: XCCDF BCP draft
by Nunez, Luis K
In anticipation of Developer Days 2013, a draft whitepaper "Using XCCDF for
Remediation: Best Current Practice", is attached for your review. The paper
provides a perspective on remediation and explores current XCCDF elements
related to remediation. The paper also highlights Red Hat's effort to
introduce scripting content into XCCDF.
All comments and suggestions are welcome.
Luis Nunez
G022 - IA Industry Collaboration
The MITRE Corporation
703-983-4428
www.mitre.org
10 years, 9 months
Quick False Positive fixes\
by Andrew Gilmore
These two false positives were easy to fix.
There's about 4 others that aren't so easy. Do I open trac issues for these, or just email the group?
Andrew
10 years, 9 months