On 10/10/13 10:52 AM, Jan Lieskovsky wrote:
This patch introduces new 'Accounts and Access Control' section
for Fedora content. Also convert four existing RHEL-6 rules from
'Protect Accounts by Restricting Password-Based Login' and include
them into Fedora.

Please review.

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team


From d5049e0baca827e33de5dbd7da28cf037c2eed40 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Thu, 10 Oct 2013 16:40:14 +0200
Subject: [PATCH] [Fedora] Introduce 'Accounts and Access Control Section'.
 Convert four RHEL-6 rules from its 'Verify Proper Storage'
 subsection to Fedora

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
 .../checks/accounts_password_all_shadowed.xml      |  24 +++++
 Fedora/input/checks/no_empty_passwords.xml         |  22 +++++
 Fedora/input/checks/no_netrc_files.xml             |  22 +++++
 Fedora/input/guide.xslt                            |  15 +++
 Fedora/input/profiles/common.xml                   |   4 +
 Fedora/input/system/accounts/accounts.xml          |  11 +++
 .../accounts/restrictions/password_storage.xml     | 107 +++++++++++++++++++++
 .../system/accounts/restrictions/restrictions.xml  |  13 +++
 Fedora/scap-security-guide.spec                    |  11 ++-
 9 files changed, 228 insertions(+), 1 deletion(-)
 create mode 100644 Fedora/input/checks/accounts_password_all_shadowed.xml
 create mode 100644 Fedora/input/checks/no_empty_passwords.xml
 create mode 100644 Fedora/input/checks/no_netrc_files.xml
 create mode 100644 Fedora/input/system/accounts/accounts.xml
 create mode 100644 Fedora/input/system/accounts/restrictions/password_storage.xml
 create mode 100644 Fedora/input/system/accounts/restrictions/restrictions.xml

diff --git a/Fedora/input/checks/accounts_password_all_shadowed.xml b/Fedora/input/checks/accounts_password_all_shadowed.xml
new file mode 100644
index 0000000..42b7482
--- /dev/null
+++ b/Fedora/input/checks/accounts_password_all_shadowed.xml
@@ -0,0 +1,24 @@
+  <definition class="compliance" id="accounts_password_all_shadowed" version="1">
+    <metadata>
+      <title>All Password Hashes Shadowed</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>All password hashes should be shadowed.</description>
+    </metadata>
+    <criteria>
+      <criterion comment="password hashes are shadowed" test_ref="test_accounts_password_all_shadowed" />
+    </criteria>
+  </definition>
+  <unix:password_test check="all" comment="password hashes are shadowed" id="test_accounts_password_all_shadowed" version="1">
+    <unix:object object_ref="object_accounts_password_all_shadowed" />
+    <unix:state state_ref="state_accounts_password_all_shadowed" />
+  </unix:password_test>
+  <unix:password_object id="object_accounts_password_all_shadowed" version="1">
+    <unix:username operation="pattern match">.*</unix:username>
+  </unix:password_object>
+  <unix:password_state id="state_accounts_password_all_shadowed" version="1">
+    <unix:password>x</unix:password>
+  </unix:password_state>
diff --git a/Fedora/input/checks/no_empty_passwords.xml b/Fedora/input/checks/no_empty_passwords.xml
new file mode 100644
index 0000000..054d643
--- /dev/null
+++ b/Fedora/input/checks/no_empty_passwords.xml
@@ -0,0 +1,22 @@
+  <definition class="compliance" id="no_empty_passwords" version="1">
+    <metadata>
+      <title>No nullok Option in /etc/pam.d/system-auth</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
+    </metadata>
+    <criteria>
+      <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="test_no_empty_passwords" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="test_no_empty_passwords" version="1">
+    <ind:object object_ref="object_no_empty_passwords" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_no_empty_passwords" version="1">
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
diff --git a/Fedora/input/checks/no_netrc_files.xml b/Fedora/input/checks/no_netrc_files.xml
new file mode 100644
index 0000000..740a98b
--- /dev/null
+++ b/Fedora/input/checks/no_netrc_files.xml
@@ -0,0 +1,22 @@
+  <definition class="compliance" id="no_netrc_files" version="1">
+    <metadata>
+      <title>Verify No netrc Files Exist</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="test_no_netrc_files_home" negate="true" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="test_no_netrc_files_home" version="1">
+    <unix:object object_ref="object_no_netrc_files_home" />
+  </unix:file_test>
+  <unix:file_object comment="look for .netrc in /home" id="object_no_netrc_files_home" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" />
+    <unix:path operation="equals">/home</unix:path>
+    <unix:filename operation="pattern match">^\.netrc$</unix:filename>
+  </unix:file_object>
diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
index a24bdd9..8bdf86e 100644
--- a/Fedora/input/guide.xslt
+++ b/Fedora/input/guide.xslt
@@ -24,6 +24,7 @@
       <xsl:copy-of select="@*|node()" />
       <xsl:apply-templates select="document('system/software/software.xml')" />
+      <xsl:apply-templates select="document('system/accounts/accounts.xml')" />
@@ -34,6 +35,20 @@
+  <xsl:template match="Group[@id='accounts']">
+    <xsl:copy>
+      <xsl:copy-of select="@*|node()" />
+      <xsl:apply-templates select="document('system/accounts/restrictions/restrictions.xml')" />
+    </xsl:copy>
+  </xsl:template>
+  <xsl:template match="Group[@id='accounts-restrictions']">
+    <xsl:copy>
+      <xsl:copy-of select="@*|node()" />
+      <xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" />
+    </xsl:copy>
+  </xsl:template>
   <!-- copy everything else through to final output -->
   <xsl:template match="@*|node()">
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
index 18c8f3e..2739a33 100644
--- a/Fedora/input/profiles/common.xml
+++ b/Fedora/input/profiles/common.xml
@@ -4,5 +4,9 @@
 <select idref="ensure_gpgcheck_globally_activated" selected="true"/>
 <select idref="ensure_gpgcheck_never_disabled" selected="true"/>
+<select idref="no_empty_passwords" selected="true"/>
+<select idref="no_hashes_outside_shadow" selected="true"/>
+<select idref="gid_passwd_group_same" selected="true"/>
+<select idref="no_netrc_files" selected="true"/>
diff --git a/Fedora/input/system/accounts/accounts.xml b/Fedora/input/system/accounts/accounts.xml
new file mode 100644
index 0000000..044d85d
--- /dev/null
+++ b/Fedora/input/system/accounts/accounts.xml
@@ -0,0 +1,11 @@
+<Group id="accounts">
+<title>Account and Access Control</title>
+<description>In traditional Unix security, if an attacker gains
+shell access to a certain login account, they can perform any action
+or access any file to which that account has access. Therefore,
+making it more difficult for unauthorized people to gain shell
+access to accounts, particularly to privileged accounts, is a
+necessary part of securing a system. This section introduces
+mechanisms for restricting access to accounts under Fedora.
diff --git a/Fedora/input/system/accounts/restrictions/password_storage.xml b/Fedora/input/system/accounts/restrictions/password_storage.xml
new file mode 100644
index 0000000..d1bbcd3
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/password_storage.xml
@@ -0,0 +1,107 @@
+<Group id="password_storage">
+<title>Verify Proper Storage and Existence of Password
+By default, password hashes for local accounts are stored
+in the second field (colon-separated) in
+<tt>/etc/shadow</tt>. This file should be readable only by
+processes running with root credentials, preventing users from
+casually accessing others' password hashes and attempting
+to crack them.
+However, it remains possible to misconfigure the system
+and store password hashes
+in world-readable files such as <tt>/etc/passwd</tt>, or
+to even store passwords themselves in plaintext on the system.
+Using system-provided tools for password change/creation
+should allow administrators to avoid such misconfiguration.
+<Rule id="no_empty_passwords" severity="high">
+<title>Prevent Log In to Accounts With Empty Password</title>
+<description>If an account is configured for password authentication
+but does not have an assigned password, it may be possible to log
+into the account without authentication. Remove any instances of the <tt>nullok</tt>
+option in <tt>/etc/pam.d/system-auth</tt> to
+prevent logins with empty passwords.
+<ocil clause="NULL passwords can be used">
+To verify that null passwords cannot be used, run the following command:
+<pre># grep nullok /etc/pam.d/system-auth</pre>
+If this produces any output, it may be possible to log into accounts
+with empty passwords.
+If an account has an empty password, anyone could log in and
+run commands with the privileges of that account. Accounts with
+empty passwords should never be used in operational
+<oval id="no_empty_passwords" />
+<ref nist="IA-5(b),IA-5(c),IA-5(1)(a)" />
+<Rule id="no_hashes_outside_shadow" severity="medium">
+<title>Verify All Account Password Hashes are Shadowed</title>
+If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field,
+instead of an <tt>x</tt>), the cause of this misconfiguration should be
+investigated.  The account should have its password reset and the hash should be
+properly stored, or the account should be deleted entirely.
+<ocil clause="any stored hashes are found in /etc/passwd">
+To check that no password hashes are stored in
+<tt>/etc/passwd</tt>, run the following command:
+<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
+If it produces any output, then a password hash is
+stored in <tt>/etc/passwd</tt>.
+The hashes for all user account passwords should be stored in
+the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
+which is readable by all users.
+<oval id="accounts_password_all_shadowed" />
+<ref nist="IA-5(h)" disa="201" />
+<Rule id="gid_passwd_group_same">
+<title>All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
+Add a group to the system for each GID referenced without a corresponding group.
+<ocil clause="there is output">
+To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>, 
+run the following command:
+<pre># pwck -qr</pre>
+There should be no output.
+Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
+<ref disa="366" />
+<Rule id="no_netrc_files" severity="medium">
+<title>Verify No netrc Files Exist</title>
+<description>The <tt>.netrc</tt> files contain login information
+used to auto-login into FTP servers and reside in the user's home
+directory. These files may contain unencrypted passwords to
+remote FTP servers making them susceptible to access by unauthorized
+users and should not be used.  Any <tt>.netrc</tt> files should be removed.
+<ocil clause="any .netrc files exist">
+To check the system for the existence of any <tt>.netrc</tt> files,
+run the following command:
+<pre># find /home -xdev -name .netrc</pre>
+<!-- needs fixup to limit search to home dirs -->
+Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
+files. DoD policy requires passwords be encrypted in storage and not used
+in access scripts.
+<oval id="no_netrc_files" />
+<ref nist="IA-5(h)" disa="196" />
diff --git a/Fedora/input/system/accounts/restrictions/restrictions.xml b/Fedora/input/system/accounts/restrictions/restrictions.xml
new file mode 100644
index 0000000..febead6
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/restrictions.xml
@@ -0,0 +1,13 @@
+<Group id="accounts-restrictions">
+<title>Protect Accounts by Restricting Password-Based Login</title>
+<description>Conventionally, Unix shell accounts are accessed by
+providing a username and password to a login program, which tests
+these values for correctness using the <tt>/etc/passwd</tt> and
+<tt>/etc/shadow</tt> files. Password-based login is vulnerable to
+guessing of weak passwords, and to sniffing and man-in-the-middle
+attacks against passwords entered over a network or at an insecure
+console. Therefore, mechanisms for accessing accounts by entering
+usernames and passwords should be restricted to those which are
+operationally necessary.</description>
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index 4ef3713..73eab57 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
-%global	fedorassgrelease	2.rc1
+%global	fedorassgrelease	2.rc2
 Name:		scap-security-guide
 Version:	0.1
@@ -50,6 +50,15 @@ rm -rf $RPM_BUILD_ROOT
+* Thu Oct 10 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc2
+- Introduce 'Account and Access Control' section
+- Convert following "Verify Proper Storage and Existence of Password Hashes" section
+  rules to Fedora:
+  * Prevent Log In to Accounts With Empty Password
+  * Verify All Account Password Hashes are Shadowed
+  * All GIDs referenced in /etc/passwd must be defined in /etc/group
+  * Verify No netrc Files Exist
 * Wed Oct 02 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc1
 - Set proper name of the build directory in the spec's %setup macro.
 - Replace hard-wired paths with macros. Preserve attributes when copying files.