kickstart file for correct partitioning?
by Greg Elin
Shawn,
You mentioned there was a kickstart file to set up the correct partitions
for compliance? Do you have that link?
thanks
Greg Elin
personal cell: 917-304-3488
personal email: greg(a)fotonotes.net
email: gregelin(a)gitmachines.com
9 years, 10 months
[PATCH] modified CS2 profile to exclude Rule for disabling user list
by David Smith
Signed-off-by: David Smith <dsmith(a)secure-innovations.net>
---
RHEL/6/input/profiles/CS2.xml | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index 3615fa2..929cdef 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -189,7 +189,6 @@
<select idref="enable_gdm_login_banner" selected="true" />
<select idref="set_gdm_login_banner_text" selected="true" />
<refine-value idref="login_banner_text" selector="dod_default"/>
-<select idref="disable_user_list" selected="true" />
<select idref="disable_gnome_thumbnailers" selected="true" />
<select idref="gconf_gnome_disable_automount" selected="true"/>
--
1.7.1
9 years, 10 months
Running a scan for a single rule in opens cap?
by Greg Elin
Is it possible from command line to run a single rule test with opens
cap...and even better pipe the output?
The only way I can figure to run a single test is to create a profile with
a single rule.
9 years, 10 months
[PATCH 0/2] [RHEL/6] Include STIG disclaimer in two more places. [RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils
by Jan Lieskovsky
From 3c42c661b4f12d57fda35c3506bde1140a09a02f Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov(a)redhat.com>
Date: Mon, 26 May 2014 16:30:22 +0200
Subject: [PATCH 0/2] [RHEL/6] Include STIG disclaimer in two more
places. [RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils
This patchset does the following:
1) [RHEL/6] Includes STIG profile disclaimer into RHEL-6 manual page and
also into dedicated file
(located in /doc subdirectory of the RPM package once installed)
2) [RHEL/6, RHEL/7, Fedora] Drops Requires on openscap-utils (since we
shouldn't enforce use of the
OpenSCAP scanner for system evaluation)
Patchset has been tested on all of RHEL/6, RHEL/7 & Fedora, builds &
works fine.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
Jan Lieskovsky (2):
[RHEL/6] Add upstream STIG for RHEL 6 Server profile disclaimer into
the scap-security-guide manual page and also into
dedicated file under the package's /doc directory.
[RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils. Add a note
into manual pages regarding that.
Fedora/input/auxiliary/scap-security-guide.8 | 7 ++++
Fedora/scap-security-guide.spec | 2 +-
...STREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER | 16 +++++++++
RHEL/6/input/auxiliary/scap-security-guide.8 | 41
+++++++++++++++-------
RHEL/7/input/auxiliary/scap-security-guide.8 | 7 ++++
scap-security-guide.spec | 4 +--
6 files changed, 62 insertions(+), 15 deletions(-)
create mode 100644
RHEL/6/input/auxiliary/UPSTREAM_STIG_FOR_RHEL6_SERVER_PROFILE_DISCLAIMER
--
1.8.3.1
9 years, 10 months
[PATCH] [RHEL] Make new 0.1.17 release
by Jan Lieskovsky
Hello folks,
it has been three months again from the last SCAP Security Guide
0.1-16 release (last was Fri, 21-th Feb of 2014). In between 76 changes
/ patches were applied:
$ git log --format=%h --since="21-Feb-2014" | wc -l
76
So I think it's time to make a new official release (for those people
relying on RPM packages instead of building directly from Git).
Besides that the count of patches (diff 0.1-16 vs current git) makes
the maintenance cost of 0.1-16 tarball + set of patches to be applied
above it (for example due to package source tarball hash check) very high.
Therefore proposing to make a new 0.1.17 release. The attached
patch updates the spec & if approved new upstream source tarball &
new EPEL package release would follow.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
9 years, 10 months
Debugging error results
by Greg Elin
Are there docs or best practices for debugging scap scan producing error results?
Greg Elin
P: 917-304-3488
E: gregelin(a)gitmachines.com
Sent from my iPhone
9 years, 10 months
Scap for Centos
by Derek Warner
Any chance anyone is working on getting SCAP to work on CENTOS? I would
love to use the scap security guide and secstate to validate CENTOS 6.5.
Right now its a manual process going line by line in the RHEL 5 STIG. I
would really love to find out if anyone has anything automated that works
on CENTOS.
V/R
Derek Warner – CISSP-ISSEP
Information System Security Engineer
Riptide Software
w- 321-296-0068 x 136
c- 407-716-9223
derek.warner(a)riptidesoftware.com
derek.a.warner(a)us.army.mil
9 years, 10 months
[PATCH] Updated no_files_unowned_by_user
by Shawn Wells
Shawn Wells (1):
[bugfix] no_files_unowned_by_user, 'symlinks and directories' ->
'directories'
RHEL/6/input/checks/no_files_unowned_by_user.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
9 years, 10 months
[PATCH 0/7] bugfixes from DISA FSO
by Shawn Wells
A few bugfixes for issues raised by DISA FSO
Shawn Wells (7):
[bugfix RHEL6] Updates to gconf_gnome_screensaver_idle_delay
Added vim swap files to checks/.gitignore
[bugfix RHEL6] OCIL fix for accounts_passwords_pam_fail_interval
XCCDF rule name audit_file_access -->
audit_rules_unsuccessful_file_modification
[bugfix RHEL6] Disabling OVAL for audit_privileged_commands
(audit_rules_privileged_commands)
Naming mismatch, deny_password_attempts_unlock_time -->
accounts_passwords_pam_faillock_unlock_time
Updated OVAL name, logrotate_rotate_all_files ->
ensure_logrotate_activated
RHEL/6/input/auxiliary/stig_overlay.xml | 4 ++--
RHEL/6/input/auxiliary/transition_notes.xml | 8 ++++----
RHEL/6/input/checks/.gitignore | 1 +
RHEL/6/input/checks/ensure_logrotate_activated.xml | 20 ++++++++++++++++++++
.../checks/gconf_gnome_screensaver_idle_delay.xml | 6 +++---
RHEL/6/input/checks/logrotate_rotate_all_files.xml | 20 --------------------
RHEL/6/input/profiles/C2S.xml | 2 +-
RHEL/6/input/profiles/CS2.xml | 2 +-
RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml | 4 ++--
RHEL/6/input/profiles/common.xml | 2 +-
.../6/input/profiles/fisma-medium-rhel6-server.xml | 4 ++--
RHEL/6/input/profiles/nist-CL-IL-AL.xml | 4 ++--
.../input/profiles/stig-rhel6-server-upstream.xml | 2 +-
RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL/6/input/system/accounts/pam.xml | 6 +++---
RHEL/6/input/system/accounts/physical.xml | 4 ++--
RHEL/6/input/system/auditing.xml | 4 ++--
RHEL/6/input/system/logging.xml | 2 +-
18 files changed, 49 insertions(+), 48 deletions(-)
create mode 100644 RHEL/6/input/checks/ensure_logrotate_activated.xml
delete mode 100644 RHEL/6/input/checks/logrotate_rotate_all_files.xml
9 years, 10 months
Current scan issues
by Andrew Gilmore
Periodically, I do a git merge with upstream and test the result against my
system. Most of the time, things get better, but occasionally, something
breaks. Here's my list of broken stuff:
Rule world_writeable_files:
Now scans /proc and shows thousands of files from /proc/#/attr/<file> with
permissions 777.
Rule package_openswan_installed: Yum tells me that I have libreswan
installed, which obsoletes openswan. Is downgrading to openswan really
required, and why?
Rule world_writable_files_system_ownership:
Now finding /tmp/.X11-unix and /tmp/.ICE-unix where it did not before.
What's the right way to address this? Why are these 777 anyway?
Rule accounts_max_concurrent_login_sessions:
Broken regular expressions, I may get to a patch for this one, something
like (if I can ever figure out gmail's formatting!)
diff --git a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
index b08faa5..b0f0920 100644
--- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -21,7 +21,7 @@
<ind:textfilecontent54_object
id="object_etc_security_limits_conf_maxlogins" version="1">
<ind:filepath>/etc/security/limits.conf</ind:filepath>
- <ind:pattern operation="pattern
match">^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*\*[\s]+hard|-[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
9 years, 10 months