[PATCH] Making SSH checks uniform and hopefully adding case insensitive matches properly
by Maura Dailey
There are a few things I did here. The first was to rewrite the regex to use (?i) for case insensitive matching. The second was to make the checks and the language in the comments uniform and run everything through tidy. The third was to test all the checks and add the test_attestation reference to each.
- Maura Dailey
Maura Dailey (1):
Making SSH checks uniform and hopefully adding case insensitive
matches properly
RHEL6/input/checks/sshd_banner_set.xml | 24 +++++++--------
RHEL6/input/checks/sshd_clientalivecountmax.xml | 32 ++++++++-----------
.../input/checks/sshd_hostbasedauthentication.xml | 19 ++++++++----
RHEL6/input/checks/sshd_idle_timeout.xml | 30 ++++++++++--------
RHEL6/input/checks/sshd_no_user_envset.xml | 24 ++++++--------
.../input/checks/sshd_permitemptypasswords_no.xml | 24 +++++++--------
RHEL6/input/checks/sshd_permitrootlogin_no.xml | 24 +++++++--------
RHEL6/input/checks/sshd_protocol_2.xml | 17 +++++++---
RHEL6/input/checks/sshd_rsh_emulation_disabled.xml | 24 +++++++--------
RHEL6/input/checks/sshd_use_approved_ciphers.xml | 28 ++++++++++-------
10 files changed, 126 insertions(+), 120 deletions(-)
10 years, 8 months
[PATCH] Improbably, the input line for UDP is $UDPServerRun, not $InputUDPServerRun. Also, the check forgot to include the port number, so it always gave a false positive.
by Maura Dailey
This regex will match on $InputTCPServerRun, $InputRELPServerRun, and $UDPServerRun.
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
RHEL6/input/checks/rsyslog_nolisten.xml | 21 +++++++++------------
1 files changed, 9 insertions(+), 12 deletions(-)
diff --git a/RHEL6/input/checks/rsyslog_nolisten.xml b/RHEL6/input/checks/rsyslog_nolisten.xml
index 46cc285..d9376b6 100644
--- a/RHEL6/input/checks/rsyslog_nolisten.xml
+++ b/RHEL6/input/checks/rsyslog_nolisten.xml
@@ -1,31 +1,28 @@
<def-group>
- <definition class="compliance"
- id="rsyslog_nolisten" version="1">
+ <definition class="compliance" id="rsyslog_nolisten" version="1">
<metadata>
- <title>Disable Rsyslogd from Accepting Remote Messages on
- Loghosts Only</title>
+ <title>Disable Rsyslogd from Accepting Remote Messages on Loghosts
+ Only</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>RSyslogd should reject remote
- messages</description>
+ <description>rsyslogd should reject remote messages</description>
+ <reference source="MED" ref_id="20130819" ref_url="test_attestation" />
</metadata>
<criteria>
<criterion comment="Conditions are satisfied"
test_ref="test_rsyslog_nolisten" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist"
- comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $InputUDPServerRun | $InputRELPServerRun"
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
+ comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun"
id="test_rsyslog_nolisten" version="1">
<ind:object object_ref="object_rsyslog_nolisten" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_rsyslog_nolisten"
- version="1">
+ <ind:textfilecontent54_object id="object_rsyslog_nolisten" version="1">
<ind:path>/etc</ind:path>
<ind:filename>rsyslog.conf</ind:filename>
- <ind:pattern operation="pattern match">^\$Input(?:(TCP)|(UDP)|(RELP))ServerRun\s*$</ind:pattern>
+ <ind:pattern operation="pattern match">^\$(?:Input(?:TCP|RELP)|UDP)ServerRun</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
--
1.7.1
10 years, 8 months
Question on 'Verify File Hashes with RPM', and results in general
by Robert Sanders
Ok, I'm stumped now. I'm using the latest SSG content (downloaded today) on a RHEL6.4 64bit VM. On this box I loaded the latest SPAWAR release candidate as well as Security Blanket. Ran the scan, and this module passed, but it failed in Security Blanket. Poking through the SSG content I ran the command as indicated in the description manually and it *failed*. So looking in the check-content section for this rule I see 3 entries -
one for the CCE reference
one for a oval definition
one for an ocil-transitional
If I drill down through the oval definition it *looks* like there's an pattern match for only looking at things with a 'bin' as part of the path, which would skip the things that appeared to bork.
Looked at the ocil-transitional definition I see a command using grep like I've *never* seen before (note the && was escaped in the xccdf file)
description command -> rpm -Va | grep '^..5'
check-content(ocil-trans) command -> rpm -Va | grep '$1 ~ /..5/ && $2 != "c"'
So...
question 1 - which command is actually being run? I'm assuming the one from the oval, as the ocil one doesn't make any sense to me unless the command is being mangled before execution, or someone snuck something into grep when I wasn't looking...
Question 2 - Is there any way to have oscap spit out a log file of the commands/checks actually being run, so see why things may or may not have triggered a fail?
Question 3 - If the command being run is actually from the oval, with the pathname pattern match, why doesn't the description detail the same exception? I've had this complaint with the RHEL5 STIG as well where there have been a few line items where the description says one thing and the actual check is doing some extra stuff.
-Rob
10 years, 8 months
Modifing report design
by Antonio Sebastian Salles M.
Hi all,
Somebody knows how can I modify openscap report design? I need to put a
logo in front and add contact information, and I cannot see any info in
wiki.
All info would be nice.
Thanks a lot!
--
Antonio Salles
10 years, 8 months
Does aide_periodic_cron_checking have an incorrect fix documented?
by Hayden,Robert
I was reviewing the Rule: aide_periodic_cron_checking and noticed the following recommended fix:
----start quote----
To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --check
AIDE can be executed periodically through other means; this is merely one example.
---- end quote------
This fix is also documented in the RHEL STIG version 1 release 2.
I believe that is an incorrect line for crontab as the 6th element is to be the executed command. On my RHEL 6.4 machine, "root" is not a valid command and I receive the following in local mail box
# mail
Heirloom Mail version 12.4 7/29/08. Type ? for help.
"/var/spool/mail/root": 1 message 1 new
>N 1 Cron Daemon Fri Aug 9 04:05 23/1036 "Cron <root@techval15> root /usr/sbin/aide --check"
& 1
Message 1:
From root(a)techval15.northamerica.cerner.net Fri Aug 9 04:05:01 2013
Return-Path: <root(a)techval15.northamerica.cerner.net>
Date: Fri, 9 Aug 2013 04:05:01 -0500
From: root(a)techval15.northamerica.cerner.net (Cron Daemon)
To: root(a)techval15.northamerica.cerner.net
Subject: Cron <root@techval15> root /usr/sbin/aide --check
Content-Type: text/plain; charset=ISO-8859-1
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
Status: R
/bin/sh: root: command not found
Am I missing something?
Thanks
Robert
Robert Hayden | Sr. Technology Architect | Cerner Corporation | 816.201.4068 | rhayden(a)cerner.com<mailto:rhayden@cerner.com> | www.cerner.com
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
10 years, 8 months
[PATCH] Check needs to be reversed. As is, if you specified 10 as the maximum number of concurrent logins, it would allow 20.
by Maura Dailey
Self explanatory. I also added a test_attestation reference and corrected the comment for the external value.
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
.../accounts_max_concurrent_login_sessions.xml | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
index eda8052..cb2e859 100644
--- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -7,6 +7,7 @@
</affected>
<description>The maximum number of concurrent login sessions per user should meet
minimum requirements.</description>
+ <reference source="MED" ref_id="20130807" ref_url="test_attestation" />
</metadata>
<criteria comment="the value maxlogins should be set appropriately in /etc/security/limits.conf">
<criterion test_ref="test_maxlogins" />
@@ -25,9 +26,9 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_maxlogins" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
+ <ind:subexpression operation="less than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" />
</ind:textfilecontent54_state>
- <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
+ <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="max_concurrent_login_sessions_value" version="1" />
</def-group>
--
1.7.1
10 years, 8 months
Using OR operator for runlevel criteria
by Chen, Wei
Hello,
Can someone explain the logic behind using the OR operator for runlevel test criteria? If runlevel 1 is set to true and runlevel 3 set to false, wouldn't the below criteria still return true?
<criteria operator="OR" comment="service iptables is configured to start">
<criterion comment="iptables runlevel 0" test_ref="oval:ssg:tst:427"/>
<criterion comment="iptables runlevel 1" test_ref="oval:ssg:tst:428"/>
<criterion comment="iptables runlevel 2" test_ref="oval:ssg:tst:429"/>
<criterion comment="iptables runlevel 3" test_ref="oval:ssg:tst:430"/>
<criterion comment="iptables runlevel 4" test_ref="oval:ssg:tst:431"/>
<criterion comment="iptables runlevel 5" test_ref="oval:ssg:tst:432"/>
<criterion comment="iptables runlevel 6" test_ref="oval:ssg:tst:433"/>
</criteria>
Thanks,
Wei Chen
DS/SI/CS
Chenw3(a)state.gov<mailto:Chenw3@state.gov>
571-345-2567
10 years, 8 months
Suggestion on the 'Ensure All Files Are Owned...' items
by Robert Sanders
I was wondering why the tests for 'Ensure all Files Are Owned by a User' and 'Ensure all Files are Owned by a Group' kept on failing. Drilling down it looks like the underlying find command being used is along the lines of :
find PARTITION -xdev -nouser -print
When I run this command manually I've had complaints that find can't read files in /proc. Looking at the man page suggests this can be avoided by adding the '-ignore_readdir_race' option before the -xdev option.
This change may need to be added for both SSG items 2.2.3.e and 2.2.3.f
-Rob
10 years, 8 months
[PATCH] Small patch to replace autogenerated ids with human readable ids
by Maura Dailey
I think some of these ids were leftover from the USGCB for RHEL 5. In any case, I've replaced them
with human readable ones, which should make them easier to read for future editors.
- Maura Dailey
Maura Dailey (1):
Small patch to replace autogenerated test, state, and object ids with
human readable ones
.../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++-------------
.../checks/core_dump_suid_progs_limits_conf.xml | 19 ++-----
RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++-----
RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++-----
RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++-----
RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++-----
RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++-----
RHEL6/input/checks/file_owner_etc_group.xml | 22 +++-----
RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++-----
RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++-----
RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++-----
.../input/checks/file_permissions_ungroupowned.xml | 27 +++------
RHEL6/input/checks/interactive_boot_disable.xml | 18 ++----
13 files changed, 112 insertions(+), 208 deletions(-)
10 years, 8 months
MLS question from a new user
by Kordell, Luke T
Hello.
I am new to SCAP and trying to determine how to modify a rule. I have downloaded the source code and have located an OVAL test I would like to change to suite my purposes. The file is selinux_policytype.xml. I have chosen this file because I am trying to make the SELinux enforcement rule pass for an MLS enforcement rather than targeted. My questions are as follows:
The OVAL document references an object, test, state and variable but does not define them (as far as I can tell) within the OVAL file. Rather, it appears to be calling them from somewhere else.
In particular I am referring to these lines.
13 test_ref = "test_selinux_policy"
21 object object_ref = obj_selinux_policy
22 state state_ref = state_selinux_policy
Finally I think this is the variable I am going to need to change.
var_ref = var_selinux_policy_name
My question are:
1) where are these objects defined, and if it is possible how can I modify them?
2) Other than the OVAL website are there any other resources anyone can recommend that can help me learn this material?
Luke
10 years, 8 months