From shawn at redhat.com Thu Aug 20 11:34:48 2015 Content-Type: multipart/mixed; boundary="===============2749814370698240199==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED) Date: Mon, 19 Aug 2013 23:59:57 -0400 Message-ID: <5212E9BD.6000408@redhat.com> In-Reply-To: 4722C175AFAA7C4A85CE84AF00B6D57907C8E5FD@ba-exch1.ds.amrdec.army.mil --===============2749814370698240199== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/19/13 6:07 PM, Beavers, Randall D. CTR (US) wrote: > Willy Santos & Shawn Wells, Willy's no longer with RHT :( He may still be lurking on the list though. > I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists. > (searching CCI information online). > > I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs > to DISA STIGS for my program. Any help would be appreciated. Seems the > DISA IASE website and the VMS site doesn't jive. > > Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that > would help me? In excel format? In xml format? > > Please advise. Various rules are mapped back to policies via the tags. Example is = the selinux_unlabeled_device_files rule: > | > Ensure No Device Files are Unlabeled by SELinux > Device files, which are used for communication with important > system resources, should be labeled with proper SELinux types. If any dev= ice > files carry the SELinux type unlabeled_t, investigate the cause = and > correct the file's context. > > To check for unlabeled device files, run= the following command: >
# ls -RZ /dev | grep unlabeled_t
> It should produce no output in a well-configured system.
> > If a device file carries the SELinux type unlabeled_t, then SELi= nux > cannot properly restrict access to the device file. > > > > > >
| (ref: = https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/= system/selinux.xml) Through this metadata we can associate CCE 26774-0 against the indicated = NIST 800-53 rev3 and DISA CCI requirements. This information is transformed via the 'make tables' transform, which = generates CCI to SRG: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel= 6-srgmap-flat.html and CCI to NIST: http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig= -rhel6-server-flat.html Do these help? --===============2749814370698240199== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9SVNP LTg4NTktMSIKICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICA8L2hlYWQ+CiAgPGJv ZHkgYmdjb2xvcj0iI0ZGRkZGRiIgdGV4dD0iIzAwMDAwMCI+CiAgICA8ZGl2IGNsYXNzPSJtb3ot Y2l0ZS1wcmVmaXgiPk9uIDgvMTkvMTMgNjowNyBQTSwgQmVhdmVycywgUmFuZGFsbCBELgogICAg ICBDVFIgKFVTKSB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCmNpdGU9Im1p ZDo0NzIyQzE3NUFGQUE3QzRBODVDRTg0QUYwMEI2RDU3OTA3QzhFNUZEQGJhLWV4Y2gxLmRzLmFt cmRlYy5hcm15Lm1pbCIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj4KV2ls bHkgU2FudG9zICZhbXA7IFNoYXduIFdlbGxzLDwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAg V2lsbHkncyBubyBsb25nZXIgd2l0aCBSSFQgOig8YnI+CiAgICAmbmJzcDs8YnI+CiAgICBIZSBt YXkgc3RpbGwgYmUgbHVya2luZyBvbiB0aGUgbGlzdCB0aG91Z2guPGJyPgogICAgPGJyPgogICAg PGJyPgogICAgPGJsb2NrcXVvdGUKY2l0ZT0ibWlkOjQ3MjJDMTc1QUZBQTdDNEE4NUNFODRBRjAw QjZENTc5MDdDOEU1RkRAYmEtZXhjaDEuZHMuYW1yZGVjLmFybXkubWlsIgogICAgICB0eXBlPSJj aXRlIj4KICAgICAgPHByZSB3cmFwPSIiPkknbSBzZWVpbmcgeW91IGd1eXMgbWFwcGluZyBhIGxv dCBvZiBDQ0lzIHRvIFJIRUwgNiBvbiB0aGUgbGlzdHMuCihzZWFyY2hpbmcgQ0NJIGluZm9ybWF0 aW9uIG9ubGluZSkuCgpJJ20gZG9pbmcgc29tZSB3b3JrIG1hcHBpbmcgdGhlIE5JU1QgODAwLTUz ICh2LjQpIHRvIENDSXMgdG8gRElTQSBTUkdzCnRvIERJU0EgU1RJR1MgZm9yIG15IHByb2dyYW0u ICBBbnkgaGVscCB3b3VsZCBiZSBhcHByZWNpYXRlZC4gIFNlZW1zIHRoZQpESVNBIElBU0Ugd2Vi c2l0ZSBhbmQgdGhlIFZNUyBzaXRlIGRvZXNuJ3Qgaml2ZS4KCkRvIHlvdSBndXlzIGhhdmUgc29t ZSBkZWZpbml0aXZlIG1hcHBpbmdzIGZvciBSSEVMIDYuNCBDQ0VzIC8gQ0NJcyB0aGF0CndvdWxk IGhlbHAgbWU/IEluIGV4Y2VsIGZvcm1hdD8gIEluIHhtbCBmb3JtYXQ/CgpQbGVhc2UgYWR2aXNl LjwvcHJlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgPGJyPgogICAgVmFyaW91cyBy dWxlcyBhcmUgbWFwcGVkIGJhY2sgdG8gcG9saWNpZXMgdmlhIHRoZSAmbHQ7cmVmJmd0OyB0YWdz LgogICAgRXhhbXBsZSBpcyB0aGUgc2VsaW51eF91bmxhYmVsZWRfZGV2aWNlX2ZpbGVzIHJ1bGU6 PGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgIDxtZXRhIGNoYXJzZXQ9InV0 Zi04Ij4KICAgICAgPHByZSBzdHlsZT0ibWFyZ2luOiAwcHg7IHBhZGRpbmc6IDBweDsgY29sb3I6 IHJnYigwLCAwLCAwKTsgZm9udC1zaXplOiAxM3B4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQt dmFyaWFudDogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9y bWFsOyBsaW5lLWhlaWdodDogMTlweDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGlnbjogc3RhcnQ7 IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aWRvd3M6IGF1dG87IHdv cmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IGJhY2tncm91 bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsiPjxjb2RlIHN0eWxlPSJiYWNrZ3JvdW5kLWNv bG9yOiByZ2JhKDAsIDAsIDAsIDAuMDk4MDM5Mik7IHBhZGRpbmc6IDFweDsgYmFja2dyb3VuZC1w b3NpdGlvbjogaW5pdGlhbCBpbml0aWFsOyBiYWNrZ3JvdW5kLXJlcGVhdDogaW5pdGlhbCBpbml0 aWFsOyI+Jmx0O1J1bGUgaWQ9InNlbGludXhfdW5sYWJlbGVkX2RldmljZV9maWxlcyImZ3Q7CiZs dDt0aXRsZSZndDtFbnN1cmUgTm8gRGV2aWNlIEZpbGVzIGFyZSBVbmxhYmVsZWQgYnkgU0VMaW51 eCZsdDsvdGl0bGUmZ3Q7CiZsdDtkZXNjcmlwdGlvbiZndDtEZXZpY2UgZmlsZXMsIHdoaWNoIGFy ZSB1c2VkIGZvciBjb21tdW5pY2F0aW9uIHdpdGggaW1wb3J0YW50CnN5c3RlbSByZXNvdXJjZXMs IHNob3VsZCBiZSBsYWJlbGVkIHdpdGggcHJvcGVyIFNFTGludXggdHlwZXMuIElmIGFueSBkZXZp Y2UKZmlsZXMgY2FycnkgdGhlIFNFTGludXggdHlwZSAmbHQ7dHQmZ3Q7dW5sYWJlbGVkX3QmbHQ7 L3R0Jmd0OywgaW52ZXN0aWdhdGUgdGhlIGNhdXNlIGFuZApjb3JyZWN0IHRoZSBmaWxlJ3MgY29u dGV4dC4KJmx0Oy9kZXNjcmlwdGlvbiZndDsKJmx0O29jaWwgY2xhdXNlPSJ0aGVyZSBpcyBvdXRw dXQiJmd0O1RvIGNoZWNrIGZvciB1bmxhYmVsZWQgZGV2aWNlIGZpbGVzLCBydW4gdGhlIGZvbGxv d2luZyBjb21tYW5kOgombHQ7cHJlJmd0OyMgbHMgLVJaIC9kZXYgfCBncmVwIHVubGFiZWxlZF90 Jmx0Oy9wcmUmZ3Q7Ckl0IHNob3VsZCBwcm9kdWNlIG5vIG91dHB1dCBpbiBhIHdlbGwtY29uZmln dXJlZCBzeXN0ZW0uJmx0Oy9vY2lsJmd0OwombHQ7cmF0aW9uYWxlJmd0OwpJZiBhIGRldmljZSBm aWxlIGNhcnJpZXMgdGhlIFNFTGludXggdHlwZSAmbHQ7dHQmZ3Q7dW5sYWJlbGVkX3QmbHQ7L3R0 Jmd0OywgdGhlbiBTRUxpbnV4CmNhbm5vdCBwcm9wZXJseSByZXN0cmljdCBhY2Nlc3MgdG8gdGhl IGRldmljZSBmaWxlLgombHQ7L3JhdGlvbmFsZSZndDsKJmx0O2lkZW50IGNjZT0iMjY3NzQtMCIg LyZndDsKJmx0O292YWwgaWQ9InNlbGludXhfYWxsX2RldmljZWZpbGVzX2xhYmVsZWQiIC8mZ3Q7 CiZsdDtyZWYgbmlzdD0iQUMtNixBVS05LENNLTciIGRpc2E9IjIyLDMyIi8mZ3Q7CiZsdDt0ZXN0 ZWQgYnk9IkRTIiBvbj0iMjAxMjEwMjQiLyZndDsKJmx0Oy9SdWxlJmd0OzwvY29kZT48L3ByZT4K ICAgIDwvYmxvY2txdW90ZT4KICAgIChyZWY6CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl eHQiIGhyZWY9Imh0dHBzOi8vZ2l0LmZlZG9yYWhvc3RlZC5vcmcvY2dpdC9zY2FwLXNlY3VyaXR5 LWd1aWRlLmdpdC90cmVlL1JIRUw2L2lucHV0L3N5c3RlbS9zZWxpbnV4LnhtbCI+aHR0cHM6Ly9n aXQuZmVkb3JhaG9zdGVkLm9yZy9jZ2l0L3NjYXAtc2VjdXJpdHktZ3VpZGUuZ2l0L3RyZWUvUkhF TDYvaW5wdXQvc3lzdGVtL3NlbGludXgueG1sPC9hPik8YnI+CiAgICA8YnI+CiAgICBUaHJvdWdo IHRoaXMgbWV0YWRhdGEgd2UgY2FuIGFzc29jaWF0ZSBDQ0UgMjY3NzQtMCBhZ2FpbnN0IHRoZQog ICAgaW5kaWNhdGVkIE5JU1QgODAwLTUzIHJldjMgYW5kIERJU0EgQ0NJIHJlcXVpcmVtZW50cy48 YnI+CiAgICA8YnI+CiAgICBUaGlzIGluZm9ybWF0aW9uIGlzIHRyYW5zZm9ybWVkIHZpYSB0aGUg J21ha2UgdGFibGVzJyB0cmFuc2Zvcm0sCiAgICB3aGljaCBnZW5lcmF0ZXMgQ0NJIHRvIFNSRzo8 YnI+CjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9wZW9wbGUu cmVkaGF0LmNvbS9zd2VsbHMvc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9vdXRwdXQvdGFibGUt cmhlbDYtc3JnbWFwLWZsYXQuaHRtbCI+aHR0cDovL3Blb3BsZS5yZWRoYXQuY29tL3N3ZWxscy9z Y2FwLXNlY3VyaXR5LWd1aWRlL1JIRUw2L291dHB1dC90YWJsZS1yaGVsNi1zcmdtYXAtZmxhdC5o dG1sPC9hPjxicj4KICAgIDxicj4KICAgIGFuZCBDQ0kgdG8gTklTVDo8YnI+CjxhIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHA6Ly9wZW9wbGUucmVkaGF0LmNvbS9zd2Vs bHMvc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9vdXRwdXQvdGFibGUtc3RpZy1yaGVsNi1zZXJ2 ZXItZmxhdC5odG1sIj5odHRwOi8vcGVvcGxlLnJlZGhhdC5jb20vc3dlbGxzL3NjYXAtc2VjdXJp dHktZ3VpZGUvUkhFTDYvb3V0cHV0L3RhYmxlLXN0aWctcmhlbDYtc2VydmVyLWZsYXQuaHRtbDwv YT48YnI+CiAgICA8YnI+CiAgICBEbyB0aGVzZSBoZWxwPzxicj4KICA8L2JvZHk+CjwvaHRtbD4K --===============2749814370698240199==-- From randall.d.beavers.ctr at mail.mil Thu Aug 20 11:34:52 2015 Content-Type: multipart/mixed; boundary="===============5532612620107167828==" MIME-Version: 1.0 From: Beavers, Randall D. CTR (US) To: scap-security-guide at lists.fedorahosted.org Subject: Re: Re: [PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED) Date: Mon, 19 Aug 2013 17:07:25 -0500 Message-ID: <4722C175AFAA7C4A85CE84AF00B6D57907C8E5FD@ba-exch1.ds.amrdec.army.mil> --===============5532612620107167828== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Classification: UNCLASSIFIED Caveats: NONE Willy Santos & Shawn Wells, I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists. (searching CCI information online). I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs to DISA STIGS for my program. Any help would be appreciated. Seems the DISA IASE website and the VMS site doesn't jive. Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that would help me? In excel format? In xml format? Please advise. Randy Beavers, GSLC, CISSP Information Assurance Engineer Joint Battle Command-Platform 6000-C Technology Drive Huntsville, AL 35805 256-842-5426 (work) 256-289-6054 (cell) 256-876-2576 (fax) randall.d.beavers.ctr(a)mail.mil randall.d.beavers.ctr(a)mail.smil.mil Classification: UNCLASSIFIED Caveats: NONE --===============5532612620107167828==-- From blank at eclipse.ncsc.mil Thu Aug 20 11:34:52 2015 Content-Type: multipart/mixed; boundary="===============4170895351956861110==" MIME-Version: 1.0 From: Jeffrey Blank To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED) Date: Tue, 20 Aug 2013 10:32:03 -0400 Message-ID: <52137DE3.6030302@eclipse.ncsc.mil> In-Reply-To: 4722C175AFAA7C4A85CE84AF00B6D57907C8E5FD@ba-exch1.ds.amrdec.army.mil --===============4170895351956861110== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Yes, I'd also be interested in the answer. The policy mapping situation is messy. It doesn't really seem like anybody makes consistent use (if not utility) of 800-53. Once the OVAL is tested with OpenSCAP, we will issue a security guide from the project. But at present it would be quite difficult to make much sense of the policy mappings (aside from perhaps the CCIs issued in the STIG) to include in any such issuance. One of the original goals of the project was to ensure that a high-quality set of mappings was available for the configuration guidance, to simplify/speed the dissemination of this kind of information and ease deployment. Not so sure this is practical or worthwhile anymore. Consider this an invitation to open discussion on the matter. ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance On 08/19/2013 06:07 PM, Beavers, Randall D. CTR (US) wrote: > Classification: UNCLASSIFIED > Caveats: NONE > = > Willy Santos & Shawn Wells, > = > I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists. > (searching CCI information online). > = > I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs > to DISA STIGS for my program. Any help would be appreciated. Seems the > DISA IASE website and the VMS site doesn't jive. > = > Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that > would help me? In excel format? In xml format? > = > Please advise. > = > Randy Beavers, GSLC, CISSP > Information Assurance Engineer > Joint Battle Command-Platform > 6000-C Technology Drive > Huntsville, AL 35805 > 256-842-5426 (work) > 256-289-6054 (cell) > 256-876-2576 (fax) > randall.d.beavers.ctr(a)mail.mil > randall.d.beavers.ctr(a)mail.smil.mil > = > = > = > Classification: UNCLASSIFIED > Caveats: NONE > = > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > = --=20 --===============4170895351956861110==--