From e8613dc54495f28b8460c3075b9931e2d515dc0a Mon Sep 17 00:00:00 2001
From: lukek1 <luke.t.kordell@lmco.com>
Date: Fri, 4 Apr 2014 15:55:41 -0400
Subject: [PATCH] CSCF-RHEL6-MLS initial core profile

---
 RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml |  271 ++++++++++++++++++++++++++++++
 1 file changed, 271 insertions(+)
 create mode 100644 RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml

diff --git a/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
new file mode 100644
index 0000000..5267102
--- /dev/null
+++ b/RHEL/6/input/profiles/CSCF-RHEL6-MLS.xml
@@ -0,0 +1,271 @@
+<Profile id="CSCF-RHEL6-MLS"> 
+<title>CSCF RHEL6 MLS Core Baseline</title> 
+<description> This profile reflects the Centralized Super Computing Facility (CSCF) baseline for Red Hat Enterprise Linux 6. This baseline has received government ATO through the ICD 503 process, utilizing the CNSSI 1253 cross domain overlay. This profile should be considered in active development. Additional tailoring will be needed, such as the creation of RBAC roles for production deployment </description>
+
+<select idref="account_disable_post_pw_expiration" selected="true" />
+<select idref="account_temp_expire_date" selected="true" />
+<select idref="aide_build_database" selected="true" />
+<select idref="aide_periodic_cron_checking" selected="true" />
+<select idref="audit_account_changes" selected="true" />
+<select idref="audit_config_immutable" selected="true" />
+<select idref="audit_file_access" selected="true" />
+<select idref="audit_file_deletions" selected="true" />
+<select idref="audit_kernel_module_loading" selected="true" />
+<select idref="file_permissions_var_log_audit" selected="true" />
+<select idref="audit_logs_rootowner" selected="true" />
+<select idref="audit_mac_changes" selected="true" />
+<select idref="audit_manual_logon_edits" selected="true" />
+<select idref="audit_manual_session_edits" selected="true" />
+<select idref="audit_media_exports" selected="true" />
+<select idref="audit_network_modifications" selected="true" />
+<select idref="audit_privileged_commands" selected="true" />
+<select idref="audit_rules_dac_modification_chmod" selected="true" />
+<select idref="audit_rules_dac_modification_chown" selected="true" />
+<select idref="audit_rules_dac_modification_fchmod" selected="true" />
+<select idref="audit_rules_dac_modification_fchmodat" selected="true" />
+<select idref="audit_rules_dac_modification_fchown" selected="true" />
+<select idref="audit_rules_dac_modification_fchownat" selected="true" />
+<select idref="audit_rules_dac_modification_fremovexattr" selected="true" />
+<select idref="audit_rules_dac_modification_fsetxattr" selected="true" />
+<select idref="audit_rules_dac_modification_lremovexattr" selected="true" />
+<select idref="audit_rules_dac_modification_lchown" selected="true" />
+<select idref="audit_rules_dac_modification_lsetxattr" selected="true" />
+<select idref="audit_rules_dac_modification_removexattr" selected="true" />
+<select idref="audit_rules_dac_modification_setxattr" selected="true" />
+<select idref="audit_rules_time_adjtimex" selected="true" />
+<select idref="audit_rules_time_clock_settime" selected="true" />
+<select idref="audit_rules_time_settimeofday" selected="true" />
+<select idref="audit_rules_time_stime" selected="true" />
+<select idref="audit_rules_time_watch_localtime" selected="true" />
+<select idref="audit_sysadmin_actions" selected="true" />
+<select idref="bios_disable_usb_boot" selected="true" />
+<select idref="bootloader_nousb_argument" selected="true" />
+<select idref="bootloader_password" selected="true" />
+<select idref="auditd_data_retention_action_mail_acct" selected="true" />
+<select idref="auditd_data_retention_admin_space_left_action" selected="true" />
+<select idref="configure_auditd_audispd" selected="true" />
+<select idref="configure_auditd_max_log_file" selected="true" />
+<select idref="configure_auditd_max_log_file_action" selected="true" />
+<refine-value idref="var_auditd_max_log_file_action"  selector="keep_logs" />
+<select idref="configure_auditd_num_logs" selected="true" />
+<select idref="auditd_data_retention_space_left_action" selected="true" />
+<select idref="cups_disable_browsing" selected="true" />
+<select idref="cups_disable_printserver" selected="true" />
+<select idref="deactivate_wireless_interfaces" selected="true" />
+<select idref="deny_password_attempts_unlock_time" selected="true" />
+<select idref="accounts_passwords_pam_faillock_deny" selected="true" />
+<select idref="accounts_passwords_pam_fail_interval" selected="true" />
+<select idref="dhcp_server_deny_bootp" selected="true" />
+<select idref="dhcp_server_deny_decline" selected="true" />
+<select idref="dhcp_server_disable_ddns" selected="true" />
+<select idref="disable_anacron" selected="true" />
+<select idref="disable_avahi" selected="true" />
+<select idref="disable_dhcp_client" selected="true" />
+<select idref="disable_dhcp_server" selected="true" />
+<select idref="disable_dns_server" selected="true" />
+<select idref="disable_gnome_thumbnailers" selected="true" />
+<select idref="disable_httpd" selected="true" /> 
+<select idref="kernel_module_ipv6_option_disabled" selected="true" />
+<select idref="kernel_module_cramfs_disabled" selected="true" />
+<select idref="kernel_module_freevxfs_disabled" selected="true" />
+<select idref="kernel_module_hfs_disabled" selected="true" />
+<select idref="kernel_module_hfsplus_disabled" selected="true" />
+<select idref="kernel_module_jffs2_disabled" selected="true" />
+<select idref="kernel_module_squashfs_disabled" selected="true" />
+<select idref="kernel_module_udf_disabled" selected="true" />
+<select idref="disable_prelink" selected="true" />
+<select idref="kernel_module_dccp_disabled" selected="true" />
+<select idref="kernel_module_rds_disabled" selected="true" />
+<select idref="kernel_module_sctp_disabled" selected="true" />
+<select idref="kernel_module_tipc_disabled" selected="true" />
+<select idref="disable_rexec" selected="true" />
+<select idref="disable_rlogin" selected="true" />
+<select idref="disable_rsh" selected="true" />
+<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true" />
+<select idref="sysctl_ipv4_all_send_redirects" selected="true" />
+<select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true" />
+<select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true" />
+<select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true" />
+<select idref="sysctl_ipv4_ip_forward" selected="true" />
+<select idref="disable_telnet_service" selected="true" />
+<select idref="disable_tftp" selected="true" />
+<select idref="disable_vsftpd" selected="true" />
+<select idref="disable_ypbind" selected="true" />
+<select idref="dns_server_authenticate_zone_transfers" selected="true" />
+<select idref="enable_auditd_bootloader" selected="true" />
+<select idref="enable_gdm_login_banner" selected="true" />
+<select idref="enable_screensaver_after_idle" selected="true" />
+<select idref="enable_screensaver_password_lock" selected="true" />
+<select idref="enable_selinux_bootloader" selected="true" />
+<select idref="ensure_logrotate_activated" selected="true" />
+<select idref="file_ownership_binary_dirs" selected="true" />
+<select idref="file_ownership_library_dirs" selected="true" />
+<select idref="file_permissions_binary_dirs" selected="true" />
+<select idref="file_permissions_etc_passwd" selected="true" />
+<select idref="file_permissions_library_dirs" selected="true" />
+<select idref="gconf_gnome_disable_automount" selected="true" />
+<select idref="file_groupowner_etc_group" selected="true" />
+<select idref="file_groupowner_etc_gshadow" selected="true" />
+<select idref="file_groupowner_etc_passwd" selected="true" />
+<select idref="groupowner_rsyslog_files" selected="true" />
+<select idref="groupowner_shadow_file" selected="true" />
+<select idref="httpd_conf_files_permissions" selected="true" />
+<select idref="httpd_logs_permissions" selected="true" />
+<select idref="httpd_servertokens_prod" selected="true" />
+<select idref="kernel_module_bluetooth_disabled" selected="true" />
+<select idref="kernel_module_usb-storage_disabled" selected="true" />
+<select idref="ldap_client_start_tls" selected="true" />
+<select idref="ldap_client_tls_cacertpath" selected="true" />
+<select idref="accounts_password_reuse_limit" selected="true" />
+<select idref="mount_option_dev_shm_nodev" selected="true" />
+<select idref="mount_option_dev_shm_noexec" selected="true" />
+<select idref="mount_option_dev_shm_nosuid" selected="true" />
+<select idref="mount_option_tmp_nodev" selected="true" />
+<select idref="mount_option_tmp_noexec" selected="true" />
+<select idref="mount_option_tmp_nosuid" selected="true" />
+<select idref="mount_option_var_tmp_bind_var" selected="true" />
+<select idref="mountopt_nodev_on_nonroot_partitions" selected="true" />
+<!-- we do not have any removable media that has a mount point defined in fstab <select idref="mountopt_nodev_on_removable_partitions" selected="true" /> --> 
+<select idref="mountopt_noexec_on_removable_partitions" selected="true" />
+<select idref="mountopt_nosuid_on_removable_partitions" selected="true" />
+<select idref="accounts_max_concurrent_login_sessions" selected="true" /> 
+<refine-value idref="var_accounts_max_concurrent_login_sessions" selector="3" />
+<select idref="network_disable_zeroconf" selected="true" />
+<select idref="network_ipv6_disable_rpc" selected="true" />
+<select idref="network_sniffer_disabled" selected="true" />
+<select idref="no_empty_passwords" selected="true" />
+<select idref="no_files_unowned_by_group" selected="true" />
+ <select idref="no_files_unowned_by_user" selected="true" /> 
+<select idref="accounts_password_all_shadowed" selected="true" />
+<select idref="no_netrc_files" selected="true" />
+<select idref="accounts_no_uid_except_zero" selected="true" />
+<select idref="no_direct_root_logins" selected="true" />
+<select idref="no_unpackaged_sgid_files" selected="true" />
+<select idref="no_unpackaged_suid_files" selected="true" /> 
+<select idref="ntpd_specify_multiple_servers" selected="true" />
+<select idref="ntpd_specify_remote_server" selected="true" />
+<select idref="package_aide_installed" selected="true" />
+<select idref="package_openldap-servers_removed" selected="true" />
+<select idref="package_rsyslog_installed" selected="true" />
+<select idref="package_sendmail_removed" selected="true" />
+<select idref="partition_for_var_log" selected="true" />
+<select idref="partition_for_var_log_audit" selected="true" />
+<select idref="accounts_maximum_age_login_defs" selected="true" />
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="180" />
+<select idref="accounts_password_minlen_login_defs" selected="true" />
+<refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
+<select idref="password_require_consecrepeat" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
+<select idref="accounts_password_pam_cracklib_dcredit" selected="true" />
+<select idref="accounts_password_pam_cracklib_lcredit" selected="true" />
+<select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
+<select idref="accounts_password_pam_cracklib_ucredit" selected="true" />
+<select idref="accounts_password_pam_cracklib_retry" selected="true" />
+<select idref="accounts_password_warn_age_login_defs" selected="true"  />
+<select idref="file_permissions_etc_group" selected="true" />
+<select idref="file_permissions_etc_shadow" selected="true" />
+<select idref="file_permissions_etc_gshadow" selected="true" />
+<select idref="postfix_network_listening" selected="true" />
+<select idref="securetty_root_login_console_only" selected="true" />
+<select idref="restrict_serial_port_logins" selected="true" />
+<select idref="rpm_verify_hashes" selected="true" />
+<select idref="rpm_verify_permissions" selected="true" />
+<select idref="rsyslog_accept_remote_messages_none" selected="true" />
+<select idref="rsyslog_accept_remote_messages_tcp" selected="true" />
+<select idref="rsyslog_accept_remote_messages_udp" selected="true" />  
+<select idref="rsyslog_send_messages_to_logserver" selected="true" />
+<select idref="selinux_confinement_of_daemons" selected="true" />
+<select idref="selinux_all_devicefiles_labeled" selected="true" />
+<select idref="service_abrtd_disabled" selected="true" />
+<select idref="service_acpid_disabled" selected="true" />
+<select idref="service_atd_disabled" selected="true" />
+<select idref="service_auditd_enabled" selected="true" />
+<select idref="service_autofs_disabled" selected="true" />
+<select idref="service_bluetooth_disabled" selected="true" />
+<select idref="service_certmonger_disabled" selected="true" />
+<select idref="service_cgconfig_disabled" selected="true" />
+<select idref="service_cpuspeed_disabled" selected="true" />
+<select idref="service_crond_enabled" selected="true" />
+<select idref="service_cups_disabled" selected="true" />
+<select idref="service_haldaemon_disabled" selected="true" />
+<!-- not necessary if ipv6 is disabled <select idref="service_ip6tables_enabled" selected="true" /> -->
+<select idref="service_iptables_enabled" selected="true" />
+<select idref="service_irqbalance_enabled" selected="true" />
+<select idref="service_kdump_disabled" selected="true" />
+<select idref="service_mdmonitor_disabled" selected="true" />
+<select idref="service_messagebus_disabled" selected="true" />
+<select idref="service_netconsole_disabled" selected="true" />
+<select idref="service_ntpd_enabled" selected="true" />
+<select idref="service_ntpdate_disabled" selected="true" />
+<select idref="service_oddjobd_disabled" selected="true" />
+<select idref="service_portreserve_disabled" selected="true" />
+<select idref="service_psacct_enabled" selected="true" />
+<select idref="service_qpidd_disabled" selected="true" />
+<select idref="service_quota_nld_disabled" selected="true" />
+<select idref="service_rdisc_disabled" selected="true" />
+<select idref="service_rhnsd_disabled" selected="true" />
+<select idref="service_rhsmcertd_disabled" selected="true" />
+<select idref="service_rsyslog_enabled" selected="true" />
+<select idref="service_saslauthd_disabled" selected="true" />
+<select idref="service_smartd_disabled" selected="true" />
+<select idref="service_sysstat_disabled" selected="true" />
+<select idref="set_blank_screensaver" selected="true" />
+<select idref="umask_for_daemons" selected="true" />
+<!-- will need to be refined -->
+<select idref="set_gdm_login_banner_text" selected="true" />
+<!-- not necessary if ipv6 is disabled<select idref="set_ip6tables_default_rule" selected="true" /> -->
+<select idref="set_iptables_default_rule" selected="true" />
+<select idref="set_iptables_default_rule_forward" selected="true" />
+<select idref="set_password_hashing_algorithm_systemauth" selected="true" />
+<select idref="set_password_hashing_algorithm_logindefs" selected="true" />
+<select idref="set_password_hashing_algorithm_libuserconf" selected="true" />
+<select idref="set_screensaver_inactivity_timeout" selected="true" />
+<select idref="selinux_policytype" selected="true" />
+<refine-value idref="var_selinux_policy_name" selector="mls" />
+<select idref="selinux_state" selected="true" />
+<select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true" />
+<select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true" />
+<select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true" />
+<select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true" />
+<select idref="sysctl_net_ipv4_conf_default_secure_redirects" selected="true" />
+<select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true" />
+<select idref="sysctl_net_ipv4_tcp_syncookies" selected="true" />
+<select idref="disable_users_coredumps" selected="true" />
+<select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true" />
+<select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true" />
+<!-- not necessary if ipv6 is disabled <select idref="set_sysctl_net_ipv6_conf_default_accept_ra" selected="true" /> --> 
+<select idref="set_system_login_banner" selected="true" />
+<select idref="sshd_allow_only_protocol2" selected="true" />
+<select idref="sshd_disable_root_login" selected="true" />
+<select idref="sshd_use_approved_ciphers" selected="true" />
+<select idref="sticky_world_writable_dirs" selected="true" />
+<select idref="tftpd_uses_secure_mode" selected="true" />
+<select idref="uninstall_bind" selected="true" />
+<select idref="uninstall_dhcp_server" selected="true" />
+<!-- not necessary for UVs --> 
+<select idref="uninstall_httpd" selected="true" />
+<select idref="uninstall_rsh-server" selected="true" />
+<select idref="uninstall_telnet_server" selected="true" />
+<select idref="uninstall_tftp-server" selected="true" />
+<select idref="uninstall_vsftpd" selected="true" />
+<select idref="uninstall_ypserv" selected="true" />
+<!-- the following may need refinement -->
+<select idref="file_owner_etc_group" selected="true" />
+<select idref="file_owner_etc_gshadow" selected="true" />
+<select idref="file_owner_etc_passwd" selected="true" />
+<select idref="userowner_rsyslog_files" selected="true" />
+<select idref="userowner_shadow_file" selected="true" />
+<select idref="wireless_disable_in_bios" selected="true" />
+<select idref="world_writable_files_system_ownership" selected="true" />
+<select idref="disable_interactive_boot" selected="true" />
+<select idref="install_hids" selected="true" />
+<select idref="install_antivirus" selected="true" />
+<select idref="enable_execshield" selected="true" />
+<select idref="sysctl_kernel_randomize_va_space" selected="true" />
+<select idref="bios_enable_execution_restrictions" selected="true" />
+<select idref="disable_setuid_coredumps" selected="true" />
+<select idref="disable_xwindows_with_runlevel" selected="true" />
+<select idref="world_writeable_files" selected="true" />  
+</Profile>
+
+
-- 
1.7.9.2

