From blank at eclipse.ncsc.mil Thu Aug 20 11:31:01 2015 Content-Type: multipart/mixed; boundary="===============0017172960463546970==" MIME-Version: 1.0 From: Jeffrey Blank To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH v2 2/2] M1 Incomplete Guidance - Logging and Auditing Date: Thu, 03 May 2012 20:06:41 -0400 Message-ID: <4FA31D91.6080502@eclipse.ncsc.mil> In-Reply-To: 1335360096-4734-3-git-send-email-mpalmiotto@tresys.com --===============0017172960463546970== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ah -- we already have an auditing check for CCEs 14904-7 and 14679-5, but they're wrong (and based on a since-corrected release of the guide). Thanks for the catch. The old/wrong version had confused: "Ensure auditd Collects Logon and Logout Events" with "Record Attempts to Alter Logon and Logout Events" as well as "Ensure auditd Collects Process and Session Initiation Information" with "Record Attempts to Alter Process and Session Initiation Information" The second item in each is correct (as you have it). Could you alter the existing, incorrect XCCDF and OVAL rules instead? I believe that the text/title is wrong in the existing checks, but that that actual regex is correct/preferable; we do not want to force admins to call their key/label for an audit rule a particular thing. (They can call it whatever they'd like.) If you can make those mods, please consider this an auto-ACK for a commit/push (and also please post to the list). The logwatch stuff mostly looks good, although I think we should break apart (into separate Rules/checks) each line for: HostLimit =3D no SplitHosts =3D yes The other lines don't seem as security/accountability relevant, and might be appropriate for discussion only in a Group (if at all). For the Rules about rsyslog, I would prefer not to try to tell people how to how to configure their rsyslog.conf. Creating a Rule+check implies that that's what we're trying to do. So, these things are really better as Groups. Auditd data retention is quite an interesting section. Amazingly, I am actually going to suggest that it be broken apart, and some of it turned into Rules. I believe there is a requirement in the DISA OS SRG about disabling the system, if auditing becomes inoperative. Maybe take a look at the output of "make table-srgmap" (output/rhel6-table-srgmap.html) and see what this says we should make some rules for? It might be along the lines of CCI-001343/SRG-OS-000213. I know I owe you review on some more patches -- thanks for the contributions. On 04/25/2012 09:21 AM, Michael Palmiotto wrote: > = > Signed-off-by: Mike Palmiotto > --- > .../checks/audit_rules_logon_modification.xml | 34 +++++++++ > .../checks/audit_rules_session_modification.xml | 47 ++++++++++++ > .../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++++= ++++ > .../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++++= ++++ > rhel6/src/input/system/auditing.xml | 77 ++++++++++++++= +++++- > rhel6/src/input/system/logging.xml | 67 ++++++++++++++= +++ > 6 files changed, 365 insertions(+), 1 deletions(-) > create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification= .xml > create mode 100644 rhel6/src/input/checks/audit_rules_session_modificati= on.xml > create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserv= er.xml > create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml > = > diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml b/= rhel6/src/input/checks/audit_rules_logon_modification.xml > new file mode 100644 > index 0000000..97d170d > --- /dev/null > +++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml > @@ -0,0 +1,34 @@ > + > + > + > + Record Attempts to Alter Logon and Logout Events > + > + Red Hat Enterprise Linux 6 > + > + > + Audit attempted manual edits of files involved in st= oring logon events. > + > + > + > + > + > + > + > + > + > + > + /etc/audit > + audit.rules > + ^\-w[\s]+\/var\/log\/lastlo= g[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$ > + 1 > + > + > + > + > + > + /etc/audit > + audit.rules > + ^\-w[\s]+\/var\/log\/faillo= g[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$ > + 1 > + > + > diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml = b/rhel6/src/input/checks/audit_rules_session_modification.xml > new file mode 100644 > index 0000000..22b0cb6 > --- /dev/null > +++ b/rhel6/src/input/checks/audit_rules_session_modification.xml > @@ -0,0 +1,47 @@ > + > + > + > + > + > + Red Hat Enterprise Linux 6 > + > + > + Ensure that watches are placed on utmp, btmp, and wtm= p, sessions. > + > + > + > + > + > + > + > + = > + > + > + > + > + /etc/audit > + audit.rules > + ^\-w[\s]+\/var\/log\/wtmp[\= s]+wa[\s]+\-k[\s]+session\s*$ > + 1 > + > + > + > + > + > + > + /etc/audit > + audit.rules > + ^\-w[\s]+\/var\/log\/utmp[\= s]+wa[\s]+\-k[\s]+session\s*$ > + 1 > + > + > + > + > + > + > + /etc/audit > + audit.rules > + ^\-w[\s]+\/var\/log\/btmp[\= s]+wa[\s]+\-k[\s]+session\s*$ > + 1 > + > + > diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml = b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml > new file mode 100644 > index 0000000..2a99b92 > --- /dev/null > +++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml > @@ -0,0 +1,71 @@ > + > + > + > + Ensure Logwatch Configured on the Central Log Server > + > + Red Hat Enterprise Linux 6 > + > + > + Check if logwatch service is enabled and configured.<= /description> > + > + > + > + > + > + > + > + > + > + = > + > + > + > + > + no > + > + > + /etc/logwatch/conf > + logwatch.conf > + ^[\s]HostLimit[\s]*=3D[\s]*= [\w]+\s*$ > + 1 > + > + > + > + > + > + > + yes > + > + > + /etc/logwatch/conf > + logwatch.conf > + ^[\s]SplitHosts[\s]*=3D[\s]= *[\w]+\s*$ > + 1 > + = > + = > + > + > + > + > + no > + > + > + /etc/logwatch/conf > + logwatch.conf > + ^[\s]MultiEmail[\s]*=3D[\s]= *[\w]+\s*$ > + 1 > + > + = > + > + > + > + > + -zz-disk_space > + > + > + /etc/logwatch/conf > + logwatch.conf > + ^[\s]Service[\s]*=3D[\s]*\-= zz\-disk\_space+\s*$ > + 1 > + > + > diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml b/rhel6= /src/input/checks/rsyslog_messages_captured.xml > new file mode 100644 > index 0000000..0639653 > --- /dev/null > +++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml > @@ -0,0 +1,70 @@ > + > + + version=3D"1"> > + > + Ensure Important Messages are Captured > + > + Red Hat Enterprise Linux 6 > + > + > + Make sure appropriate lines are in rsyslog.conf. > + > + > + > + > + > + > + > + > + > + = > + > + > + > + > + /etc > + rsyslog.conf > + ^auth\.\*[\s]*\,[\s]*user\.= \*[\s]+\/var\/log\/messages$ > + 1 > + > + = > + > + > + > + > + /etc > + rsyslog.conf > +^kern\.\*[\s]+\/var\/log\/kern\= .log$ > + 1 > + > + = > + > + > + > + > + /etc > + rsyslog.conf > +^daemon\.\*[\s]+\/var\/log\/dae= mon\.log$ > + 1 > + > + = > + > + > + > + > + /etc > + rsyslog.conf > + ^syslog\.\*[\s]+\/var\/log\/sy= slog$ > + 1 > + > + = > + > + > + > + > + /etc > + rsyslog.conf > + ^lpr\,news\,uucp\,local0\,loca= l1\,local2\,local3\,local4\,local5\,local6\.\*[\s]+\/var\/log\/unused\.log$= > + 1 > + > + = > diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system= /auditing.xml > index e75754f..1d18eaf 100644 > --- a/rhel6/src/input/system/auditing.xml > +++ b/rhel6/src/input/system/auditing.xml > @@ -95,6 +95,51 @@ process during boot. > > > = > + > + > > Configure <tt>auditd</tt> Rules for Comprehensive Auditing > The auditd program can perform comprehensive > @@ -171,7 +216,6 @@ to capture events that modify account changes: > > > = > - > > Record Events that Modify the System=E2=80=99s Network Environmen= t > Add the following to /etc/audit/audit.rules, setti= ng > @@ -205,6 +249,37 @@ anything other than administrator action. All change= s to MAC policy should be au > > > = > + > + Record Attempts to Alter Logon and Logout Events > + = > +The audit system already collects login info for all users and root. To = watch for attempted manual edits of = > +files involved in storing logon events, add the following to /etc/au= dit/audit.rules: = > +
> +-w /var/log/faillog -p wa -k logins =

> +-w /var/log/lastlog -p wa -k logins
> +
> +
> + > + > + > +
> + > + > + > + Record Attempts to Alter Process and Session Initiation Informat= ion > + = > +The audit system already collects process information for all users and = root. To watch for attempted manual = > +edits of files involved in storing such process information, add the fol= lowing to /etc/audit/audit.rules: = > +
> +-w /var/run/utmp -p wa -k session =

> +-w /var/log/btmp -p wa -k session =

> +-w /var/log/wtmp -p wa -k session
> +
> +
> + > + > + > +
> = > > Ensure <tt>auditd</tt> Collects Discretionary Access Control > diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/= logging.xml > index 839484e..fc6b311 100644 > --- a/rhel6/src/input/system/logging.xml > +++ b/rhel6/src/input/system/logging.xml > @@ -54,6 +54,25 @@ logging services. > <ref nist=3D"AU-2" /> > </Rule> > = > +<Rule id=3D"ensure_rsyslog_messages_captured"> > +<title> Ensure Important Messages are Captured > + > +Edit the file /etc/rsyslog.conf. Add or correct whichever of th= e following lines are appropriate for your > +environment: > +
> +auth.*,user.*                                                           =
/var/log/messages
> +kern.*                                                                  =
/var/log/kern.log
> +daemon.*                                                                =
/var/log/daemon.log
> +syslog.*                                                                =
/var/log/syslog
> +lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*        =
/var/log/unused.log
> +
> +See the man page rsyslog.conf(5) for more information. > +By default, rsyslog uses a timestamp format that Logw= atch does not understand. If your en- > +vironment uses Logwatch, edit the file /etc/rsyslog.conf and ad= d or edit the following line: > +
$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> + > +
> + > > Confirm Existence and Permissions of System Log Files > For each log file LOGFILE referenced in > @@ -297,4 +316,52 @@ if the /var/log partition becomes full. > > > > + > + > + Configure Logwatch on the Central Log Server > + = > +Is this machine the central log server? If so, edit the file /etc/lo= gwatch/conf/logwatch.conf. Add or = > +correct the following lines: > +
 =

> +HostLimit =3D no =

> +SplitHosts =3D yes =

> +MultiEmail =3D no =

> +Service =3D -zz-disk_space =

> +
> +Ensure that logwatch.pl is run nightly from cron. (Thi= s is the default): = > +
# cd /etc/cron.daily =

> +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch =

> +
> +On a central logserver, you want Logwatch to summarize all syslog entrie= s, including those which did not originate = > +on the logserver itself. The HostLimit setting tells Logwatch t= o report on all hosts, not just the one on which it = > +is running. = > +If SplitHosts is set, Logwatch will separate entries by hostnam= e. This makes the report longer but significantly = > +more usable. If it is not set, then Logwatch will not report which host = generated a given log entry, and that = > +information is almost always necessary. If MultiEmail is set, t= hen each host's information will be sent in a = > +separate e-mail message. This is a matter of preference. = > +The Service directive -zz-disk_space tells Logwatch no= t to run the zz-disk_space report, which reports on = > +free disk space. Since all log monitoring is being done on the central l= ogserver, the disk space listing will always be = > +that of the logserver, regardless of which host is being monitored. This= is confusing, so disable that service. Note = > +that this does mean that Logwatch will not monitor disk usage i= nformation. Many workarounds are possible, = > +such as running df on each host daily via cron and sen= ding the output to syslog so that it will be reported to = > +the logserver.
> + > + > +
> + > + > + > + Disable Logwatch on Clients if a Logserver Exists > + = > +Does your site have a central logserver which has been configured to rep= ort on logs received from all systems? = > +If so: > +
 =

> +# rm /etc/cron.daily/0logwatch =

> +
> +If no logserver exists, it will be necessary for each machine to run Log= watch individually. Using a central = > +logserver provides the security and reliability benefits discussed earli= er, and also makes monitoring logs easier = > +and less time-intensive for administrators.
> + > +
>
> + --===============0017172960463546970==--