From jlieskov at redhat.com Thu Aug 20 11:35:34 2015 Content-Type: multipart/mixed; boundary="===============3713273586395747163==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's rules to Fedora Date: Mon, 14 Oct 2013 06:21:06 -0400 Message-ID: <1543498062.5518715.1381746066304.JavaMail.root@redhat.com> In-Reply-To: 525B6C10.9010203@redhat.com --===============3713273586395747163== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > From: "Shawn Wells" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Monday, October 14, 2013 5:59:12 AM > Subject: Re: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' sectio= n's rules to Fedora > = > On 10/11/13 10:54 AM, Jan Lieskovsky wrote: > = > = > = > This proposal converts rules from RHEL6's 'Restrict Root Logins' > section so they could be used on Fedora too. Depends on previous > typo fix (caab207a8c8a587914d9a1b318d972bbd678896c). > = > Common Fedora rpm Makefile rules and Fedora SSG Makefile content > rules have been tested and confirmed to work properly. > = > Please review. > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > 0001-Fedora-Convert-RHEL6-Restrict-Root-Logins-section-s-.patch > From 844d8b1e757942da57adedf8f6ad726a4771ae01 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky Date: Fri, 11 Oct 2013 16:44= :31 > +0200 > Subject: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's > rules to Fedora > = > = > Signed-off-by: Jan Lieskovsky --- > .../input/checks/accounts_no_uid_except_zero.xml | 23 +++ > .../checks/no_shelllogin_for_systemaccounts.xml | 22 ++ > .../input/checks/restrict_serial_port_logins.xml | 27 +++ > .../checks/securetty_root_login_console_only.xml | 26 +++ > Fedora/input/guide.xml | 2 +- > Fedora/input/guide.xslt | 1 + > Fedora/input/profiles/common.xml | 35 +++- > .../system/accounts/restrictions/root_logins.xml | 230 > +++++++++++++++++++++ > Fedora/scap-security-guide.spec | 5 +- > 9 files changed, 359 insertions(+), 12 deletions(-) > create mode 100644 Fedora/input/checks/accounts_no_uid_except_zero.xml > create mode 100644 Fedora/input/checks/no_shelllogin_for_systemaccounts.= xml > create mode 100644 Fedora/input/checks/restrict_serial_port_logins.xml > create mode 100644 Fedora/input/checks/securetty_root_login_console_only= .xml > create mode 100644 Fedora/input/system/accounts/restrictions/root_logins= .xml > = > diff --git a/Fedora/input/checks/accounts_no_uid_except_zero.xml > b/Fedora/input/checks/accounts_no_uid_except_zero.xml > new file mode 100644 > index 0000000..cc337f4 > --- /dev/null > +++ b/Fedora/input/checks/accounts_no_uid_except_zero.xml > @@ -0,0 +1,23 @@ > + > + version=3D"1"> > + > + UID 0 Belongs Only To Root > + > + Fedora 19 > + > + Only the root account should be assigned a user id of > 0. > + > + > + /etc/passwd file" test_ref=3D"test_accounts_no_uid_except_root" /> > + > + > + comment=3D"tests for reg exp ^[^r][^o][^o][^t].*:0 in /etc/passwd file" > id=3D"test_accounts_no_uid_except_root" version=3D"1"> > + > + > + version=3D"1"> > + /etc > + passwd > + match">^(?!root:)[^:]*:[^:]:0 > + 1 > + > + > diff --git a/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml > b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml > new file mode 100644 > index 0000000..8f1b6f6 > --- /dev/null > +++ b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml > @@ -0,0 +1,22 @@ > + > + version=3D"1"> > + > + System Accounts Do Not Run a Shell > + > + Fedora 19 > + > + The root account is the only system account that shou= ld > have a login shell. > + > + > + /sbin/nologin) for system accounts in /etc/passwd file" > test_ref=3D"test_no_shelllogin_for_systemaccounts" /> > + > + > + comment=3D"tests for the presence of login shells (not /sbin/nologin) for > system accounts in /etc/passwd file" > id=3D"test_no_shelllogin_for_systemaccounts" version=3D"1"> > + > + > + version=3D"1"> > + /etc/passwd > + match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/= sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$ > + 1 > + > + > diff --git a/Fedora/input/checks/restrict_serial_port_logins.xml > b/Fedora/input/checks/restrict_serial_port_logins.xml > new file mode 100644 > index 0000000..a1f456e > --- /dev/null > +++ b/Fedora/input/checks/restrict_serial_port_logins.xml > @@ -0,0 +1,27 @@ > + > + version=3D"1"> > + > + Restrict Serial Port Root Logins > + > + Fedora 19 > + > + Preventing direct root login to serial port interfaces > helps > + ensure accountability for actions taken on the system using the ro= ot > + account. > + > + > + test_ref=3D"test_serial_ports_etc_securetty" negate=3D"true" /> > + > + > + > + comment=3D"serial ports /etc/securetty" id=3D"test_serial_ports_etc_secur= etty" > version=3D"1"> > + > + > + > + id=3D"object_serial_ports_etc_securetty" version=3D"1"> > + /etc > + securetty > + ^ttyS[0-9]+$ > + equal">1 > + > + > diff --git a/Fedora/input/checks/securetty_root_login_console_only.xml > b/Fedora/input/checks/securetty_root_login_console_only.xml > new file mode 100644 > index 0000000..51a33de > --- /dev/null > +++ b/Fedora/input/checks/securetty_root_login_console_only.xml > @@ -0,0 +1,26 @@ > + > + version=3D"1"> > + > + Restrict Virtual Console Root Logins > + > + Fedora 19 > + > + Preventing direct root login to virtual console devic= es > + helps ensure accountability for actions taken on the system using = the > + root account. > + > + > + test_ref=3D"test_virtual_consoles_etc_securetty" /> > + > + > + > + comment=3D"virtual consoles /etc/securetty" > id=3D"test_virtual_consoles_etc_securetty" version=3D"1"> > + > + > + > + id=3D"object_virtual_consoles_etc_securetty" version=3D"1"> > + /etc/securetty > + ^vc/[0-9]+$ > + equal">1 > + > + > diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml > index 6e276b1..8d21fe8 100644 > --- a/Fedora/input/guide.xml > +++ b/Fedora/input/guide.xml > @@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United > States and other > countries. All other names are registered trademarks or trademarks of th= eir > respective companies. > > -0.0.2 > +0.0.3 > > diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt > index 559042e..d99da5a 100644 > --- a/Fedora/input/guide.xslt > +++ b/Fedora/input/guide.xslt > @@ -45,6 +45,7 @@ > > > > + select=3D"document('system/accounts/restrictions/root_logins.xml')" /> > select=3D"document('system/accounts/restrictions/password_storage.= xml')" > /> > select=3D"document('system/accounts/restrictions/password_expirati= on.xml')" > /> > > diff --git a/Fedora/input/profiles/common.xml > b/Fedora/input/profiles/common.xml > index 83e3478..8997e79 100644 > --- a/Fedora/input/profiles/common.xml > +++ b/Fedora/input/profiles/common.xml > @@ -2,15 +2,30 @@ > Common Profile for General-Purpose Fedora Systems > This profile contains items common to general-purpose Fedora > installations. > = > - > - > - > - > - > + > + > + > + > + > + > + > + > + > + > + > + > + > + > +