From blank at eclipse.ncsc.mil Thu Aug 20 11:30:51 2015 Content-Type: multipart/mixed; boundary="===============5488026730900638544==" MIME-Version: 1.0 From: Jeffrey Blank To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 2/3] M1 Incomplete Guidance - Account and Access Control Date: Wed, 11 Apr 2012 12:05:03 -0400 Message-ID: <4F85ABAF.5070102@eclipse.ncsc.mil> In-Reply-To: 1334093083-21022-3-git-send-email-mpalmiotto@tresys.com --===============5488026730900638544== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Some issues for this patch: 1) Does pam_ccreds exist on RHEL 6? (I didn't think it did.) There is an expectation that things are tested at least once (on RHEL 6) before they're proposed for a commit. 2) Per our brief discussion about the intent behind Rules verify_wheel_exists and accounts_root_auditing_improved, there's too much variation in the real world to insist that everyone call their admin group wheel. It may be better as general discussion in a Group (i.e to recommend that a group is used for all admin). 3) The group bios_password is a nice addition, except that it's referencing section numbers which don't exist or aren't correct (and aren't going to be correct). Let's avoid any references to sections via section number in this project; in the other guide they were only made because it was easy to keep straight by doing a \ref{} to a \label{} (in LaTeX). (I don't know if there is a similar facility in XCCDF / XHTML / DocBook, or whether it's worth the trouble here). Prior to commit, there's a general expectation of proofreading, especially following a copy-paste from the RHEL 5 guide. Ditto for the section reference in Rule login_shell_inactivity_timeout. On 04/10/2012 05:24 PM, Mike Palmiotto wrote: > From: Michael Palmiotto > = > --- > .../checks/accounts_disabled_after_expiration.xml | 24 +++++ > .../accounts_login_shell_timeout_implemented.xml | 55 +++++++++++ > .../input/checks/accounts_netrc_files_checked.xml | 25 +++++ > .../checks/accounts_root_auditing_improved.xml | 30 ++++++ > .../accounts_user_dot_files_not_world_writable.xml | 33 +++++++ > .../checks/libuser_login_defs_userdefaults.xml | 50 ++++++++++ > rhel6/src/input/system/accounts/accounts.xml | 27 ++++++ > rhel6/src/input/system/accounts/pam.xml | 38 +++++++- > rhel6/src/input/system/accounts/physical.xml | 41 ++++++++ > .../system/accounts/restrictions/restrictions.xml | 99 ++++++++++++++= ++++++ > rhel6/src/input/system/accounts/session.xml | 24 +++++ > 11 files changed, 445 insertions(+), 1 deletions(-) > create mode 100644 rhel6/src/input/checks/accounts_disabled_after_expira= tion.xml > create mode 100644 rhel6/src/input/checks/accounts_login_shell_timeout_i= mplemented.xml > create mode 100644 rhel6/src/input/checks/accounts_netrc_files_checked.x= ml > create mode 100644 rhel6/src/input/checks/accounts_root_auditing_improve= d.xml > create mode 100644 rhel6/src/input/checks/accounts_user_dot_files_not_wo= rld_writable.xml > create mode 100644 rhel6/src/input/checks/libuser_login_defs_userdefault= s.xml > = > diff --git a/rhel6/src/input/checks/accounts_disabled_after_expiration.xm= l b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml > new file mode 100644 > index 0000000..334c1dd > --- /dev/null > +++ b/rhel6/src/input/checks/accounts_disabled_after_expiration.xml > @@ -0,0 +1,24 @@ > + > + > + > + Ensure Accounts Set to Disable After Password Expiration</= title> > + <affected family=3D"unix"> > + <platform>Red Hat Enterprise Linux 6</platform> > + </affected> > + <reference ref_id=3D"TODO" source=3D"CCE" /> > + <description> Check for INACTIVE line in useradd.</description> > + </metadata> > + <criteria operator=3D"AND"> > + <criterion comment=3D"inactive set" test_ref=3D"test_accounts_disa= bled_after_expiration_inactive" /> > + </criteria> > + </definition> > + <ind:textfilecontent54_test check=3D"all" comment=3D"inactive set in u= seradd" id=3D"test_accounts_disabled_after_expiration_inactive" version=3D"= 1"> > + <ind:object object_ref=3D"object_accounts_disabled_after_expiration_= inactive" /> > + </ind:textfilecontent54_test> > + <ind:textfilecontent54_object id=3D"object_accounts_disabled_after_exp= iration_inactive" version=3D"1"> > + <ind:path>/etc/default</ind:path> > + <ind:filename>useradd</ind:filename> > + <ind:pattern operation=3D"pattern match">^INACTIVE\=3D[\d{1,3}]\s*$<= /ind:pattern> > + <ind:instance datatype=3D"int">1</ind:instance> > + </ind:textfilecontent54_object> > +</def-group> > diff --git a/rhel6/src/input/checks/accounts_login_shell_timeout_implemen= ted.xml b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.x= ml > new file mode 100644 > index 0000000..aa330c8 > --- /dev/null > +++ b/rhel6/src/input/checks/accounts_login_shell_timeout_implemented.xml > @@ -0,0 +1,55 @@ > +<def-group> > + <!-- THIS FILE IS GENERATED by create_file_entries.py. --> > + <definition class=3D"compliance" id=3D"accounts_login_shell_timeout_im= plemented" version=3D"1"> > + <metadata> > + <title> Implement Inactivity Time-out for Login Shells > + > + Red Hat Enterprise Linux 6 > + > + > + Check if login shells set to automatically log users= out after a certain period of inactivity. > + > + > + > + > + > + > + > + > + > + > + > + > + /etc/profile.d > + tmout.sh > + ^readonly[\s]+TMOUT\s*$ > + 1 > + > + > + > + > + > + /etc/profile.d > + tmout.sh > + ^TMOUT\=3D\d{3,5}\s*$ > + 1 > + > + > + > + > + > + /etc/profile.d > + tmout.sh > + ^export[\s]+TMOUT\s*$ > + 1 > + > + > + > + > + > + /etc/profile.d > + autologout.csh > + ^set[\s]+\-r[\s]+autologout= [\s]+\d{1,3}\s*$ > + 1 > + > + > diff --git a/rhel6/src/input/checks/accounts_netrc_files_checked.xml b/rh= el6/src/input/checks/accounts_netrc_files_checked.xml > new file mode 100644 > index 0000000..2a4a6ca > --- /dev/null > +++ b/rhel6/src/input/checks/accounts_netrc_files_checked.xml > @@ -0,0 +1,25 @@ > + > + > + > + Ensure No .netrc Files > + > + Red Hat Enterprise Linux 6 > + > + > + Check that .netrc files are missing from all user acc= ounts. > + > + > + > + > + > + > + > + > + > + > + /home > + .netrc > + > + > + > + > diff --git a/rhel6/src/input/checks/accounts_root_auditing_improved.xml b= /rhel6/src/input/checks/accounts_root_auditing_improved.xml > new file mode 100644 > index 0000000..648bc02 > --- /dev/null > +++ b/rhel6/src/input/checks/accounts_root_auditing_improved.xml > @@ -0,0 +1,30 @@ > + > + > + > + Verify Sudo Audit Trail > + > + Red Hat Enterprise Linux 6 > + > + > + Check if the following line appears in /etc/sudoers.<= /description> > + > + = > + > + = > + > + > + > + > + > + = > + > + > + > + > + /etc > + sudoers > + ^\%wheel[\s]+[\s]+ALL\=3D\(= ALL\)[\s]+[\s]+ALL\s*$ > + 1 > + > + > + > diff --git a/rhel6/src/input/checks/accounts_user_dot_files_not_world_wri= table.xml b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writab= le.xml > new file mode 100644 > index 0000000..82a9e45 > --- /dev/null > +++ b/rhel6/src/input/checks/accounts_user_dot_files_not_world_writable.x= ml > @@ -0,0 +1,33 @@ > + > + > + > + Ensure User Dot Files not World Writable > + > + Red Hat Enterprise Linux 6 > + > + > + File permissions should be set correctly for dot-file= s for all user accounts. > + > + > + > + > + > + > + > + > + > + > + > + /home > + .* > + state_dot_files_wrong_perm > + > + > + true > + true > + true > + true > + true > + > + > + > diff --git a/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml b= /rhel6/src/input/checks/libuser_login_defs_userdefaults.xml > new file mode 100644 > index 0000000..66345a5 > --- /dev/null > +++ b/rhel6/src/input/checks/libuser_login_defs_userdefaults.xml > @@ -0,0 +1,50 @@ > + > + > + > + Check if Password Parameters are Removed from libuser.conf<= /title> > + <affected family=3D"unix"> > + <platform>Red Hat Enterprise Linux 6</platform> > + </affected> > + <reference ref_id=3D"TODO" source=3D"CCE" /> > + <description> Make sure the password password parameters are remov= ed from libuser.conf.</description> > + </metadata> > + <criteria operator=3D"AND"> > + = > + <criterion comment=3D"shadowmin removed" test_ref=3D"test_libuser_= login_defs_removed_shadowmin" /> > + <criterion comment=3D"shadowmax removed" test_ref=3D"test_libuser_= login_defs_removed_shadowmax" /> > + <criterion comment=3D"shadowwarn removed" test_ref=3D"test_libuser= _login_defs_removed_shadowwarn" /> > + = > + </criteria> > + </definition> > + = > + <ind:textfilecontent54_test check=3D"all" check_existence=3D"none_exis= t" comment=3D"shadowmin removed from login.defs" id=3D"test_libuser_login_d= efs_removed_shadowmin" version=3D"1"> > + <ind:object object_ref=3D"object_libuser_login_defs_removed_shadowmi= n" /> > + </ind:textfilecontent54_test> > + <ind:textfilecontent54_object id=3D"object_libuser_login_defs_removed_= shadowmin" version=3D"1"> > + <ind:path>/etc</ind:path> > + <ind:filename>login.defs</ind:filename> > + <ind:pattern operation=3D"pattern match">^LU\_SHADOWMIN\s*$</ind:pat= tern> > + <ind:instance datatype=3D"int">1</ind:instance> > + </ind:textfilecontent54_object> > + = > + <ind:textfilecontent54_test check=3D"all" check_existence=3D"none_exis= t" comment=3D"shadowmax removed from login.defs" id=3D"test_libuser_login_d= efs_removed_shadowmax" version=3D"1"> > + <ind:object object_ref=3D"object_libuser_login_defs_removed_shadowma= x" /> > + </ind:textfilecontent54_test> > + <ind:textfilecontent54_object id=3D"object_libuser_login_defs_removed_= shadowmax" version=3D"1"> = > + <ind:path>/etc</ind:path> > + <ind:filename>login.defs</ind:filename> > + <ind:pattern operation=3D"pattern match">^LU\_SHADOWMAX\s*$</ind:pat= tern> > + <ind:instance datatype=3D"int">1</ind:instance> > + </ind:textfilecontent54_object> > + = > + <ind:textfilecontent54_test check=3D"all" check_existence=3D"none_exis= t" comment=3D"shadowwarn removed from login.defs" id=3D"test_libuser_login_= defs_removed_shadowwarn" version=3D"1"> > + <ind:object object_ref=3D"object_libuser_login_defs_removed_shadowwa= rn" /> > + </ind:textfilecontent54_test> > + <ind:textfilecontent54_object id=3D"object_libuser_login_defs_removed_= shadowwarn" version=3D"1"> = > + <ind:path>/etc</ind:path> > + <ind:filename>login.defs</ind:filename> > + <ind:pattern operation=3D"pattern match">^LU\_SHADOWWARNING\s*$</ind= :pattern> > + <ind:instance datatype=3D"int">1</ind:instance> > + </ind:textfilecontent54_object> > + > +</def-group> > diff --git a/rhel6/src/input/system/accounts/accounts.xml b/rhel6/src/inp= ut/system/accounts/accounts.xml > index fbdeb39..e5b61a6 100644 > --- a/rhel6/src/input/system/accounts/accounts.xml > +++ b/rhel6/src/input/system/accounts/accounts.xml > @@ -8,4 +8,31 @@ access to accounts, particularly to privileged accounts,= is a > necessary part of securing a system. This section introduces > mechanisms for restricting access to accounts under > RHEL6.</description> > + > +<Group id=3D"all_human_users_group"> > +<title> Create and Maintain a Group Containing All Human Users > + > +Identify all user accounts on the system which correspond to human users= . Depending on your system > +configuration, this may be all entries in /etc/passwd with UID = values of at least 500. Once, you have > +identified such a set of users, create a group named usergroup (substitu= te some name appropriate to your > +environment) and populate it with each human user: > +
# groupadd usergroup
> +# usermod -G usergroup human1
> +# usermod -G usergroup human2
> +...
> +# usermod -G usergroup humanN
> +Then modify your procedure for creating new user accounts by adding = -G usergroup to the set of flags with > +which useradd is invoked, so that new human users will be place= d in the correct group by default. > + > +Creating a group of human users does not, by itself, enhance system secu= rity. However, as you work on securing > +your system, you will often find commands which never need to be run by = system accounts, or which are only > +ever needed by users logged into the graphical console (which should onl= y ever be available to human users, even > +on workstations). Once a group of users has been created, it is easy to = restrict access to a given command, for > +instance /path/to/graphical/command, to authorized users: > +
# chgrp usergroup /path/to/graphical/command
> +# chmod 750 /path/graphical/command
> +Without a group of human users, it is necessary to restrict access by so= mehow preventing each system account > +from running the command, which is an error-prone process even when it i= s possible at all.
> + > + > > diff --git a/rhel6/src/input/system/accounts/pam.xml b/rhel6/src/input/sy= stem/accounts/pam.xml > index bc91277..0782e1d 100644 > --- a/rhel6/src/input/system/accounts/pam.xml > +++ b/rhel6/src/input/system/accounts/pam.xml > @@ -309,6 +309,31 @@ prevents direct password guessing attacks. > = > > = > + > = > > Set Password Hashing Algorithm > @@ -374,7 +399,18 @@ compromised could be used yet again by an attacker. > > > > - > + > + > + > + Remove the <tt>pam_ccreds</tt> Package if Possible > + > +Unless its credential caching functionality is required, remove the = pam_ccreds package: > +
# yum erase pam_ccreds
> +The pam_ccreds package contains the setuid program /usr/sbi= n/ccreds_validate and should be removed > +unless it provides essential functionality. Any credentials cached on a = system would also be compromised if an > +attacker obtains control of the system.
> + > +
> = > > = > diff --git a/rhel6/src/input/system/accounts/physical.xml b/rhel6/src/inp= ut/system/accounts/physical.xml > index 45ad144..27441e0 100644 > --- a/rhel6/src/input/system/accounts/physical.xml > +++ b/rhel6/src/input/system/accounts/physical.xml > @@ -7,6 +7,23 @@ there are some steps which, if taken, make it more diffi= cult for an > attacker to quickly or undetectably modify a system from its > console. > = > + > +Set BIOS Password > +BIOS (on x86 systems) is the first code to execute during s= ystem startup and controls many important > +system parameters, including which devices the system will try to boot f= rom, and in which order. > +Assign a password to prevent any unauthorized changes to the BIOS config= uration. The exact steps will > +vary depending on your machine, but are likely to include: > +1.Reboot the machine. > +2.Press the appropriate key during the initial boot screen (F2 is typica= l). > +3.Navigate the BIOS configuration menu to add a password. > +The exact process will be system-specific and the system's hardware manu= al may provide detailed instructions. > +This password should prevent attackers with physical access from attempt= ing to change important parameters, > +such as those described in Sections 2.5.2.2.1 and 2.2.2.2.4. However, an= attacker with physical access can usually > +clear the BIOS password. The password should be written down and stored = in a physically-secure location, such > +as a safe, in the event that it is forgotten and must be retrieved. > + > + > + > > Set Boot Loader Password > During the boot process, the boot loader is > @@ -133,6 +150,30 @@ services, weakening system security. > > > = > + > + Implement Inactivity Time-out for Login Shells > + > +If the system does not run X Windows, then the login shells can be confi= gured to automatically log users out after > +a period of inactivity. The following instructions are not practical for= systems which run X Windows, as they > +will close terminal windows in the X environment. For information on how= to automatically lock those systems, > +see Section 2.3.5.6. > +To implement a 15-minute idle time-out for the default /bin/bash shell, create a new file tmout.sh in the directory /etc/prof= ile.d with the following lines: > +
TMOUT=3D900
> +readonly TMOUT
> +export TMOUT
> +To implement a 15-minute idle time-out for the tcsh shell, crea= te a new file autologout.csh in the directory > +/etc/profile.d with the following line: > +
set -r autologout 15
> +Similar actions should be taken for any other login shells used. > +The example time-out here of 15 minutes should be adjusted to whatever y= our security policy requires. The > +readonly line for bash and the -r option for tcsh<= /tt> can be omitted if policy allows users to override the value. > +The automatic shell logout only occurs when the shell is the foreground = process. If, for example, a vi session is > +left idle, then automatic logout would not occur. > +When logging in through a remote connection, as with SSH, it may be more= effective to set the timeout value > +directly through that service. To learn how to set automatic timeout int= ervals for SSH, see Section 3.5.2.3.
> + > + > +
> = > > Configure Screen Locking > diff --git a/rhel6/src/input/system/accounts/restrictions/restrictions.xm= l b/rhel6/src/input/system/accounts/restrictions/restrictions.xml > index febead6..cfee882 100644 > --- a/rhel6/src/input/system/accounts/restrictions/restrictions.xml > +++ b/rhel6/src/input/system/accounts/restrictions/restrictions.xml > @@ -10,4 +10,103 @@ console. Therefore, mechanisms for accessing accounts= by entering > usernames and passwords should be restricted to those which are > operationally necessary.
> = > + > + > + > + Verify <tt>sudo</tt> is Configured to Improve Auditing of Root A= ccess > + > +The sudo command allows fine-grained control over which users c= an execute commands using other accounts. > +The primary benefit of sudo when configured as above is that it= provides an audit trail of every command run > +by a privileged user. It is possible for a malicious administrator to ci= rcumvent this restriction, but, if there is an > +established procedure that all root commands are run using sudo= , then it is easy for an auditor to detect unusual > +behavior when this procedure is not followed.
> +
> + > + > +Editing /etc/sudoers by hand can be dangerous, since a configur= ation error may make it impossible to access > +the root account remotely. The recommended means of editing this file is= using the visudo command, which > +checks the file's syntax for correctness before allowing it to be saved.=
> + > +Note that sudo allows any attacker who gains access to the pass= word of an administrator account to run commands > +as root. This is a downside which must be weighed against the benefits o= f increased audit capability and of being > +able to heavily restrict the use of the high-value root password (which = can be logistically difficult to change > +often). As a basic precaution, never use the NOPASSWD di= rective, which would allow anyone with access to an administrator account t= o execute commands as root without knowing the administrator's password. > +
> + > + > + > +Ensure that the group wheel exists, and that the usernames of a= ll administrators who should be allowed > +to execute commands as root are members of that group. > +
# grep ^wheel /etc/group
> + > +
> + > + > +Edit the file /etc/sudoers. Add, uncomment, or cor= rect the line: > +
%wheel     ALL=3D(ALL)       ALL
> +
> + > +
> +
> + > + > + Remove Password Parameters from <tt>libuser.conf</tt> > +The /etc/libuser.conf file contains configuration = options for the libuser library, which is intended to implement > +a standardized interface for manipulating and administering user and gro= up accounts. By default, it sources > +password settings from /etc/login.defs, but it can override the= se parameters. The man page libuser.conf(5) contains more informat= ion. > + > + > +Verify Line Under Import Section > + > +Ensure the following line exists within the file /etc/libuser.conf under the [import] section. > +
login_defs =3D /etc/login.defs
> + > +
> + > + > +Verify Lines do not Appear in Userdefaults Section > + > +Ensure that no lines beginning with the following appear in the [use= rdefaults] section of the file, as > +these override settings from /etc/login.defs: > +
LU_SHADOWMAX
> +LU_SHADOWMIN
> +LU_SHADOWWARNING
> + > +
> +
> + > + > + > + Set Accounts to Disable After Password Expiration > + > +In order to automatically disable local accounts some number of DAYS<= /i> after password expiration, add or > +modify the following line in /etc/default/useradd: > +
INACTIVE=3DDAYS
> +For example, if
INACTIVE=3D30
and if the password is currentl= y on the verge of expiration, then 30 days remain > +until the account is automatically disabled. If the password will not ex= pire for another 60 days, then 90 days > +remain until the account is automatically disabled. See useradd(8) for more information. > +Determining the inactivity timeout must be done with careful considerati= on of the length of a "normal" period > +of inactivity for users in your environment. Setting the timeout too low= incurs support costs and also has the > +potential to impact availability of the system to legitimate users. > + > +
> + >
> diff --git a/rhel6/src/input/system/accounts/session.xml b/rhel6/src/inpu= t/system/accounts/session.xml > index 00b5a8d..f7e6530 100644 > --- a/rhel6/src/input/system/accounts/session.xml > +++ b/rhel6/src/input/system/accounts/session.xml > @@ -114,6 +114,19 @@ groups or ACLs. > > > = > + > + Ensure that User Dot-Files are not World-writable > + > +For each human user USER of the system, view the permissions of a= ll dot-files in the user's home directory: > +
# ls -ld /home/USER /.[A-Za-z0-9]*
> +Ensure that none of these files are group- or world-writable. Correct ea= ch misconfigured file FILE by exe- > +cuting: > +
# chmod go-w /home/USER /FILE
> +A user who can modify another user's configuration files can likely exec= ute commands with the other user's > +privileges, including stealing data, destroying files, or launching furt= her attacks on the system.
> + > +
> + > > Ensure that Users Have Sensible Umask Values > > @@ -168,6 +181,17 @@ operator=3D"equals" interactive=3D"0"> > 077 > > = > + > + Ensure that Users do not Have <tt>.netrc</tt> Files > + > +For each human user USER of the system, ensure that the user has = no .netrc file. The command: > +
# ls -l /home/USER /.netrc
> +should return the error "No such file or directory". If any user has suc= h a file, approach that user to discuss > +removing this file. > +The .netrc file is a configuration file used to make unattended= logins to other systems via FTP. When this file > +exists, it frequently contains unencrypted passwords which may be used t= o attack other systems.
> +
> + > > > Ensure the Default Bash Umask is Set Correctly --===============5488026730900638544==--