Anyone going to Red Hat Summit?
by Shawn Wells
Red Hat Summit is this coming April [1] and there's a number of security
talks planned. One about SSG, "Applied SCAP: Automating security
compliance & remediation" was accepted [2] :)
Summit passes increased from $995 to $1,495 this week and future
increases planned [3]. If anyone from the SSG community would like to
attend summit, contact me */_off list_/* and we'll be able to get you
registered with the original 'super saver' price. Applies to anyone in
the community (note that govvies can register @ $995 at any time by
default, so this largely helps out system integrators and commercial guys).
No, I don't get secret commissions on this or anything.... we just want
to enable as much of the SSG community to attend as possible! Again,
contact me /_*off list*_/.
[1] http://www.redhat.com/summit/
[2] http://www.redhat.com/summit/sessions/index.html#441
[3] https://redhat.g2planet.com/summit2014/register
10 years, 2 months
Remaining false positives
by Andrew Gilmore
I did a fresh git pull on Monday, and ran the stig-rhel6-server-upstream
scan.
The set of false positives has shrunk, but is still not zero.
1) mountopt_noexec_on_removable_partitions exits with error, when there are
no removable partitions configured in fstab
2) file_ownership_library_dirs complains about an /usr/libexec suid abrt
file
3) no_files_unowned_by_* are still broken and looking for any files in /
4) enable_execshield and sysctl_kernel_randomize_va_space are failing,
although sysctl shows correct results
5) selinux_all_devicefiles_labeled shows errors with the /dev/.udev
directories
6) enable_gdm_login_banner didn't get the gconf mandatory check fixed,
although all the rest did (YAY!)
7) sysctl_ipv6_default_accept_redirects and service_ip6tables_enabled fail
when ipv6 has been disabled via modprobe.d entries
8) install_openswan is obsoleted by libreswan
9) audit_file_access does not check for open_by_handle_at, and fails when
the audit rules lines do not contain exactly the content specified.
I was very glad to see almost all of the sysctl and gconf false positives
fixed!
Andrew Gilmore
10 years, 2 months
Self Introduction
by Graham Williamson
Hi everyone,
My name is Graham (Willo) Williamson and I'm an employee of Northrop
Grumman Australia. I'm currently being sub contracted back to very
familiar ground, the Australian DoD. I'm one of those lucky people who
are working in this latest cyber craze (like that'll last). :)
I was in the Royal Australian Air Force for about 14 years and got out
to start "earning the big bucks" back in Mar 2011. For basically, the
last 6 and a bit years of my time in the Air Force, I was doing CND and
some IA on various systems. I originally self taught myself Linux on
Fedora Core 2 and one of those big yellow Wiley 'Bible' series books
and haven't looked back. Been a fan ever since.
I'm looking forward to getting involved and I am willing and able to
contribute. Like a couple of the others on this list, git is definitely
not my strong suit, but I'm using it daily at the moment and becoming
more at one with the force with every passing day. Anyway, I've already
joined the git group and Shawn's already hooked me up and approved my
membership, so I'm very keen to crack on and get amongst it.
Cheers, Willo
--
Graham Williamson
10 years, 2 months
fix CCE-27032-2 no_files_unowned_by_user.xml
by Mercer, Rodney
Based on comments and recommendations from the following thread, I've
submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml
https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/00...
This only checks /etc/passwd and not any other authorization databases.
8<====================
>From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001
From: Rodney Mercer <rmercer(a)harris.com>
Date: Wed, 18 Dec 2013 15:01:25 +0000
Subject: [PATCH] Modified no_files_unowned_by_user.xml
modified completely broken no_files_unowned_by_user.xml to properly
check all files on the system to make sure that they are owned by a user
that resides in /etc/passwd.
---
RHEL6/input/checks/no_files_unowned_by_user.xml | 51
++++++++++++----------
1 files changed, 28 insertions(+), 23 deletions(-)
diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml
b/RHEL6/input/checks/no_files_unowned_by_user.xml
index a73183a..f3f1276 100644
--- a/RHEL6/input/checks/no_files_unowned_by_user.xml
+++ b/RHEL6/input/checks/no_files_unowned_by_user.xml
@@ -1,38 +1,43 @@
<def-group>
- <definition class="compliance"
- id="no_files_unowned_by_user" version="1">
+ <definition class="compliance" id="no_files_unowned_by_user"
version="1">
<metadata>
<title>Find files unowned by a user</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>All files should be owned by a
- user</description>
+ <description>All files should be owned by a user</description>
+ <reference source="rmercer" ref_id="20131218"
ref_url="test_attestation" />
</metadata>
<criteria>
- <criterion comment="Check all files and make sure they are owned
by a user"
- negate="true"
- test_ref="test_20050" />
+ <criterion comment="Check all files and make sure they are owned
by a user" test_ref="no_files_unowned_by_user_test" />
</criteria>
</definition>
- <unix:file_test
xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
- check="all" comment="files with no user owner"
- id="test_20050" version="1">
- <notes>
- <note>This will enumerate all files on local
- partitions</note>
- </notes>
- <unix:object object_ref="obj_20022" />
- <unix:state state_ref="state_20050" />
- </unix:file_test>
- <unix:file_state comment="Executables with suid set"
- id="state_20050" version="1">
- <unix:user_id datatype="int">0</unix:user_id>
+
+ <unix:file_state id="file_permissions_unowned_userid_list_match"
version="1">
+ <unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int" />
</unix:file_state>
- <unix:file_object comment="all local files"
- id="obj_20022" version="1">
- <unix:behaviors recurse="symlinks and directories"
recurse_file_system="local" />
+
+ <local_variable id="file_permissions_unowned_userid_list"
comment="List of valid user ids" datatype="int" version="1">
+ <object_component item_field="subexpression"
object_ref="file_permissions_unowned_userid_list_object" />
+ </local_variable>
+
+ <ind:textfilecontent54_object
id="file_permissions_unowned_userid_list_object" version="1">
+ <ind:filepath>/etc/passwd</ind:filepath>
+ <ind:pattern operation="pattern
match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
+ <ind:instance operation="greater than or equal"
datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" />
<unix:path>/</unix:path>
<unix:filename operation="pattern match">.*</unix:filename>
+ <filter
action="exclude">file_permissions_unowned_userid_list_match</filter>
</unix:file_object>
+
+ <unix:file_test
xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
+ check="all" check_existence="none_exist" comment="Check user ids on
all files on the system"
+ id="no_files_unowned_by_user_test" version="1">
+ <unix:object object_ref="file_permissions_unowned_object" />
+ </unix:file_test>
</def-group>
+
--
1.7.1
10 years, 2 months
OSCAP Anaconda Addon 0.4 available
by Vratislav Podzimek
A new version of the OSCAP Anaconda Addon integrating the OpenSCAP
toolkit with the Anaconda installer is now available for testing. Links,
checksums and documentation are available at project's main page:
https://fedorahosted.org/oscap-anaconda-addon/
[new in version 0.4]
* fixing unreported issues revealed during testing
* UX improvements
(http://vpodzime.fedorapeople.org/oaa-0.4-changes.webm)
* bugs rhbz#1050913, rhbz#1049989, rhbz#1032846
* support for XCCDF tailoring
* checking session validity also when using XCCDF benchmark
[plans for 0.5]
* automatic detection of scap-security-guide if it is available in the
compose
* support for data stream + tailoring in an archive/RPM
* content integrity checking (probably sha256sum as something to start
with)
--
Vratislav Podzimek
Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic
10 years, 3 months
XCCDF and OVAL Editor
by joescap@mm.st
Can any one recommend a XCCDF/OVAL editor? I'm just looking for a GUI
that us relatively easy to get running and can modify a few of the
checks in the content to conform to our organizations policy (password
failed attempts for example). I've seen a few, but would like some
recommendations. Thanks
10 years, 3 months
PATCH] [RHEL-7] Silence three 'Double hyphen within comment' RHEL-7 make shorthand2xccdf parser errors
by Jan Lieskovsky
Running 'make' / 'make shorthand2xccdf' on current RHEL-7 content returns:
# make shorthand2xccdf
xsltproc -o output/rhel7-shorthand.xml input/guide.xslt input/guide.xml
input/services/ssh.xml:389: parser error : Double hyphen within comment: <!-- <ident cce="RHEL7-CCE-TBD" />
<!
<!-- <oval id="sshd_strengthen_firewall" /> -->
^
input/services/dhcp.xml:157: parser error : Double hyphen within comment: <!--<ident cce="RHEL7-CCE-TBD" />
<ident cce="RHEL7-CC
<!--<oval id="dhcp_server_minimize_served_info" /> -->
^
input/services/dhcp.xml:279: parser error : Double hyphen within comment: <!--<ident cce="RHEL7-CCE-TBD" />
<!
<!--<oval id="dhcp_client_restrict_options" /> -->
^
Fix the issues by adding missing enclosing comments (after
the change 'make shorthand2xccdf' on RHEL-7 content doesn't
issue errors anymore).
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
10 years, 3 months