Red Hat Summit is this coming April  and there's a number of security
talks planned. One about SSG, "Applied SCAP: Automating security
compliance & remediation" was accepted  :)
Summit passes increased from $995 to $1,495 this week and future
increases planned . If anyone from the SSG community would like to
attend summit, contact me */_off list_/* and we'll be able to get you
registered with the original 'super saver' price. Applies to anyone in
the community (note that govvies can register @ $995 at any time by
default, so this largely helps out system integrators and commercial guys).
No, I don't get secret commissions on this or anything.... we just want
to enable as much of the SSG community to attend as possible! Again,
contact me /_*off list*_/.
I did a fresh git pull on Monday, and ran the stig-rhel6-server-upstream
The set of false positives has shrunk, but is still not zero.
1) mountopt_noexec_on_removable_partitions exits with error, when there are
no removable partitions configured in fstab
2) file_ownership_library_dirs complains about an /usr/libexec suid abrt
3) no_files_unowned_by_* are still broken and looking for any files in /
4) enable_execshield and sysctl_kernel_randomize_va_space are failing,
although sysctl shows correct results
5) selinux_all_devicefiles_labeled shows errors with the /dev/.udev
6) enable_gdm_login_banner didn't get the gconf mandatory check fixed,
although all the rest did (YAY!)
7) sysctl_ipv6_default_accept_redirects and service_ip6tables_enabled fail
when ipv6 has been disabled via modprobe.d entries
8) install_openswan is obsoleted by libreswan
9) audit_file_access does not check for open_by_handle_at, and fails when
the audit rules lines do not contain exactly the content specified.
I was very glad to see almost all of the sysctl and gconf false positives
My name is Graham (Willo) Williamson and I'm an employee of Northrop
Grumman Australia. I'm currently being sub contracted back to very
familiar ground, the Australian DoD. I'm one of those lucky people who
are working in this latest cyber craze (like that'll last). :)
I was in the Royal Australian Air Force for about 14 years and got out
to start "earning the big bucks" back in Mar 2011. For basically, the
last 6 and a bit years of my time in the Air Force, I was doing CND and
some IA on various systems. I originally self taught myself Linux on
Fedora Core 2 and one of those big yellow Wiley 'Bible' series books
and haven't looked back. Been a fan ever since.
I'm looking forward to getting involved and I am willing and able to
contribute. Like a couple of the others on this list, git is definitely
not my strong suit, but I'm using it daily at the moment and becoming
more at one with the force with every passing day. Anyway, I've already
joined the git group and Shawn's already hooked me up and approved my
membership, so I'm very keen to crack on and get amongst it.
Based on comments and recommendations from the following thread, I've
submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml
This only checks /etc/passwd and not any other authorization databases.
>From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001
From: Rodney Mercer <rmercer(a)harris.com>
Date: Wed, 18 Dec 2013 15:01:25 +0000
Subject: [PATCH] Modified no_files_unowned_by_user.xml
modified completely broken no_files_unowned_by_user.xml to properly
check all files on the system to make sure that they are owned by a user
that resides in /etc/passwd.
RHEL6/input/checks/no_files_unowned_by_user.xml | 51
1 files changed, 28 insertions(+), 23 deletions(-)
diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml
index a73183a..f3f1276 100644
@@ -1,38 +1,43 @@
- <definition class="compliance"
- id="no_files_unowned_by_user" version="1">
+ <definition class="compliance" id="no_files_unowned_by_user"
<title>Find files unowned by a user</title>
<platform>Red Hat Enterprise Linux 6</platform>
- <description>All files should be owned by a
+ <description>All files should be owned by a user</description>
+ <reference source="rmercer" ref_id="20131218"
- <criterion comment="Check all files and make sure they are owned
by a user"
- test_ref="test_20050" />
+ <criterion comment="Check all files and make sure they are owned
by a user" test_ref="no_files_unowned_by_user_test" />
- check="all" comment="files with no user owner"
- id="test_20050" version="1">
- <note>This will enumerate all files on local
- <unix:object object_ref="obj_20022" />
- <unix:state state_ref="state_20050" />
- <unix:file_state comment="Executables with suid set"
- id="state_20050" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
+ <unix:file_state id="file_permissions_unowned_userid_list_match"
+ <unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int" />
- <unix:file_object comment="all local files"
- id="obj_20022" version="1">
- <unix:behaviors recurse="symlinks and directories"
+ <local_variable id="file_permissions_unowned_userid_list"
comment="List of valid user ids" datatype="int" version="1">
+ <object_component item_field="subexpression"
+ <ind:pattern operation="pattern
+ <ind:instance operation="greater than or equal"
+ <unix:file_object comment="all local files"
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" />
<unix:filename operation="pattern match">.*</unix:filename>
+ check="all" check_existence="none_exist" comment="Check user ids on
all files on the system"
+ id="no_files_unowned_by_user_test" version="1">
+ <unix:object object_ref="file_permissions_unowned_object" />
A new version of the OSCAP Anaconda Addon integrating the OpenSCAP
toolkit with the Anaconda installer is now available for testing. Links,
checksums and documentation are available at project's main page:
[new in version 0.4]
* fixing unreported issues revealed during testing
* UX improvements
* bugs rhbz#1050913, rhbz#1049989, rhbz#1032846
* support for XCCDF tailoring
* checking session validity also when using XCCDF benchmark
[plans for 0.5]
* automatic detection of scap-security-guide if it is available in the
* support for data stream + tailoring in an archive/RPM
* content integrity checking (probably sha256sum as something to start
Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic
Can any one recommend a XCCDF/OVAL editor? I'm just looking for a GUI
that us relatively easy to get running and can modify a few of the
checks in the content to conform to our organizations policy (password
failed attempts for example). I've seen a few, but would like some
I noticed the recent news of Red Hat's intent to partner and collaborate
with the CentOS Project and was wondering if SSG will branch on CentOS
content? From time to time folks have asked about running SCAP content on
the CentOS platform. Could CentOS leverage the shared directory? I am
just throwing this out to see the interest level.
J83B - Industry Collaboration
The MITRE Corporation