Hey everyone -
I'm new to this project. I'm a complete novice when it comes with SCAP so
please be patient haha. I'm currently having issues with my SSH keys I
believe so I've been just pulling the latest repo daily. In the mean time,
until I can figure out the disconnect, I believe I have some patches
someone can hopefully commit.
Add a refine-value tag for the variable to accept a timeout of 15 minutes
or less in the CS2 profile.
<refine-value idref="sshd_idle_timeout_value" selector="15_minutes"
operator="less than or equal" />
In turn, add a value of 15_minutes/900 in the check for the newly defined
Hopefully that makes some sense and is useful. Still trying to wrap my head
around this stuff.
Vincenzo Pierorazio, CISSP, GPEN, C|HFI, OSCP, OSWP
Secure Innovations, LLC
It's been awhile since many of us in the MD/DC/VA area have gotten together!
This Wednesday Jeff Blank, Dave Smith and I are meeting up at DuClaws Arundel Mills  for a happy hour, and we wanted to extend an invite for those in the area to join us. Gives us a chance to plan a few things out (e.g. the remaining OVAL testing, integration of bash scripts, needed profiles like FedRAMP) in a very informal setting.
Current plan is to meetup at 4:30 at the Arundel Mills location (it's over near the movie theature):
7000 Arundel Mills Circle
Hanover, MD 21076
Feel free to join us! Note this isn't a sponsored event by RH or the government, just an opportunity for locals + interested parties to get together. We'll post "meeting minutes" back to the mailing list... if we can remember them after a few pints ;)
Hope to see you there!
We have a requirement to not mount portable storage devices and we have
implemented the USB blocking but it appears that gphoto has access to
camera's and android phones using PTP.
This mounting is done at teh gnome layer as the the device is not
visibly mounted from the command line, but can be seen in nautilus under
I tried the "2.2.2.e. Disable GNOME Automounting" but it still mounts.
Any one found a solution to this?
Quick question on this one. If I follow the prose directory then any interface on the system that doesn't have a file in /etc/sysconfig/network-scripts is a finding. On my box I've got the virbr0 and virbr0-nic interfaces due to the virtualization stuff installed. Should there be some language in here related to these virtual nics?
This patchset does the following:
1) files.xml was modified so the titles of the SGID and SUID rules were uniform
2) the introductory text to the DHCP section was heavily modified
3) minor copy editing in the rest of the changed files
David Smith (1):
Prose changes and copy editing
RHEL6/input/services/base.xml | 20 ++++++++++----------
RHEL6/input/services/dhcp.xml | 24 ++++++------------------
RHEL6/input/services/obsolete.xml | 2 +-
RHEL6/input/services/ssh.xml | 3 +--
RHEL6/input/system/permissions/files.xml | 2 +-
5 files changed, 19 insertions(+), 32 deletions(-)
This patch takes the "conditional clause" attribute from the
contrived "ocil-transitional" check system and uses it to create
a question for users.
This should allow the scap-security-guide content to act as a bridge
between the robotic and special "this is a finding" phrasing found in DISA STIGs,
and OCIL designed for human interaction. We can generate both.
Jeffrey Blank (1):
added interrogatory phrase to OCIL questions
RHEL6/transforms/xccdf-create-ocil.xslt | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
...mount_option_nodev_nonroot_local_partitions.xml | 28 ++++++++++---------
1 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml b/RHEL6/input/checks/mount_option_nodev_nonroot_local_partitions.xml
index a5e6334..e0abd50 100644
@@ -1,36 +1,38 @@
- <definition class="compliance" id="mount_option_nodev_nonroot_local_partitions" version="1">
+ <definition class="compliance"
+ id="mount_option_nodev_nonroot_local_partitions" version="1">
<title>Add nodev Option to Non-Root Local Partitions</title>
<platform>Red Hat Enterprise Linux 6</platform>
- <description>The nodev mount option prevents files from being
- interpreted as character or block devices. Legitimate character and block
- devices should exist in the /dev directory on the root partition or
- within chroot jails built for system services. All other locations should not
- allow character and block devices.</description>
+ <description>The nodev mount option prevents files from being interpreted
+ as character or block devices. Legitimate character and block devices
+ should exist in the /dev directory on the root partition or within chroot
+ jails built for system services. All other locations should not allow
+ character and block devices.</description>
+ <reference source="MED" ref_id="20130821" ref_url="test_attestation" />
- <criterion comment="nodev on local filesystems" test_ref="test_nodev_nonroot_local_partitions" />
+ <criterion comment="nodev on local filesystems"
+ test_ref="test_nodev_nonroot_local_partitions" negate="true" />
- <linux:partition_test check="all" check_existence="all_exist" id="test_nodev_nonroot_local_partitions" version="1" comment="nodev on local filesystems">
+ <linux:partition_test check="all" check_existence="all_exist"
+ id="test_nodev_nonroot_local_partitions" version="1"
+ comment="nodev on local filesystems">
<linux:object object_ref="object_non_root_partitions" />
<linux:state state_ref="state_local_nodev" />
<linux:partition_object id="object_non_root_partitions" version="1">
<!-- look at all partitions except root -->
<linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point>
<linux:partition_state id="state_local_nodev" version="1">
<!-- this check defines a local partition as one which has a device node in /dev -->
<linux:device operation="pattern match">^/dev/.*$</linux:device>
- <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
+ <linux:mount_options datatype="string" entity_check="all"
+ operation="not equal">nodev</linux:mount_options>
Quick question - I'm looking at the SSG content files and trying to determine the 'line item' number for a particular check. The DISA STIG content is layed out so that the line item information (i.e., rhel-06-0000001) is inline with a particular check. The SSG content doesn't appear to have this inline, and I suspect that the line items are being generated programmatically via the oscap command but I haven't drilled down to see what oscap is actually doing. Considering that the SSG is the upstream document for the RHEL6 STIG - is DISA responsible for remapping the SSG items to the STIG items, or will DISA adopt the way that the SSG is generating line items? If the latter, could this result in line item x.z.y from version A be a *very* different best than line item x.y.z from version B?
I went through a whole bunch more checks, tested them, tweaked their regex as necessary, and corrected comment fields. I also ran them through tidy and fixed them up a little. A few checks had "dead states" which were never referenced in a test field, so I deleted those.
I also added rsyslog to the template file for installed packages, since it was apparently missing, even though the compiled check had been added in a previous commit.
- Maura Dailey
Maura Dailey (1):
Another batch of tested checks. Includes some checks that had their
comments expanded or were renamed from random values.
RHEL6/input/checks/banner_etc_issue.xml | 1 +
.../checks/dovecot_disable_plaintext_auth.xml | 10 ++++---
RHEL6/input/checks/dovecot_enable_ssl.xml | 12 ++++----
.../input/checks/logwatch_configured_hostlimit.xml | 8 ++---
.../checks/logwatch_configured_splithosts.xml | 10 +++----
RHEL6/input/checks/network_sniffer_disabled.xml | 1 +
RHEL6/input/checks/ntp_remote_server.xml | 27 +++++++++----------
.../checks/postfix_network_listening_disabled.xml | 26 +++++++++---------
RHEL6/input/checks/postfix_server_banner.xml | 17 ++++--------
RHEL6/input/checks/restrict_serial_port_logins.xml | 7 +++--
.../checks/securetty_root_login_console_only.xml | 5 ++-
RHEL6/input/checks/selinux_mode.xml | 9 ++++--
RHEL6/input/checks/selinux_policytype.xml | 18 +++++--------
.../set_password_hashing_algorithm_libuserconf.xml | 3 +-
.../set_password_hashing_algorithm_logindefs.xml | 5 ++-
RHEL6/input/checks/singleuser_password.xml | 19 ++++++--------
RHEL6/input/checks/smb_client_signing_smb_conf.xml | 23 +++++++++--------
.../sysconfig_networking_bootproto_ifcfg.xml | 20 +++++++-------
RHEL6/input/checks/sysconfig_nozeroconf_yes.xml | 22 +++++++---------
.../input/checks/system_info_architecture_x86.xml | 22 ++++++++--------
.../checks/system_info_architecture_x86_64.xml | 22 ++++++++--------
.../input/checks/templates/packages_installed.csv | 3 +-
RHEL6/input/checks/tftpd_uses_secure_mode.xml | 3 +-
RHEL6/input/checks/xwindows_runlevel_setting.xml | 3 +-
24 files changed, 146 insertions(+), 150 deletions(-)
Just happened across this while I was modding an incorrect parameter.
Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs seems to pass
regardless of the number being higher than 1. Mine was set to 7 and was
passing, so I set it to 100 for another run through and it still passed.
Note: I'm not sure if these login.defs are actually necessary, well not
in a PAM environment. When PAM's handling the restrictions login.defs
is not involved.
Citation: http://www.linuxmanpages.com/man5/login.defs.5.php (bug section)