scap-security-guide August 2016

scap-security-guide@lists.fedorahosted.org

8 participants
6 discussions

SCAP Security Guide 0.1.30
by Jan Lieskovsky 13 Sep '16

13 Sep '16

Hello folks, it's my pleasure and honor to announce that SCAP Security Guide release 0.1.30 has been created and is now available for download. Highlights of this release: * CNSS No.1253 (nist-CL-IL-AL) profile has been ported to Red Hat Enterprise Linux 7, * SCAP benchmark for Red Hat Enterprise Linux 7 now passes official NIST SCAP ScapVal-1.2.14.1 content validation tool requirements, * The XCCDF rules for Red Hat Enterprise Linux 7 has been equipped with CCE identifiers, * New CJIS "Criminal Justice Information Services (CJIS) Security Policy" profile has been added to Red Hat Enterprise Linux 7 benchmark, * Profile for each ANSSI hardening level for NP targets has been added to Debian 8 benchmark, * Remediation scripts don't rely on external /usr/share/scap-security-guide/remediation_functions shell library any more (instead starting from this release the remediation scripts are part of the specific benchmark itself). This allows to perform remediation without the need to have scap-security-guide RPM package being installed. For a more detailed overview of changes (bug fixes, enhancements) implemented in this release please have a look at more detailed changelog: * https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.30 Full changelog at: * https://github.com/OpenSCAP/scap-security-guide/issues?q=milestone%3A0.1.30 Zip archives with pre-built benchmarks in DataStream form: * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30/s… (Zip archive using OVAL-5.11.1 language version) * https://github.com/OpenSCAP/scap-security-guide/releases/download/v0.1.30/s… (Zip archive using OVAL-5.10 language version) Happy hardening! Regards, Jan -- Jan iankko Lieskovsky (on behalf of the SCAP Security Guide upstream team)

2 2

RHEL 7.3 Beta SSG bugs
by Shawn Wells 01 Sep '16

01 Sep '16

In running through the RHEL 7.3 beta, I found the following bugs. Looks like most have already been patched upstream. Has anyone seen bugs beyond those below? FAIL DURING OSCAP-ANACONDA INSTALL? FAIL AFTER CLI REMEDIATION? BugZilla Install AIDE X FIXED https://bugzilla.redhat.com/show_bug.cgi?id=1372058 Build and Test AIDE Database X FIXED https://bugzilla.redhat.com/show_bug.cgi?id=1372058 Configure Periodic Execution of AIDE X FIXED https://bugzilla.redhat.com/show_bug.cgi?id=1372058 Install Virus Scanning Software X X Acceptable - DoD specific Enable Randomized Layout of Virtual Address Space X ERROR https://bugzilla.redhat.com/show_bug.cgi?id=1372060 Set Password to Maximum of Consecutive Repeating Characters from Same Character Class X X https://bugzilla.redhat.com/show_bug.cgi?id=1372061 Set Interactive Session Timeout X X https://bugzilla.redhat.com/show_bug.cgi?id=1372062 Set Boot Loader Password X X Acceptable - user needs to input password Install the screen Package X https://bugzilla.redhat.com/show_bug.cgi?id=1372066 Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces X X https://bugzilla.redhat.com/show_bug.cgi?id=1372063 Ensure Logs Sent to Remote Host X X Acceptable - user must input Disable GSSAPI Authentication X X https://bugzilla.redhat.com/show_bug.cgi?id=1372068 Disable Kerberos Authentication X X https://bugzilla.redhat.com/show_bug.cgi?id=1372068 Enable Use of StrictModes X X https://bugzilla.redhat.com/show_bug.cgi?id=1372068 Enable Use of Privilege Separation X X https://bugzilla.redhat.com/show_bug.cgi?id=1372068 Disable Compression or Set Compression to delayed X X https://bugzilla.redhat.com/show_bug.cgi?id=1372068 Verify Permissions on SSH Server Private *_key Key Files X X https://bugzilla.redhat.com/show_bug.cgi?id=1372070

1 0

How do I use remote resources offline?
by Chuck Atkins 05 Aug '16

05 Aug '16

I'm trying to use scap-workbench to run the Upstream STIG for RHEL6 Workstation profile and it explicitly wants the RHEL6 OVAL as a remote resource, http://www.redhat.com/security/data/oval/Red_Hat_Enterprise_Linux_6.xml. If I check "Fetch remote resources" then, of course, the scans and remediation work as expected but how can i get the entire benchmark to run offline? Can I download the oval info ahead of time and place it in a specific location? ---------- Chuck Atkins Staff R&D Engineer, Scientific Computing Kitware, Inc. (518) 881-1183

4 4

Re: [Open-scap] Add new rules (disk/partitions) to openscap profile
by Jan Lieskovsky 05 Aug '16

05 Aug '16

Hello Radwa, thank you for checking with us. ----- Original Message ----- > From: "Radwa KILANY" <radwakilany(a)gmail.com> > To: open-scap-list(a)redhat.com > Sent: Thursday, August 4, 2016 11:01:52 AM > Subject: [Open-scap] Add new rules (disk/partitions) to openscap profile > > Hello , > > I would like to add new rules checking options on disk partitions like /opt > and /usr. The available profiles didn't offer these checks. Correct. > > > The online documentation explains how to customise profiles through > "workbench interface", but didn't offer any options to add new ones. SCAP Workbench allows to add rules, that are already defined in the benchmark into profile (derive a new copy of the profile containing more / less rules). But it's not possible to use SCAP Workbench to add completely new rule to the benchmark. > Also, > I'm pretty aware it'll be doable throug alterig the ds and xccdf file but > thave no clue to how exactly I can do it. While direct altering the ds / xccdf would solve the issue for your use case, why not to create SCAP Security Guide PR also others from the community to be able to use your enhancements. > So do you know of any way to add a new rule? To be honest the task of adding new rule to SCAP Security Guide is not trivial. Not like it would be difficult to implement, but it requires some familiarity with the underlying standards (XCCDF, OVAL) first. Right now we have mechanisms to simplify some tasks, but currently aren't in the state yet where adding new rule would be question of few clicks in the GUI editor. In any case, to start get familiar with the concepts I would recommend Shawn's SSG WorkShop that should give you overall overview of the concepts / standards used in SSG and how to create new OVAL from template: [1] http://people.redhat.com/jamisonm/scap/SCAP-Workshop-Coursebook-v2.pdf Also XCCDF and OVAL standards, and overall layout of the SSG repository are in more detail explained in SSG Contributor WorkShop presentations: [2] https://jlieskov.files.wordpress.com/2013/11/scap_security_guide_questions_… [3] https://jlieskov.files.wordpress.com/2013/11/scap_security_guide_questions_… If you would like directly to start looking into the code and learn by example the steps (XCCDF - rule prose, OVAL - rule check, rule correction - remediation script, and finally creating new XCCDF profile topics) are covered within the last four commits in this branch: [4] https://github.com/iankko/scap-security-guide/commits/ssg_ws The only difference in your use case would be, the last step would differ - since it wouldn't require to create completely new XCCDF profile for the rule(s) being added, but would be enough to reference those rules in some of the existing profiles (e.g. 'common' one to mention some example. The other way is to report new RFE for the rule to be available in SSG ticketing system and wait till it's implemented: [5] https://github.com/OpenSCAP/scap-security-guide/issues/new > > Thank you in advance, Hope this helps. Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > > > _______________________________________________ > Open-scap-list mailing list > Open-scap-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/open-scap-list

1 0

Can we change the banner text requirement for "dconf_gnome_login_banner_text" to allow custom banner text? (RH BZ#1357620)
by Jan Lieskovsky 03 Aug '16

03 Aug '16

Hello, please see downstream report: [1] https://bugzilla.redhat.com/show_bug.cgi?id=1357620 In short the reason for the failure here not being the system in question (target of evaluation) wouldn't meet the required setting, but the only difference is the form of banner text used (instead of 'dod_default' https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/7/input/xc… the customers are using custom text for the login banner). Can we modify the 'dconf_gnome_login_banner_text.xml' OVAL not to be that restrictive? In other words, allow also other custom banners to be set on the target of evaluation under assumption, other requirements were already satisfied? Basically the change would be instead of exact banner text string match against 'dod_default' selector value of 'login_banner_text' variable, the new version would check if desired login banner text isn't empty string. Thoughts? Thank you && Regards, Jan -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

3 2

Latest OpenSCAP changes to speed up SSG builds
by Martin Preisler 03 Aug '16

03 Aug '16

I found pretty bad inefficiencies in some of our XSLTs. Check out https://github.com/OpenSCAP/openscap/commit/a65bf27dec4a93e2b87cec8cbcd80be… or https://github.com/OpenSCAP/openscap/commit/1dd5573b2c964b00af57215cadb7f13… Long story short I was able to cut SSG build time on my machine from 2m21.061s to 1m08.771s. In other words my machine now needs roughly half the time to build SSG. I was timing `make -j 4`. It will take a while for these changes to make it into releases and into distributions but I am writing this email because the savings are significant and perhaps you want to enjoy them sooner. SCAP Security Guide contributors are doing a lot of content builds. This will only work if you !!! have OPENSCAP 1.2.x !!! If you want to speed up the build, replace /usr/share/openscap/xsl/xccdf_1.1_to_1.2.xsl with https://raw.githubusercontent.com/OpenSCAP/openscap/maint-1.2/xsl/xccdf_1.1… /usr/share/openscap/xsl/xccdf-share.xsl with https://raw.githubusercontent.com/OpenSCAP/openscap/maint-1.2/xsl/xccdf-sha… and /usr/share/openscap/xsl/xccdf-guide-impl.xsl with https://github.com/OpenSCAP/openscap/blob/maint-1.2/xsl/xccdf-guide-impl.xsl Perhaps it would be worth it to deploy this on our Jenkins slaves even before it hits releases? What do you think? -- Martin Preisler Identity Management and Platform Security | Red Hat, Inc.

5 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide August 2016