Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/auxiliary/alt-titles-stig.xml | 6 +++ RHEL6/input/profiles/common.xml | 8 ++-- RHEL6/input/system/auditing.xml | 4 +- RHEL6/input/system/logging.xml | 62 +++++++++++++++------------- RHEL6/input/system/permissions/files.xml | 22 ++++++++++ 5 files changed, 67 insertions(+), 35 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index 3b9724d..dec21ab 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -50,6 +50,12 @@ The system must have USB Mass Storage disabled unless needed. <title rule="service_autofs_disabled" shorttitle="Disable the Automounter"> Automated file system mounting tools must not be enabled unless needed. </title> +<title rule="log_files_location" shorttitle="Verify Location of Log Files"> +Log files must be located in /var/log. +</title> +<title rule="perms_log_files" shorttitle="Verify Permissions on Log Files"> +Log files must have mode 0600. +</title> <title rule="userowner_shadow_file" shorttitle="Verify User Who Owns shadow File"> The /etc/shadow file must be owned by root. </title> diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index d80e69a..5be7ddf 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -24,6 +24,10 @@ <select idref="no_hashes_outside_shadow" selected="true"/> <select idref="no_uidzero_except_root" selected="true"/>
+ +<select idref="log_files_location" selected="true"/> +<select idref="perms_log_files" selected="true"/> + <select idref="userowner_shadow_file" selected="true"/> <select idref="groupowner_shadow_file" selected="true"/> <select idref="perms_shadow_file" selected="true"/> @@ -45,7 +49,6 @@ <select idref="file_permissions_binary_dirs" selected="true"/> <select idref="file_ownership_binary_dirs" selected="true"/>
-<select idref="audit_logs_permissions" selected="true"/>
<select idref="password_min_len" selected="true"/> <select idref="password_min_age" selected="true"/> @@ -101,9 +104,6 @@ <select idref="package_rsyslog_installed" selected="true"/> <select idref="service_rsyslog_enabled" selected="true"/>
-<select idref="userowner_rsyslog_files" selected="true"/> -<select idref="groupowner_rsyslog_files" selected="true"/> -<select idref="rsyslog_file_permissions" selected="true"/> <select idref="rsyslog_send_messages_to_logserver" selected="true"/> <select idref="ensure_logrotate_activated" selected="true"/> <select idref="enable_auditd_service" selected="true"/> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index b4e54b8..f8008b0 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -681,7 +681,7 @@ audited.</rationale> <ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" /> </Rule>
-<Rule id="audit_logs_permissions"> +<!-- <Rule id="audit_logs_permissions"> <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title> <description> Change the mode of the audit log files with the following command: @@ -715,7 +715,7 @@ owner, and unauthorized users, potential access to sensitive information.</ratio <oval id="file_ownership_var_log_audit" /> <ref nist="AC-6,AU-1(b),AU-9" disa="166" /> <tested by="DS" on="20121024"/> -</Rule> +</Rule> -->
<Rule id="audit_mac_changes"> <title>Record Events that Modify the System's Mandatory Access Controls</title> diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml index 9ff9334..ffa9cbb 100644 --- a/RHEL6/input/system/logging.xml +++ b/RHEL6/input/system/logging.xml @@ -115,7 +115,7 @@ will not create it and important log messages can be lost. <ref nist="" /> </Rule>
-<Rule id="userowner_rsyslog_files" severity="medium"> +<!-- <Rule id="userowner_rsyslog_files" severity="medium"> <title>Ensure Log Files Are Owned By Appropriate User</title> <description>The owner of all log files written by <tt>rsyslog</tt> should be root. @@ -165,38 +165,28 @@ protected from unauthorized access.</rationale> <oval id="rsyslog_files_groupownership" /> <ref nist="AC-6" disa="1314"/> <tested by="DS" on="20121024"/> -</Rule> - +</Rule> -->
-<Rule id="rsyslog_file_permissions" severity="medium"> -<title>Ensure System Log Files Have Correct Permissions</title> -<description>The file permissions for all log files written by -rsyslog should be set to 600, or more restrictive. -These log files are determined by the second part of each Rule line in -<tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>. -For each log file <i>LOGFILE</i> referenced in <tt>/etc/rsyslog.conf</tt>, -run the following command to inspect the file's permissions: -<pre>$ ls -l <i>LOGFILE</i></pre> -If the permissions are not 600 or more restrictive, -run the following command to correct this: -<pre># chmod 0600 <i>LOGFILE</i></pre> +<Rule id="log_files_location"> +<title>Verify Location of Log Files</title> +<description> +To configure the storage location of log files, add or correct the storage location +for each log type listed in the second column under <tt>RULES</tt> in <tt>/etc/rsyslog.conf</tt>. </description> -<ocil clause="the permissions are not correct"> -To see the permissions of a given log file, run the following command: -<pre>$ ls -l <i>LOGFILE</i></pre> -The permissions should be 600, or more restrictive. +<ocil clause="all logs are not stored in /var/log/"> +To ensure all system log files are stored in /var/log/, examine the rules in the file +<tt>/etc/rsyslog.conf</tt>. All log locations are listed in the second column, under the +<tt>RULES</tt> section, and should begin with <tt>/var/log/</tt>. </ocil> -<rationale>Log files can contain valuable information regarding system -configuration. If the system log files are not protected unauthorized -users could change the logged data, eliminating their forensic value. +<rationale>The log files generated by rsyslog contain valuable information regarding system +configuration, user authentication, and other such information. Log files should be +protected from unauthorized access. </rationale> -<ident cce="27190-8" /> -<oval id="rsyslog_files_permissions" /> -<ref nist="" disa="1314"/> -<tested by="DS" on="20121024"/> +<ident cce="26821-9" /> +<ref nist="AU-9" disa="1314"/> </Rule> -</Group>
+</Group> <Group id="rsyslog_sending_messages"> <title>Rsyslog Logs Sent To Remote Host</title> <description> @@ -231,8 +221,8 @@ Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting <tt><i>loghost.example.com</i></tt> appropriately. -The choice of protocol depends on the environment of the system; -although TCP and RELP provide more reliable message delivery, +The choice of protocol depends on the environment of the system; +although TCP and RELP provide more reliable message delivery, they may not be supported in all environments. <br/> To use UDP for log message delivery: @@ -264,6 +254,7 @@ place to view the status of multiple hosts within the enterprise. <oval id="rsyslog_remote_loghost" /> <ref nist="AU-3(2),AU-9" disa="1348, 136" /> </Rule> + </Group>
<Group id="rsyslog_accepting_remote_messages"> @@ -431,6 +422,19 @@ the logserver.</description> -->
</Group> <!-- <Group id="configure_logwatch_on_logserver"> -->
+ + +<!-- Ensure that <tt>logwatch.pl</tt> is run nightly from <tt>cron</tt>. (This is the default): +<pre># cd /etc/cron.daily +# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch +</pre> +free disk space. Since all log monitoring is being done on the central logserver, the disk space listing will always be +that of the logserver, regardless of which host is being monitored. This is confusing, so disable that service. Note +that this does mean that <tt>Logwatch</tt> will not monitor disk usage information. Many workarounds are possible, +such as running <tt>df</tt> on each host daily via <tt>cron</tt> and sending the output to <tt>syslog</tt> so that it will be reported to +the logserver.</description> --> + + <Rule id="disable_logwatch_for_logserver"> <title> Disable Logwatch on Clients if a Logserver Exists</title> <description> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index e1db8c6..84b20d1 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -17,6 +17,28 @@ need read access to the <tt>passwd</tt> file in order to function properly, but read access to the <tt>shadow</tt> file allows malicious attacks against system passwords, and should never be enabled.</description>
+<Rule id="perms_log_files" severity="medium"> +<title>Verify Permissions on Log Files</title> +<description>The file permissions for all log files written by +rsyslog and auditd should be set to 0600. +For any log files with permissions other than 0600, run the following command: +<pre># chmod 0600 <i>LOGFILE</i></pre> +</description> +<ocil clause="there are any files listed in the output"> +To ensure there are no log files with incorrect permissions in /var/log/, +run the following command: +<pre># find /var/log/ ! -perm 0600 -type f</pre> +</ocil> +<rationale>Log files can contain valuable information regarding system +configuration. If the system log files are not protected unauthorized +users could change the logged data, eliminating their forensic value. +</rationale> +<ident cce="27190-8" /> +<oval id="rsyslog_files_permissions" /> +<ref nist="" disa="1314"/> +<tested by="DS" on="20121024"/> +</Rule> + <Rule id="userowner_shadow_file" severity="medium"> <title>Verify User Who Owns <tt>shadow</tt> File</title> <description><fileowner-desc-macro file="/etc/shadow" owner="root"/></description>