On 8/28/13 2:02 PM, leam hall wrote:
Hey Maura!

I'm using the openscap-utils rpm and the content from the Fedorahosted zip file.


On Wed, Aug 28, 2013 at 1:05 PM, Maura Dailey <maura@eclipse.ncsc.mil> wrote:
On 08/28/2013 12:04 PM, leam hall wrote:
Hey all,

Just ran oscap with the xml files available on the website (Benchmark version 0.9). Here are the issues that seem to be false positives. Prefix everything with "RHEL-06-000". These are all marked as fail but the server meets the STIG.
Stupid question, but what are you running against exactly? The RPM or the latest git checkout? I want to make sure that if I run this, I'm seeing the same results, and I've made a lot of changes to OVAL checks in the git repository in the past few weeks. I'm going to run through your list, comparing it against the OVAL checks.

  9   rhnsd can be on if configured to Satellite server or similar
Fix text definitely implies this. It's not the only service that implies it's allowed in certain environments, but then proceeds to only accept a value of disabled.

 57   ucredit

STIG wants ucredit=-1, so to test:

[shawn@rhel6 checks]$ grep ucredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1


[shawn@rhel6 checks]$ var_password_pam_cracklib_ucredit=-1 ; export var_password_pam_cracklib_ucredit
[shawn@rhel6 checks]$ ./testcheck.py accounts_password_pam_cracklib_ucredit.xml
external_variable with id : var_password_pam_cracklib_ucredit
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml
Writing results to : /tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml-results
Definition oval:scap-security-guide.testing:def:112: true
Evaluation done.

Side note: stig-rhel6-server was inheriting var_password_pam_cracklib_ucredit=2 from common. Created patch to set var_password_pam_cracklib_ucredit=-1 for STIG requirements.

 58   ocredit

[shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1 ocredit=5
[shawn@rhel6 checks]$ var_password_pam_cracklib_ocredit=-1 ; export var_password_pam_cracklib_ocredit
[shawn@rhel6 checks]$ ./testcheck.py accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml
Writing results to : /tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml-results
Definition oval:scap-security-guide.testing:def:117: false
Evaluation done.

[shawn@rhel6 checks]$ sudo vim ocredit /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1 ocredit=-1
[shawn@rhel6 checks]$ ./testcheck.py accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml
Writing results to : /tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml-results
Definition oval:scap-security-guide.testing:def:117: true
Evaluation done.

Side note: var_password_pam_cracklib_ocredit=2 inherited from common. Updated STIG profile for var_password_pam_cracklib_ocredit=-1


 59   lcredit

[shawn@rhel6 checks]$ var_password_pam_cracklib_lcredit=-1 ; export var_password_pam_cracklib_lcredit
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1 ocredit=-1 lcredit=5
[shawn@rhel6 checks]$ ./testcheck.py accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml
Writing results to : /tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml-results
Definition oval:scap-security-guide.testing:def:122: false
Evaluation done.

[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[sudo] password for shawn:
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1 ocredit=-1 lcredit=-1
[shawn@rhel6 checks]$ ./testcheck.py accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml
Writing results to : /tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.

[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=3 ucredit=-1 ocredit=-1 lcredit=-5
[shawn@rhel6 checks]$ ./testcheck.py accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml
Writing results to : /tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.


Side note: var_password_pam_cracklib_lcredit=2 inherited from common. Updated STIG profile for var_password_pam_cracklib_lcredit=-1

For the previous 3, I'd like to see the pam_cracklib.so line so I can troubleshoot.

As Maura mentioned, can you send your /etc/pam.d/system-auth file? I had trouble reproducing your results.


 73   /etc/issue
Going back to my many many OVAL check updates, I'd like to see your exact /etc/issue so I can debug what went wrong. If it's an exact copy of the text from the STIG, I'll work off that.
Skipping since Maura has the regex foo for this :)


 98  No ipv6 installed
Do you mean it's disabled on your system, but the OVAL checks are saying it isn't?
[shawn@rhel6 checks]$ sudo vim /etc/modprobe.d/disabled.conf ; cat /etc/modprobe.d/disabled.conf ; \
> ./testcheck.py kernel_module_ipv6_option_disabled.xml ; \
> sudo vim /etc/modprobe.d/disabled.conf ; cat /etc/modprobe.d/disabled.conf ; \
> ./testcheck.py kernel_module_ipv6_option_disabled.xml
options ipv6 disable=1
Evaluating with OVAL tempfile : /tmp/kernel_module_ipv6_option_disabledv3NN_r.xml
Writing results to : /tmp/kernel_module_ipv6_option_disabledv3NN_r.xml-results
Definition oval:scap-security-guide.testing:def:127: true
Evaluation done.
Evaluating with OVAL tempfile : /tmp/kernel_module_ipv6_option_disabledTJDTEF.xml
Writing results to : /tmp/kernel_module_ipv6_option_disabledTJDTEF.xml-results
Definition oval:scap-security-guide.testing:def:127: false
Evaluation done.

Appears working. Can you send where you disabled IPv6?


 99  "
?
RHEL-06-000099: The system must ignore ICMPv6 redirects by default.
aka sysctl_net_ipv6_conf_default_accept_redirects.xml

[root@rhel6 checks]# sysctl -q -n -w net.ipv6.conf.default.accept_redirects=0
[root@rhel6 checks]# ./testcheck.py sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile : /tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml
Writing results to : /tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml-results
Definition oval:scap-security-guide.testing:def:130: true
Evaluation done.
[root@rhel6 checks]# sysctl -q -n -w net.ipv6.conf.default.accept_redirects=1
[root@rhel6 checks]# ./testcheck.py sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile : /tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml
Writing results to : /tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml-results
Definition oval:scap-security-guide.testing:def:130: false
Evaluation done.

Can you send us the output of:
`grep net.ipv6.conf.default.accept_redirects /etc/sysctl.conf` and
`sysctl -a | grep net.ipv6.conf.default.accept_redirects`

165  adjtimex
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_adjtimex.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_adjtimexQoelxQ.xml
Writing results to : /tmp/audit_rules_time_adjtimexQoelxQ.xml-results
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Definition oval:scap-security-guide.testing:def:134: true
Evaluation done.

Since these operate on OR's, the false is checking for 32bit auditing rules. Ultimately, this results in a pass.

Can you send the output of 'grep adjtimex /etc/audit/audit.rules' ?



167  settimeofday
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_settimeofday.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_settimeofday9TYIqD.xml
Writing results to : /tmp/audit_rules_time_settimeofday9TYIqD.xml-results
Definition oval:scap-security-guide.testing:def:147: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
(passes)


Can you send the output of 'grep settimeofday /etc/audit/audit.rules' ?



169  stime  // Also, the STIG is wrong. There is no x86_64 stime syscall
The STIG actually says that stime is not necessary, which is kind of a strange wording, but the suggested line in the fix text prose is correct, at least. So far as OVAL checks go, I haven't gotten to testing audit checks yet. Maybe this is broken. I'll check it out once I've deciphered the OVAL check.

[root@rhel6 RHEL6]# echo "-a always,exit -F arch=b32 -S stime -k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 RHEL6]# cd input/checks/
[root@rhel6 checks]# ./testcheck.py audit_rules_time_s
audit_rules_time_settimeofday.xml  audit_rules_time_stime.xml        
[root@rhel6 checks]# ./testcheck.py audit_rules_time_stime.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_stime4hUFRb.xml
Writing results to : /tmp/audit_rules_time_stime4hUFRb.xml-results
Definition oval:scap-security-guide.testing:def:152: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.


Can you send the output of 'grep stime /etc/audit/audit.rules' ?



171  clock_settime
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_clock_settime.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_time_clock_settime2SUHvv.xml
Writing results to : /tmp/audit_rules_time_clock_settime2SUHvv.xml-results
Definition oval:scap-security-guide.testing:def:155: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.


Can you send the output of 'grep clock_settime /etc/audit/audit.rules' ?


184-196, 200 chmod, chown, etc...
Haven't tested audit checks yet...
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_chmod.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_dac_modification_chmodA0U8eF.xml
Writing results to : /tmp/audit_rules_dac_modification_chmodA0U8eF.xml-results
Definition oval:scap-security-guide.testing:def:160: true
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchmod.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_dac_modification_fchmodrqtEUo.xml
Writing results to : /tmp/audit_rules_dac_modification_fchmodrqtEUo.xml-results
Definition oval:scap-security-guide.testing:def:180: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchmodat.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml
Writing results to : /tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml-results
Definition oval:scap-security-guide.testing:def:185: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.



[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchown.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_dac_modification_fchownR4dTLm.xml
Writing results to : /tmp/audit_rules_dac_modification_fchownR4dTLm.xml-results
Definition oval:scap-security-guide.testing:def:165: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_fchownat.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_dac_modification_fchownata3WKRL.xml
Writing results to : /tmp/audit_rules_dac_modification_fchownata3WKRL.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py audit_rules_dac_modification_lchown.xml
Evaluating with OVAL tempfile : /tmp/audit_rules_dac_modification_lchownmX0BTK.xml
Writing results to : /tmp/audit_rules_dac_modification_lchownmX0BTK.xml-results
Definition oval:scap-security-guide.testing:def:175: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.


Please send relevant lines from audit.rules



206-211  No telnet installed or turned on
These are both automated checks. Unless the package name is wrong, I don't know why they'd give false positives.
This is broke. I forgot who originally reported, but we still need to update the telnet checks to use the xinet templates.


240  /etc/ssh/sshd_config Banner
The OVAL check was definitely working on my system when I last tested it.
I'm able to reproduce...

[root@rhel6 checks]# cat /etc/issue
You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

[root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml
Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
Definition oval:scap-security-guide.testing:def:193: false
Definition oval:scap-security-guide.testing:def:191: false
Definition oval:scap-security-guide.testing:def:190: false
Evaluation done.

Maura, do you want to take a stab at this (noticed your signoff on the OVAL)?

FWIW, if I used the USGCB banner everything worked OK.


271  If there are no removable partitions this is not a finding.
Working on testing this one now...
Skipping in my testing then


278  If the file permissions are more restrictive then it is not a finding.
This pairs with rpm_verify_permissions, which has the following criterion checks:
    <criteria operator="AND">
      <criterion test_ref="test_verify_all_rpms_user_ownership" comment="user ownership of all files matches local rpm database" />
      <criterion test_ref="test_verify_all_rpms_group_ownership" comment="group ownership of all files matches local rpm database" />
      <criterion test_ref="test_verify_all_rpms_mode" comment="mode of all files matches local rpm database" />
    </criteria>

Can you send what files are being reported? It should only hit on ownership mismatches.


324  No X running
Agreed, the GNOME checks need to be rewritten to have extended definitions to exclude machines that don't have X installed.
Which package(s) should we check for? xorg-x11-server-Xorg? gnome-desktop?



326   " 
?

Same thing as 324



346  Finding reported on umask 022
This is DEFINITELY a bug. The check section is actually pointing to a different check. The actual check for this rule was never written.
The XCCDF (set_daemon_umask) points to:

<oval id="umask_for_daemons" value="var_umask_for_daemons"/>

so, to test:
[shawn@rhel6 checks]$ grep umask /etc/init.d/functions
# Make sure umask is sane
umask 022
[shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export var_umask_for_daemons
[shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml
Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results
Definition oval:scap-security-guide.testing:def:212: false
Evaluation done.


but then in the OVAL code, it's looking at the wrong place:
<ind:textfilecontent54_object id="object_umask_for_daemons" version="1">
    <ind:path>/etc/sysconfig</ind:path>
    <ind:filename>init</ind:filename>
    <ind:pattern operation="pattern match">umask[\s]+(.*)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

verified no other XCCDF rule was using this OVAL:
[shawn@rhel6 input]$ grep -rin umask_for_daemons system/*
system/permissions/execution.xml:18:<Value id="var_umask_for_daemons" type="string" operator="equals" interactive="0">
system/permissions/execution.xml:47:<oval id="umask_for_daemons" value="var_umask_for_daemons"/>

.... wrote a patch to fix the pattern match expression, and file path things seem OK now:
[shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export var_umask_for_daemons
[shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml
Writing results to : /tmp/umask_for_daemons394CCR.xml-results
Definition oval:scap-security-guide.testing:def:212: true
Evaluation done.


348  No vsftp installed, thus no file.
No OVAL check exists in SSG.

Created https://fedorahosted.org/scap-security-guide/ticket/411 to track


506  "hushlogin"
This one isn't in the SSG at all.
507  PrintLastLog
This one isn't in the SSG at all.
Not sure how/why DISA FSO slid these in. Leland?

-- 
Shawn Wells
Director, Innovation Programs
shawn@redhat.com | 443.534.0130
@shawndwells