From swells at redhat.com Tue Mar 1 00:27:27 2016 Content-Type: multipart/mixed; boundary="===============0325655650123565033==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: STIG_Overlay.sh: rhel6->rhel7...Any recommendations on How to contribute? Date: Mon, 29 Feb 2016 19:27:17 -0500 Message-ID: <56D4E1E5.8070300@redhat.com> In-Reply-To: 20160301000248.26626.66461@mailman01.phx2.fedoraproject.org --===============0325655650123565033== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 2/29/16 7:02 PM, Mike Kuhnkey wrote: > stig_overlay.sh of rhel6 appears to be same for rhel7. When completed wh= at will rhel7 stig_overlay look like when rhel6 references are replaced? S= hould I be talking with DISA FSO or have I missed something in the Wiki or = blogs? It's not well documented =3D/ DISA creates their own identification scheme outside of industry CCEs. = These are the RHEL-06-* identifiers you mention. They come from the = RHEL/6/input/auxiliary/stig_overlay.xml file. For example: https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/au= xiliary/stig_overlay.xml#L11-L14 > ownerid=3D"RHEL-06-000004" disa=3D"137" severity=3D"low"> > > The system must use a separate file system for = > the system audit data path. > This will take the partition_for_var_log_audit rule and embed = RHEL-06-000004 into its metadata. As DISA gets closer to releasing the RHEL7 STIG, we'll update these = mappings for RHEL7 content (as by that time, DISA will have finalized = their RHEL-07-* numbering schemes). > DISA RHEL-7 Draft STIG references to "SRG-OS-000001-GPOS-00001" are new t= o me...Is this a new form of unified references? Somehow cross-referenced = to "CCI"? I need some guidance here, or is it still being sorted out? > > I really don't know how to phrase this question intelligently....can some= one help me out? You're not crazy. The SRG system is broken and going away. Until SRG = dies, the system goes something like this: Step 1: DISA attempts to interpret NIST 800-53 and selects controls they = feel are relevant for an operating system. From this, they create high = level requirements in the form of "General Purpose Operating System = Security Requirements Guide," or GPOS SRG. This is where the = SRG-OS-######-GPOS-##### numbers come from. The GPOS SRG is generic, = applicable to RHEL, Windows, OSX, etc. An example could be "Audit = Privileged User Actions." Outside of DISA, these numbers are entirely = meaningless. Step 2: Once DISA has the high-level requirements, they create = product-specific configuration guidance. This is where RHEL-07-###### = numbers come from. "Audit Privileged User Actions" might mean adding 10+ = audit rules for Linux, so we'd have RHEL-07-000000 through = RHEL-07-000010 mapped back to a single SRG-OS-GPS identifier. When RHEL = deployments attest to STIG compliance, they must show conformance to = RHEL-07-###### controls. Step 3: Once the RHEL-07-###### controls and naming schema is finalized, = we map them into the stig_overlay file. This will bind the DISA = identifiers into OpenSCAP XCCDF content. End result being DISA = identifiers show up in OpenSCAP HTML and CLI reports, looking something = like this: > Title Set Password Strength Minimum Special Characters > Rule accounts_password_pam_ocredit > Ident CCE-26409-3 > Ident DISA FSO RHEL-06-000058 > Result pass Does this help? --===============0325655650123565033== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGJyPgogICAgPGJyPgogICAgPGRpdiBjbGFz cz0ibW96LWNpdGUtcHJlZml4Ij5PbiAyLzI5LzE2IDc6MDIgUE0sIE1pa2UgS3VobmtleSB3cm90 ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDoyMDE2MDMw MTAwMDI0OC4yNjYyNi42NjQ2MUBtYWlsbWFuMDEucGh4Mi5mZWRvcmFwcm9qZWN0Lm9yZyIKICAg ICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxwcmUgd3JhcD0iIj5zdGlnX292ZXJsYXkuc2ggb2Ygcmhl bDYgYXBwZWFycyB0byBiZSBzYW1lIGZvciByaGVsNy4gIFdoZW4gY29tcGxldGVkIHdoYXQgd2ls bCByaGVsNyBzdGlnX292ZXJsYXkgbG9vayBsaWtlIHdoZW4gcmhlbDYgcmVmZXJlbmNlcyBhcmUg cmVwbGFjZWQ/ICBTaG91bGQgSSBiZSB0YWxraW5nIHdpdGggRElTQSBGU08gb3IgaGF2ZSBJIG1p c3NlZCBzb21ldGhpbmcgaW4gdGhlIFdpa2kgb3IgYmxvZ3M/PC9wcmU+CiAgICA8L2Jsb2NrcXVv dGU+CiAgICBJdCdzIG5vdCB3ZWxsIGRvY3VtZW50ZWQgPS88YnI+CiAgICA8YnI+CiAgICBESVNB IGNyZWF0ZXMgdGhlaXIgb3duIGlkZW50aWZpY2F0aW9uIHNjaGVtZSBvdXRzaWRlIG9mIGluZHVz dHJ5CiAgICBDQ0VzLiBUaGVzZSBhcmUgdGhlIFJIRUwtMDYtKiBpZGVudGlmaWVycyB5b3UgbWVu dGlvbi4gVGhleSBjb21lCiAgICBmcm9tIHRoZSBSSEVMLzYvaW5wdXQvYXV4aWxpYXJ5L3N0aWdf b3ZlcmxheS54bWwgZmlsZS4gPGJyPgogICAgPGJyPgogICAgRm9yIGV4YW1wbGU6PGJyPgo8YSBj bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vT3Bl blNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9ibG9iL21hc3Rlci9SSEVMLzYvaW5wdXQvYXV4aWxp YXJ5L3N0aWdfb3ZlcmxheS54bWwjTDExLUwxNCI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQ L3NjYXAtc2VjdXJpdHktZ3VpZGUvYmxvYi9tYXN0ZXIvUkhFTC82L2lucHV0L2F1eGlsaWFyeS9z dGlnX292ZXJsYXkueG1sI0wxMS1MMTQ8L2E+PGJyPgogICAgPG1ldGEgY2hhcnNldD0idXRmLTgi PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgIDxtZXRhIGNoYXJzZXQ9InV0Zi04 Ij4KICAgICAgPG1ldGEgY2hhcnNldD0idXRmLTgiPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+wqDCoMKgwqDCoMKgwqAgJmx0O292ZXJsYXkgb3duZXI9ImRp c2FzdGlnIgogICAgICBydWxlaWQ9InBhcnRpdGlvbl9mb3JfdmFyX2xvZ19hdWRpdCIgb3duZXJp ZD0iUkhFTC0wNi0wMDAwMDQiCiAgICAgIGRpc2E9IjEzNyIgc2V2ZXJpdHk9ImxvdyImZ3Q7PGJy PgogICAgICDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJmx0O1ZNU2luZm8gVktleT0i Mzg0NjciIFNWS2V5PSI1MDI2NyIKICAgICAgVlJlbGVhc2U9IjEiIC8mZ3Q7PGJyPgogICAgICDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgJmx0O3RpdGxlJmd0O1RoZSBzeXN0ZW0gbXVz dCB1c2UgYSBzZXBhcmF0ZSBmaWxlCiAgICAgIHN5c3RlbSBmb3IgdGhlIHN5c3RlbSBhdWRpdCBk YXRhIHBhdGguJmx0Oy90aXRsZSZndDs8YnI+CiAgICAgIMKgwqDCoMKgwqDCoMKgICZsdDsvb3Zl cmxheSZndDs8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICBUaGlzIHdpbGwgdGFrZSB0aGUgcGFy dGl0aW9uX2Zvcl92YXJfbG9nX2F1ZGl0IHJ1bGUgYW5kIGVtYmVkCiAgICBSSEVMLTA2LTAwMDAw NCBpbnRvIGl0cyBtZXRhZGF0YS4gPGJyPgogICAgPGJyPgogICAgQXMgRElTQSBnZXRzIGNsb3Nl ciB0byByZWxlYXNpbmcgdGhlIFJIRUw3IFNUSUcsIHdlJ2xsIHVwZGF0ZSB0aGVzZQogICAgbWFw cGluZ3MgZm9yIFJIRUw3IGNvbnRlbnQgKGFzIGJ5IHRoYXQgdGltZSwgRElTQSB3aWxsIGhhdmUK ICAgIGZpbmFsaXplZCB0aGVpciBSSEVMLTA3LSogbnVtYmVyaW5nIHNjaGVtZXMpLiA8YnI+CiAg ICA8YnI+CiAgICA8YnI+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MjAxNjAzMDEw MDAyNDguMjY2MjYuNjY0NjFAbWFpbG1hbjAxLnBoeDIuZmVkb3JhcHJvamVjdC5vcmciCiAgICAg IHR5cGU9ImNpdGUiPgogICAgICA8cHJlIHdyYXA9IiI+RElTQSBSSEVMLTcgRHJhZnQgU1RJRyBy ZWZlcmVuY2VzIHRvICJTUkctT1MtMDAwMDAxLUdQT1MtMDAwMDEiIGFyZSBuZXcgdG8gbWUuLi5J cyB0aGlzIGEgbmV3IGZvcm0gb2YgdW5pZmllZCByZWZlcmVuY2VzPyAgU29tZWhvdyBjcm9zcy1y ZWZlcmVuY2VkIHRvICJDQ0kiPyBJIG5lZWQgc29tZSBndWlkYW5jZSBoZXJlLCBvciBpcyBpdCBz dGlsbCBiZWluZyBzb3J0ZWQgb3V0PwoKSSByZWFsbHkgZG9uJ3Qga25vdyBob3cgdG8gcGhyYXNl IHRoaXMgcXVlc3Rpb24gaW50ZWxsaWdlbnRseS4uLi5jYW4gc29tZW9uZSBoZWxwIG1lIG91dD88 L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICAgIFlvdSdyZSBub3QgY3JhenkuIFRoZSBTUkcgc3lz dGVtIGlzIGJyb2tlbiBhbmQgZ29pbmcgYXdheS4gVW50aWwgU1JHCiAgICBkaWVzLCB0aGUgc3lz dGVtIGdvZXMgc29tZXRoaW5nIGxpa2UgdGhpczo8YnI+CiAgICA8YnI+CiAgICBTdGVwIDE6IERJ U0EgYXR0ZW1wdHMgdG8gaW50ZXJwcmV0IE5JU1QgODAwLTUzIGFuZCBzZWxlY3RzIGNvbnRyb2xz CiAgICB0aGV5IGZlZWwgYXJlIHJlbGV2YW50IGZvciBhbiBvcGVyYXRpbmcgc3lzdGVtLiBGcm9t IHRoaXMsIHRoZXkKICAgIGNyZWF0ZSBoaWdoIGxldmVsIHJlcXVpcmVtZW50cyBpbiB0aGUgZm9y bSBvZiAiR2VuZXJhbCBQdXJwb3NlCiAgICBPcGVyYXRpbmcgU3lzdGVtIFNlY3VyaXR5IFJlcXVp cmVtZW50cyBHdWlkZSwiIG9yIEdQT1MgU1JHLiBUaGlzIGlzCiAgICB3aGVyZSB0aGUgU1JHLU9T LSMjIyMjIy1HUE9TLSMjIyMjIG51bWJlcnMgY29tZSBmcm9tLiBUaGUgR1BPUyBTUkcKICAgIGlz IGdlbmVyaWMsIGFwcGxpY2FibGUgdG8gUkhFTCwgV2luZG93cywgT1NYLCBldGMuIEFuIGV4YW1w bGUgY291bGQKICAgIGJlICJBdWRpdCBQcml2aWxlZ2VkIFVzZXIgQWN0aW9ucy4iIE91dHNpZGUg b2YgRElTQSwgdGhlc2UgbnVtYmVycwogICAgYXJlIGVudGlyZWx5IG1lYW5pbmdsZXNzLjxicj4K ICAgIDxicj4KICAgIFN0ZXAgMjogT25jZSBESVNBIGhhcyB0aGUgaGlnaC1sZXZlbCByZXF1aXJl bWVudHMsIHRoZXkgY3JlYXRlCiAgICBwcm9kdWN0LXNwZWNpZmljIGNvbmZpZ3VyYXRpb24gZ3Vp ZGFuY2UuIFRoaXMgaXMgd2hlcmUKICAgIFJIRUwtMDctIyMjIyMjIG51bWJlcnMgY29tZSBmcm9t LiAiQXVkaXQgUHJpdmlsZWdlZCBVc2VyIEFjdGlvbnMiCiAgICBtaWdodCBtZWFuIGFkZGluZyAx MCsgYXVkaXQgcnVsZXMgZm9yIExpbnV4LCBzbyB3ZSdkIGhhdmUKICAgIFJIRUwtMDctMDAwMDAw IHRocm91Z2ggUkhFTC0wNy0wMDAwMTAgbWFwcGVkIGJhY2sgdG8gYSBzaW5nbGUKICAgIFNSRy1P Uy1HUFMgaWRlbnRpZmllci4gV2hlbiBSSEVMIGRlcGxveW1lbnRzIGF0dGVzdCB0byBTVElHCiAg ICBjb21wbGlhbmNlLCB0aGV5IG11c3Qgc2hvdyBjb25mb3JtYW5jZSB0byBSSEVMLTA3LSMjIyMj IyBjb250cm9scy48YnI+CiAgICA8YnI+CiAgICBTdGVwIDM6IE9uY2UgdGhlIFJIRUwtMDctIyMj IyMjIGNvbnRyb2xzIGFuZCBuYW1pbmcgc2NoZW1hIGlzCiAgICBmaW5hbGl6ZWQsIHdlIG1hcCB0 aGVtIGludG8gdGhlIHN0aWdfb3ZlcmxheSBmaWxlLiBUaGlzIHdpbGwgYmluZAogICAgdGhlIERJ U0EgaWRlbnRpZmllcnMgaW50byBPcGVuU0NBUCBYQ0NERiBjb250ZW50LiBFbmQgcmVzdWx0IGJl aW5nCiAgICBESVNBIGlkZW50aWZpZXJzIHNob3cgdXAgaW4gT3BlblNDQVAgSFRNTCBhbmQgQ0xJ IHJlcG9ydHMsIGxvb2tpbmcKICAgIHNvbWV0aGluZyBsaWtlIHRoaXM6PGJyPgogICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+VGl0bGXCoMKgIFNldCBQYXNzd29yZCBTdHJlbmd0aCBNaW5pbXVt CiAgICAgIFNwZWNpYWwgQ2hhcmFjdGVyczxicj4KICAgICAgUnVsZcKgwqDCoCBhY2NvdW50c19w YXNzd29yZF9wYW1fb2NyZWRpdDxicj4KICAgICAgSWRlbnTCoMKgIENDRS0yNjQwOS0zPGJyPgog ICAgICBJZGVudMKgwqAgRElTQSBGU08gUkhFTC0wNi0wMDAwNTg8YnI+CiAgICAgIFJlc3VsdMKg IHBhc3M8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBEb2VzIHRoaXMgaGVscD8K ICA8L2JvZHk+CjwvaHRtbD4K --===============0325655650123565033==--