VMs, containers vs. bare-metal machines in SSG
by Martin Preisler
We have had increasing requests to scan containers and VM storage images
for compliance. In those use-cases a lot of our rules don't make sense.
For example separate partition for /tmp isn't really applicable to containers.
I thought about how we can deal with this in SSG. We have several options:
1) Separate benchmark and datastreams for containers and VM storage images:
ssg-rhel7-ds.xml and ssg-rhel7-container-ds.xml
2) Separate profile for containers and VM storage images:
pci-dss and pci-dss-container
3) Use applicability and CPE platforms to distinguish between what is being
scanned. That allows us to use the same pci-dss profile for bare-metal, VM,
VM storage image and container image.
Right now I am leaning towards 3) because it "unlocks" the feature
transparently to our users. There is nothing extra they have to study to
start scanning containers. The downside is that we will have to add "fake"
CPE IDs for platforms like "vm-storage" and "container". Rules that apply
to everything will have no <platform> element in them. Rules that apply
to just containers will have something like:
<platform idref="cpe:/a:*:container-image"/>
or
<platform idref="cpe:/a:*:vm-storage"/>
Official NIST CPE ID dictionary has these related CPE IDs
cpe:/a:redhat:docker:1.5.0-27
cpe:/a:linuxcontainers:lxc:0.5.0
cpe:/a:redhat:libvirt:1.2.7
Not sure we want to go with any of those though. I would like to keep it
container and VM tech agnostic.
Before I start hacking this I would like to hear your thoughts.
--
Martin Preisler
Identity Management and Platform Security | Red Hat, Inc.
6 years, 3 months
PCI-DSS Baseline Queries
by Colin Madigan
Hi Team,
I have applied the PCI-DSS profile to my Centos 7 system and there seems to be a false positive with the check "Disable Prelinking". I have checked the Remediation steps and they have been applied but check still marks as a fail. Secondly with this PCI profile how come Rules like enabling or checking SELinux are marked as notselected. Are these notselected rules not part of PCI-DSS requirements or is this due to some other reason.
Benchmark URL
ssg-centos7-ds.xml
Benchmark ID
xccdf_org.ssgproject.content_benchmark_RHEL-7
Profile ID
xccdf_org.ssgproject.content_profile_pci-dss
[cid:image002.png@01D2F011.BA7425D0]
Colin Madigan|UNIX Engineer
T02 9344 2705
30 Ross St, Glebe NSW 2037
Colin.Madigan(a)tpgtelecom.com.au<mailto:Colin.Madigan@tpgtelecom.com.au>
TPG Telecom (ASX: TPM)
[Description: http://res.tpgi.com.au/img/signature/tpglogo.jpg]
This email and any attachments are confidential and may be subject to copyright, legal or some other professional privilege. They are intended solely for the attention and use of the named addressee(s). They may only be copied, distributed or disclosed with the consent of the copyright owner. If you have received this email by mistake or by breach of the confidentiality clause, please notify the sender immediately by return email and delete or destroy all copies of the email. Any confidentiality, privilege or copyright is not waived or lost because this email has been sent to you by mistake.
Confidentiality: This email and any attachments are confidential and may be subject to copyright, legal or some other professional privilege. They are intended solely for the attention and use of the named addressee(s). They may only be copied, distributed or disclosed with the consent of the copyright owner. If you have received this email by mistake or by breach of the confidentiality clause, please notify the sender immediately by return email and delete or destroy all copies of the email. Any confidentiality, privilege or copyright is not waived or lost because this email has been sent to you by mistake.
6 years, 5 months
RHEL7 SSG v0.1.33: RHEL-07-010270
by Trey Henefield
According to STIG ID RHEL-07-010270, the pam_unix.so entry in system-auth should apply the remember= value to limit password reuse.
However, upon applying the SSG scap checks and remediations, I noticed that I was unable to change my password when forcing all account passwords to be changed at the next login.
So upon doing some searching, I discovered this:
https://bugzilla.redhat.com/show_bug.cgi?id=1412838
Tomaz included a statement at the end as follows:
"Please use pam_pwhistory instead of adding remember option to pam_unix. There is no way to make that remember option of pam_unix properly supported with SELinux."
Can we please report this issue up to DISA and recommend changing the requirement to require pam_pwhistory versus pam_unix?
Best regards,
Trey Henefield, CISSP
Senior IAVA Engineer
Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA
Trey.Henefield(a)ultra-ats.com<mailto:Trey.Henefield@ultra-ats.com>
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450
www.ultra-ats.com<http://www.ultra-ats.com>
Disclaimer
The information contained in this communication from trey.henefield(a)ultra-ats.com sent at 2017-06-21 15:02:03 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide(a)lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide(a)lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
6 years, 5 months
Help with Compiling SSG
by Bertilla Theodore
Hi
I am new to SCAP technology and trying to learn adding new XCCDF and OVAL
content to SCAP security guide. I am following the workshop content at
http://people.redhat.com/jamisonm/scap/SCAP-Workshop-Coursebook-v2.pdf &
https://jlieskov.files.wordpress.com/2013/11/scap_security_guide_question...
But they seem to be outdated and I am lost since the directory structure of
the latest SSG is different than the one at the time of the workshop.
Although I could locate and add a new XCCDF rule, I'm not sure how to
compile and validate after that. 'make' returns errors as there is no
Makefile. The ssg macros in CMakeLists.txt are missing their definition, so
cmake is also not working. I am also not able to locate the HTML guide
where I can see the newly added rule (I am guessing that's because I
couldn't compile in the first place). I've got the SSG source from
https://github.com/OpenSCAP/scap-security-guide.
Please help me on how I should proceed. If there is an updated
documentation, please point it out to me.
Your advise would be of great help.
Thanks in advance.
Best regards
Bertilla Theodore
6 years, 5 months
Stack Clash Fun Times
by Trevor Vaughan
Like most everyone, I'm running around trying to prevent Stack Clash types
of issues from happening in the future.
The most 'general purpose' way of doing this is to set the Address Space
and Stack limits in pam_limits.
So, two questions:
1) What is a good, general purpose number to set these to? I figured that
Red Hat would have a bunch of systems to sample....
2) Should these be included in the SSG?
3) Should the rest of these have nailed in defaults that make sense for
most systems? This really should be something that people understand about
their applications and/or can adjust to be larger on an as-needed basis.
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --
6 years, 5 months
Disabling passwords in the cloud
by Fen Labalme
If password access is disabled on a cloud-based server - both from
(virtual) console and via SSH - can the set of password checks be disabled
somehow?
- 10 checks: Set Password Quality Requirements with pam_pwquality
- 5 checks: Set Lockouts for Failed Password Attempts
- 3 checks: Set Password Hashing Algorithm
Thanks,
=Fen
6 years, 5 months
STIGs and SSG Gaps
by Molly Bault
Greetings Team SSG,
Firstly, thank you so much for your work on this project. Helping Linux be more secure helps everyone. I work for an avionics embedded computer company and really appreciate your tool.
I know there are gaps right now in the scap-security-guide and the RHEL 7 STIGs. I'm trying to figure out what the game plan is for those.
* There are some that is seems you guys are pushing back up to the DISA people with edits.
* There are some that are simply missing that need the work done to add. (Follow on question, is this work scheduled?)
Is this captured somewhere and I am blind? :) Thank you again for all your work on this very important project.
~Molly Jo
6 years, 5 months
Re: STIGs and SSG Gaps
by Ted Brunell
Molly,
I am working with DISA to create common content between the STIG and SSG.
It is our hope that we will, in the not too distant future, be in sync with
one another.
Please let me know if there are any follow-up questions.
R/
Ted
Ted Brunell - RHCA, RHCE, RHCVA
Principal Solution Architect
Chief Architect, DoD
Red Hat, Inc.
(c) 760-712-6837
tbrunell(a)redhat.com
** Sent from my mobile device. **
On Jun 15, 2017 6:29 PM, "Molly Bault" <Molly.Jo.Bault(a)ballardtech.com>
wrote:
Greetings Team SSG,
Firstly, thank you so much for your work on this project. Helping Linux be
more secure helps everyone. I work for an avionics embedded computer
company and really appreciate your tool.
I know there are gaps right now in the scap-security-guide and the RHEL 7
STIGs. I'm trying to figure out what the game plan is for those.
* There are some that is seems you guys are pushing back up to the DISA
people with edits.
* There are some that are simply missing that need the work done to add.
(Follow on question, is this work scheduled?)
Is this captured somewhere and I am blind? :) Thank you again for all your
work on this very important project.
~Molly Jo
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.
fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@
lists.fedorahosted.org
6 years, 5 months
Time based SSG releases
by Watson Yuuma Sato
Hello folks,
I would like to announce that we are changing SCAP Security Guide releases
to be time based. From now on, every two months there will be a release
coming out.
As last release was on April 29th, next release will happen on June 29th.
Our aim is to release early and often to increase the feedback loop
and also reduce anxiety on when the next release will happen.
--
Watson Sato
Security Technologies | Red Hat, Inc
6 years, 5 months