On 8/28/13 2:02 PM, leam hall wrote:
Hey Maura!
I'm using the openscap-utils rpm and the content from the
Fedorahosted zip file.
STIG wants ucredit=-1, so to test:
[shawn@rhel6 checks]$ grep ucredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1
[shawn@rhel6 checks]$ var_password_pam_cracklib_ucredit=-1 ; export
var_password_pam_cracklib_ucredit
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_ucredit.xml
external_variable with id : var_password_pam_cracklib_ucredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_ucredit4WnLnw.xml-results
Definition oval:scap-security-guide.testing:def:112: true
Evaluation done.
Side note: stig-rhel6-server was inheriting
var_password_pam_cracklib_ucredit=2 from common. Created patch to
set var_password_pam_cracklib_ucredit=-1 for STIG requirements.
[shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=5
[shawn@rhel6 checks]$ var_password_pam_cracklib_ocredit=-1 ; export
var_password_pam_cracklib_ocredit
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_ocreditatN3pc.xml-results
Definition oval:scap-security-guide.testing:def:117: false
Evaluation done.
[shawn@rhel6 checks]$ sudo vim ocredit /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep ocredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_ocredit.xml
external_variable with id : var_password_pam_cracklib_ocredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_ocreditKrBREl.xml-results
Definition oval:scap-security-guide.testing:def:117: true
Evaluation done.
Side note: var_password_pam_cracklib_ocredit=2 inherited from
common. Updated STIG profile for
var_password_pam_cracklib_ocredit=-1
[shawn@rhel6 checks]$ var_password_pam_cracklib_lcredit=-1 ; export
var_password_pam_cracklib_lcredit
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1 lcredit=5
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_lcredit40ApZj.xml-results
Definition oval:scap-security-guide.testing:def:122: false
Evaluation done.
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[sudo] password for shawn:
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1 lcredit=-1
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_lcreditxktRcT.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.
[shawn@rhel6 checks]$ sudo vim /etc/pam.d/system-auth
[shawn@rhel6 checks]$ grep lcredit /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=3
ucredit=-1 ocredit=-1 lcredit=-5
[shawn@rhel6 checks]$ ./testcheck.py
accounts_password_pam_cracklib_lcredit.xml
external_variable with id : var_password_pam_cracklib_lcredit
Evaluating with OVAL tempfile :
/tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml
Writing results to :
/tmp/accounts_password_pam_cracklib_lcreditZr4xu0.xml-results
Definition oval:scap-security-guide.testing:def:122: true
Evaluation done.
Side note: var_password_pam_cracklib_lcredit=2 inherited from
common. Updated STIG profile for var_password_pam_cracklib_lcredit=-1
As Maura mentioned, can you send your /etc/pam.d/system-auth file? I
had trouble reproducing your results.
Skipping since Maura has the regex foo for this :)
[shawn@rhel6 checks]$ sudo vim /etc/modprobe.d/disabled.conf ; cat
/etc/modprobe.d/disabled.conf ; \
> ./testcheck.py kernel_module_ipv6_option_disabled.xml ; \
> sudo vim /etc/modprobe.d/disabled.conf ; cat
/etc/modprobe.d/disabled.conf ; \
> ./testcheck.py kernel_module_ipv6_option_disabled.xml
options ipv6 disable=1
Evaluating with OVAL tempfile :
/tmp/kernel_module_ipv6_option_disabledv3NN_r.xml
Writing results to :
/tmp/kernel_module_ipv6_option_disabledv3NN_r.xml-results
Definition oval:scap-security-guide.testing:def:127: true
Evaluation done.
Evaluating with OVAL tempfile :
/tmp/kernel_module_ipv6_option_disabledTJDTEF.xml
Writing results to :
/tmp/kernel_module_ipv6_option_disabledTJDTEF.xml-results
Definition oval:scap-security-guide.testing:def:127: false
Evaluation done.
Appears working. Can you send where you disabled IPv6?
RHEL-06-000099: The system must ignore ICMPv6 redirects by default.
aka sysctl_net_ipv6_conf_default_accept_redirects.xml
[root@rhel6 checks]# sysctl -q -n -w
net.ipv6.conf.default.accept_redirects=0
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml
Writing results to :
/tmp/sysctl_net_ipv6_conf_default_accept_redirectsNkZern.xml-results
Definition oval:scap-security-guide.testing:def:130: true
Evaluation done.
[root@rhel6 checks]# sysctl -q -n -w
net.ipv6.conf.default.accept_redirects=1
[root@rhel6 checks]# ./testcheck.py
sysctl_net_ipv6_conf_default_accept_redirects.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml
Writing results to :
/tmp/sysctl_net_ipv6_conf_default_accept_redirects6Xp7Wz.xml-results
Definition oval:scap-security-guide.testing:def:130: false
Evaluation done.
Can you send us the output of:
`grep net.ipv6.conf.default.accept_redirects /etc/sysctl.conf` and
`sysctl -a | grep net.ipv6.conf.default.accept_redirects`
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S adjtimex -k
audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py audit_rules_time_adjtimex.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_time_adjtimexQoelxQ.xml
Writing results to :
/tmp/audit_rules_time_adjtimexQoelxQ.xml-results
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Definition oval:scap-security-guide.testing:def:134: true
Evaluation done.
Since these operate on OR's, the false is checking for 32bit
auditing rules. Ultimately, this results in a pass.
Can you send the output of 'grep adjtimex /etc/audit/audit.rules' ?
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S
settimeofday -k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py
audit_rules_time_settimeofday.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_time_settimeofday9TYIqD.xml
Writing results to :
/tmp/audit_rules_time_settimeofday9TYIqD.xml-results
Definition oval:scap-security-guide.testing:def:147: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
(passes)
Can you send the output of 'grep settimeofday
/etc/audit/audit.rules' ?
[root@rhel6 RHEL6]# echo "-a always,exit -F arch=b32 -S stime -k
audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 RHEL6]# cd input/checks/
[root@rhel6 checks]# ./testcheck.py audit_rules_time_s
audit_rules_time_settimeofday.xml
audit_rules_time_stime.xml
[root@rhel6 checks]# ./testcheck.py audit_rules_time_stime.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_time_stime4hUFRb.xml
Writing results to : /tmp/audit_rules_time_stime4hUFRb.xml-results
Definition oval:scap-security-guide.testing:def:152: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
Can you send the output of 'grep stime /etc/audit/audit.rules' ?
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S
clock_settime -k audit_time_rules" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py
audit_rules_time_clock_settime.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_time_clock_settime2SUHvv.xml
Writing results to :
/tmp/audit_rules_time_clock_settime2SUHvv.xml-results
Definition oval:scap-security-guide.testing:def:155: true
Definition oval:scap-security-guide.testing:def:137: true
Definition oval:scap-security-guide.testing:def:135: false
Evaluation done.
Can you send the output of 'grep clock_settime
/etc/audit/audit.rules' ?
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chmod -S
fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod"
>> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_chmod.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_chmodA0U8eF.xml
Writing results to :
/tmp/audit_rules_dac_modification_chmodA0U8eF.xml-results
Definition oval:scap-security-guide.testing:def:160: true
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_fchmod.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchmodrqtEUo.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchmodrqtEUo.xml-results
Definition oval:scap-security-guide.testing:def:180: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_fchmodat.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchmodat5jgwg5.xml-results
Definition oval:scap-security-guide.testing:def:185: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# echo "-a always,exit -F arch=b64 -S chown -S
fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k
perm_mod" >> /etc/audit/audit.rules
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_fchown.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchownR4dTLm.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchownR4dTLm.xml-results
Definition oval:scap-security-guide.testing:def:165: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_fchownat.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_fchownata3WKRL.xml
Writing results to :
/tmp/audit_rules_dac_modification_fchownata3WKRL.xml-results
Definition oval:scap-security-guide.testing:def:170: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
[root@rhel6 checks]# ./testcheck.py
audit_rules_dac_modification_lchown.xml
Evaluating with OVAL tempfile :
/tmp/audit_rules_dac_modification_lchownmX0BTK.xml
Writing results to :
/tmp/audit_rules_dac_modification_lchownmX0BTK.xml-results
Definition oval:scap-security-guide.testing:def:175: false
Definition oval:scap-security-guide.testing:def:137: true
Evaluation done.
Please send relevant lines from audit.rules
This is broke. I forgot who originally reported, but we still need
to update the telnet checks to use the xinet templates.
I'm able to reproduce...
[root@rhel6 checks]# cat /etc/issue
You are accessing a U.S. Government (USG) Information System (IS)
that is provided for USG-authorized use only. By using this IS
(which includes any device attached to this IS), you consent to the
following conditions:
-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing,
COMSEC monitoring, network operations and defense, personnel
misconduct (PM), law enforcement (LE), and counterintelligence (CI)
investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may
be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit
or privacy.
-Notwithstanding the above, using this IS does not constitute
consent to PM, LE or CI investigative searching or monitoring of the
content of privileged communications, or work product, related to
personal representation or services by attorneys, psychotherapists,
or clergy, and their assistants. Such communications and work
product are private and confidential. See User Agreement for
details.
[root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml
Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
Definition oval:scap-security-guide.testing:def:193: false
Definition oval:scap-security-guide.testing:def:191: false
Definition oval:scap-security-guide.testing:def:190: false
Evaluation done.
Maura, do you want to take a stab at this (noticed your signoff on
the OVAL)?
FWIW, if I used the USGCB banner everything worked OK.
Skipping in my testing then
This pairs with rpm_verify_permissions, which has the following
criterion checks:
<criteria operator="AND">
<criterion test_ref="test_verify_all_rpms_user_ownership"
comment="user ownership of all files matches local rpm database"
/>
<criterion
test_ref="test_verify_all_rpms_group_ownership" comment="group
ownership of all files matches local rpm database" />
<criterion test_ref="test_verify_all_rpms_mode"
comment="mode of all files matches local rpm database" />
</criteria>
Can you send what files are being reported? It should only hit on
ownership mismatches.
Which package(s) should we check for? xorg-x11-server-Xorg?
gnome-desktop?
Same thing as 324
The XCCDF (set_daemon_umask) points to:
<oval id="umask_for_daemons" value="var_umask_for_daemons"/>
so, to test:
[shawn@rhel6 checks]$ grep umask /etc/init.d/functions
# Make sure umask is sane
umask 022
[shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export
var_umask_for_daemons
[shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemonsvX5U0G.xml
Writing results to : /tmp/umask_for_daemonsvX5U0G.xml-results
Definition oval:scap-security-guide.testing:def:212: false
Evaluation done.
but then in the OVAL code, it's looking at the wrong place:
<ind:textfilecontent54_object id="object_umask_for_daemons"
version="1">
<ind:path>/etc/sysconfig</ind:path>
<ind:filename>init</ind:filename>
<ind:pattern operation="pattern
match">umask[\s]+(.*)</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
verified no other XCCDF rule was using this OVAL:
[shawn@rhel6 input]$ grep -rin umask_for_daemons system/*
system/permissions/execution.xml:18:<Value
id="var_umask_for_daemons" type="string" operator="equals"
interactive="0">
system/permissions/execution.xml:47:<oval id="umask_for_daemons"
value="var_umask_for_daemons"/>
.... wrote a patch to fix the pattern match expression, and file
path things seem OK now:
[shawn@rhel6 checks]$ var_umask_for_daemons=022 ; export
var_umask_for_daemons
[shawn@rhel6 checks]$ ./testcheck.py umask_for_daemons.xml
external_variable with id : var_umask_for_daemons
Evaluating with OVAL tempfile : /tmp/umask_for_daemons394CCR.xml
Writing results to : /tmp/umask_for_daemons394CCR.xml-results
Definition oval:scap-security-guide.testing:def:212: true
Evaluation done.
Created https://fedorahosted.org/scap-security-guide/ticket/411 to
track
Not sure how/why DISA FSO slid these in. Leland?
--
Shawn Wells
Director, Innovation Programs
shawn@redhat.com | 443.534.0130
@shawndwells