From shawn at redhat.com Thu Aug 20 11:35:34 2015 Content-Type: multipart/mixed; boundary="===============8564485960527224350==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's rules to Fedora Date: Sun, 13 Oct 2013 23:59:12 -0400 Message-ID: <525B6C10.9010203@redhat.com> In-Reply-To: 230522848.4647875.1381503286103.JavaMail.root@redhat.com --===============8564485960527224350== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/11/13 10:54 AM, Jan Lieskovsky wrote: > This proposal converts rules from RHEL6's 'Restrict Root Logins' > section so they could be used on Fedora too. Depends on previous > typo fix (caab207a8c8a587914d9a1b318d972bbd678896c). > > Common Fedora rpm Makefile rules and Fedora SSG Makefile content > rules have been tested and confirmed to work properly. > > Please review. > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > 0001-Fedora-Convert-RHEL6-Restrict-Root-Logins-section-s-.patch > > > From 844d8b1e757942da57adedf8f6ad726a4771ae01 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky > Date: Fri, 11 Oct 2013 16:44:31 +0200 > Subject: [PATCH] [Fedora] Convert RHEL6 'Restrict Root Logins' section's > rules to Fedora > > > Signed-off-by: Jan Lieskovsky > --- > .../input/checks/accounts_no_uid_except_zero.xml | 23 +++ > .../checks/no_shelllogin_for_systemaccounts.xml | 22 ++ > .../input/checks/restrict_serial_port_logins.xml | 27 +++ > .../checks/securetty_root_login_console_only.xml | 26 +++ > Fedora/input/guide.xml | 2 +- > Fedora/input/guide.xslt | 1 + > Fedora/input/profiles/common.xml | 35 +++- > .../system/accounts/restrictions/root_logins.xml | 230 ++++++++++++++= +++++++ > Fedora/scap-security-guide.spec | 5 +- > 9 files changed, 359 insertions(+), 12 deletions(-) > create mode 100644 Fedora/input/checks/accounts_no_uid_except_zero.xml > create mode 100644 Fedora/input/checks/no_shelllogin_for_systemaccounts= .xml > create mode 100644 Fedora/input/checks/restrict_serial_port_logins.xml > create mode 100644 Fedora/input/checks/securetty_root_login_console_onl= y.xml > create mode 100644 Fedora/input/system/accounts/restrictions/root_login= s.xml > > diff --git a/Fedora/input/checks/accounts_no_uid_except_zero.xml b/Fedora= /input/checks/accounts_no_uid_except_zero.xml > new file mode 100644 > index 0000000..cc337f4 > --- /dev/null > +++ b/Fedora/input/checks/accounts_no_uid_except_zero.xml > @@ -0,0 +1,23 @@ > + > + > + > + UID 0 Belongs Only To Root > + > + Fedora 19 > + > + Only the root account should be assigned a user id of= 0. > + > + > + > + > + > + > + > + > + > + /etc > + passwd > + ^(?!root:)[^:]*:[^:]:0 > + 1 > + > + > diff --git a/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml b/F= edora/input/checks/no_shelllogin_for_systemaccounts.xml > new file mode 100644 > index 0000000..8f1b6f6 > --- /dev/null > +++ b/Fedora/input/checks/no_shelllogin_for_systemaccounts.xml > @@ -0,0 +1,22 @@ > + > + > + > + System Accounts Do Not Run a Shell > + > + Fedora 19 > + > + The root account is the only system account that shou= ld have a login shell. > + > + > + > + > + > + > + > + > + > + /etc/passwd > + ^(?!root).*:x:[\d]*:0*([0-9= ]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/sh= utdown|\/sbin\/halt).*$ > + 1 > + > + > diff --git a/Fedora/input/checks/restrict_serial_port_logins.xml b/Fedora= /input/checks/restrict_serial_port_logins.xml > new file mode 100644 > index 0000000..a1f456e > --- /dev/null > +++ b/Fedora/input/checks/restrict_serial_port_logins.xml > @@ -0,0 +1,27 @@ > + > + > + > + Restrict Serial Port Root Logins > + > + Fedora 19 > + > + Preventing direct root login to serial port interface= s helps > + ensure accountability for actions taken on the system using the ro= ot > + account. > + > + > + > + > + > + > + > + > + > + > + > + /etc > + securetty > + ^ttyS[0-9]+$ > + 1= > + > + > diff --git a/Fedora/input/checks/securetty_root_login_console_only.xml b/= Fedora/input/checks/securetty_root_login_console_only.xml > new file mode 100644 > index 0000000..51a33de > --- /dev/null > +++ b/Fedora/input/checks/securetty_root_login_console_only.xml > @@ -0,0 +1,26 @@ > + > + > + > + Restrict Virtual Console Root Logins > + > + Fedora 19 > + > + Preventing direct root login to virtual console devic= es > + helps ensure accountability for actions taken on the system using = the > + root account. > + > + > + > + > + > + > + > + > + > + > + > + /etc/securetty > + ^vc/[0-9]+$ > + 1= > + > + > diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml > index 6e276b1..8d21fe8 100644 > --- a/Fedora/input/guide.xml > +++ b/Fedora/input/guide.xml > @@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United= States and other > countries. All other names are registered trademarks or trademarks of t= heir > respective companies. > > -0.0.2 > +0.0.3 > > diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt > index 559042e..d99da5a 100644 > --- a/Fedora/input/guide.xslt > +++ b/Fedora/input/guide.xslt > @@ -45,6 +45,7 @@ > > > > + > > > > diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/com= mon.xml > index 83e3478..8997e79 100644 > --- a/Fedora/input/profiles/common.xml > +++ b/Fedora/input/profiles/common.xml > @@ -2,15 +2,30 @@ > Common Profile for General-Purpose Fedora Systems > This profile contains items common to general-purpose Fedo= ra installations. > = > - > - > - > - > - > + > + > + > + > + > + > + > + > + > + > + > + > + > + > +