I think it would be awesome if there were a way to link to an existing STIG ID.

 

It is very difficult to map between the SSG RHEL6 content and the official RHEL6 STIG.

 

From my experience so far, I have noticed that the resulting content will open in the STIG Viewer application, but because it uses designated identifiers for Group ID and Rule ID, it doesn’t display identical to the original STIG. Also, there are a number of fields that a standard STIG uses that indicates how data gets displayed in the display window. So the content I produce just has the default “Documentable: No” field and that’s it.

 

Furthermore, I believe to be able to import scan results into an existing STIG Checklist created in the STIG Viewer, the Group ID and Rule ID fields would need to match between the original STIG and the resulting SCAP content.

 

It would be nice to have one zip file that can serve as both the STIG Viewer content and SCAP content.

 

However, I also like the simplified naming approach of each rule in SSG (e.g. banner_gui_enabled) as it is easier to maintain as opposed to the Rule IDs in the STIG (e.g. SV-50255r1_rule).

 

Also, if you change the Group ID up front, then it affects the layout of the guide.

 

Perhaps we could include a “STIG ID”, “STIG Group ID” and “STIG Rule ID” for each rule that can later be used when building the SCAP content to use the STIG identifiers. That would at least resolve the mappings.

 

So taking a random check that I found in both, here are the mappings as I see it:

 

STIG                                                                   à SSG

 

Group ID (V-38541)                                        à Group ID (auditd_configure_rules)

Group ID Title (SRG-OS-999999)                  à Group ID Title (Configure auditd Rules for Comprehensive Auditing)

Rule ID (SV-50342r1_rule)                            à Rule ID (audit_mac_changes)

Rule ID Version (RHEL-06-000183)             à Rule ID Version (does not exist and is not a valid SCAP element)

 

I believe the “Group ID Title” and “Rule ID Version” are just cosmetic and could likely be left out. Although it would still be nice to pull in the “Rule ID Version” field as a STIG ID reference.

 

But it would be nice to be able to convert SSG Group ID and Rule ID to their STIG values during build time. I believe this conversion would also need to be done in the profiles as well, since they call the rules to be enabled.

 

As for the extra content, I have not had much luck in finding a good way of incorporating that. Here is an example of the “extra content” I am referring to using the same referenced check above:

 

<description>&lt;VulnDiscussion&gt;The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>

 

Best regards,

 

Trey Henefield, CISSP

Senior IAVA Engineer

 

Ultra Electronics

Advanced Tactical Systems, Inc.

4101 Smith School Road

Building IV, Suite 100

Austin, TX 78744 USA

 

Trey.Henefield@ultra-ats.com

Tel: +1 512 327 6795 ext. 647

Fax: +1 512 327 8043

Mobile: +1 512 541 6450

 

www.ultra-ats.com

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shawn Wells
Sent: Monday, September 09, 2013 10:18 AM
To: scap-security-guide@lists.fedorahosted.org
Subject: Re: mappings to DISA STIG identifiers

 

On 9/5/13 12:09 PM, Burns, Robert K (US SSA) wrote:

A couple of corrections, version 1.1.
 
Regards,
 
Robert K. Burns
Navy Validator
Robert.burns@baesystems.com
 
Rule_Ver,SCAP_ID
RHEL-06-000526,service_autofs_disabled
RHEL-06-000525,enable_auditd_bootloader
RHEL-06-000524,
RHEL-06-000036,userowner_gshadow_file
RHEL-06-000523,
RHEL-06-000522,
RHEL-06-000521,
RHEL-06-000519,rpm_verify_hashes
RHEL-06-000037,groupowner_gshadow_file
RHEL-06-000038,perms_gshadow_file
RHEL-06-000039,userowner_passwd_file
RHEL-06-000040,groupowner_passwd_file
RHEL-06-000518,rpm_verify_permissions
RHEL-06-000517,
RHEL-06-000516,
RHEL-06-000001,partition_for_tmp
RHEL-06-000002,partition_for_var
RHEL-06-000041,file_permissions_etc_passwd
RHEL-06-000042,userowner_group_file
RHEL-06-000043,groupowner_group_file
RHEL-06-000515,
RHEL-06-000044,perms_group_file
RHEL-06-000514,
RHEL-06-000003,partition_for_var_log
RHEL-06-000511,
RHEL-06-000045,file_permissions_library_dirs
RHEL-06-000046,file_ownership_library_dirs
RHEL-06-000004,partition_for_var_log_audit
RHEL-06-000510,configure_auditd_space_left_action
RHEL-06-000047,file_permissions_binary_dirs
RHEL-06-000005,configure_auditd_space_left_action
RHEL-06-000509,
RHEL-06-000048,file_ownership_binary_dirs
RHEL-06-000007,partition_for_home
RHEL-06-000508,
RHEL-06-000050,password_min_len
RHEL-06-000008,ensure_redhat_gpgkey_installed
RHEL-06-000051,password_min_age
RHEL-06-000009,service_rhnsd_disabled
RHEL-06-000053,password_max_age
RHEL-06-000054,password_warn_age
RHEL-06-000011,security_patches_up_to_date
RHEL-06-000056,password_require_digits
RHEL-06-000013,ensure_gpgcheck_globally_activated
RHEL-06-000507,
RHEL-06-000506,
RHEL-06-000505,
RHEL-06-000015,ensure_gpgcheck_never_disabled
RHEL-06-000504,
RHEL-06-000016,package_aide_installed
RHEL-06-000503,kernel_module_usb-storage_disabled
RHEL-06-000019,no_rsh_trust_files
RHEL-06-000027,restrict_root_console_logins
RHEL-06-000385,
RHEL-06-000028,restrict_serial_port_logins
RHEL-06-000384,
RHEL-06-000029,
RHEL-06-000030,no_empty_passwords
RHEL-06-000383,audit_logs_permissions
RHEL-06-000031,no_hashes_outside_shadow
RHEL-06-000032,no_uidzero_except_root
RHEL-06-000357,deny_password_attempts_fail_interval
RHEL-06-000033,userowner_shadow_file
RHEL-06-000034,groupowner_shadow_file
RHEL-06-000035,perms_shadow_file
RHEL-06-000082,disable_sysctl_ipv4_ip_forward
RHEL-06-000117,enable_ip6tables
RHEL-06-000120,set_iptables_default_rule
RHEL-06-000124,disable_protocol_dccp
RHEL-06-000125,disable_protocol_sctp
RHEL-06-000126,disable_protocol_rds
RHEL-06-000127,disable_protocol_tipc
RHEL-06-000133,userowner_rsyslog_files
RHEL-06-000134,groupowner_rsyslog_files
RHEL-06-000136,rsyslog_send_messages_to_logserver
RHEL-06-000137,rsyslog_send_messages_to_logserver
RHEL-06-000167,audit_rules_time_settimeofday
RHEL-06-000083,set_sysctl_net_ipv4_conf_all_accept_source_route
RHEL-06-000084,set_sysctl_net_ipv4_conf_all_accept_redirects
RHEL-06-000169,audit_rules_time_stime
RHEL-06-000086,set_sysctl_net_ipv4_conf_all_secure_redirects
RHEL-06-000171,audit_rules_time_clock_settime
RHEL-06-000088,set_sysctl_net_ipv4_conf_all_log_martians
RHEL-06-000089,set_sysctl_net_ipv4_conf_default_accept_source_route
RHEL-06-000173,audit_rules_time_watch_localtime
RHEL-06-000174,audit_account_changes
RHEL-06-000090,set_sysctl_net_ipv4_conf_default_secure_redirects
RHEL-06-000091,set_sysctl_net_ipv4_conf_default_accept_redirects
RHEL-06-000175,audit_account_changes
RHEL-06-000092,set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
RHEL-06-000176,audit_account_changes
RHEL-06-000093,set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
RHEL-06-000177,audit_account_changes
RHEL-06-000095,set_sysctl_net_ipv4_tcp_syncookies
RHEL-06-000182,audit_network_modifications
RHEL-06-000183,audit_mac_changes
RHEL-06-000096,set_sysctl_net_ipv4_conf_all_rp_filter
RHEL-06-000184,audit_rules_dac_modification_chmod
RHEL-06-000097,set_sysctl_net_ipv4_conf_default_rp_filter
RHEL-06-000185,audit_rules_dac_modification_chown
RHEL-06-000098,disable_ipv6_module_loading
RHEL-06-000186,audit_rules_dac_modification_fchmod
RHEL-06-000099,set_sysctl_ipv6_default_accept_redirects
RHEL-06-000103,enable_ip6tables
RHEL-06-000187,audit_rules_dac_modification_fchmodat
RHEL-06-000106,enable_ip6tables
RHEL-06-000188,audit_rules_dac_modification_fchown
RHEL-06-000107,enable_ip6tables
RHEL-06-000189,audit_rules_dac_modification_fchownat
RHEL-06-000113,enable_iptables
RHEL-06-000190,audit_rules_dac_modification_fremovexattr
RHEL-06-000191,audit_rules_dac_modification_fsetxattr
RHEL-06-000192,audit_rules_dac_modification_lchown
RHEL-06-000193,audit_rules_dac_modification_lremovexattr
RHEL-06-000116,enable_ip6tables
RHEL-06-000194,audit_rules_dac_modification_lsetxattr
RHEL-06-000195,audit_rules_dac_modification_removexattr
RHEL-06-000196,audit_rules_dac_modification_setxattr
RHEL-06-000197,audit_file_access
RHEL-06-000198,audit_privileged_commands
RHEL-06-000199,audit_media_exports
RHEL-06-000057,password_require_uppercases
RHEL-06-000058,password_require_specials
RHEL-06-000059,password_require_lowercases
RHEL-06-000060,password_require_diffchars
RHEL-06-000061,deny_password_attempts
RHEL-06-000062,pass set_password_hashing_algorithm_systemauth
RHEL-06-000200,audit_file_deletions
RHEL-06-000063,set_password_hashing_algorithm_logindefs
RHEL-06-000064,set_password_hashing_algorithm_libuserconf
RHEL-06-000201,audit_sysadmin_actions
RHEL-06-000065,user_owner_grub_conf
RHEL-06-000202,audit_kernel_module_loading
RHEL-06-000066,group_owner_grub_conf
RHEL-06-000203,disable_xinetd
RHEL-06-000067,permissions_grub_conf
RHEL-06-000204,uninstall_xinetd
RHEL-06-000068,bootloader_password
RHEL-06-000069,require_singleuser_auth
RHEL-06-000206,uninstall_telnet_server
RHEL-06-000070,disable_interactive_boot
RHEL-06-000211,disable_telnet_service
RHEL-06-000071,package_screen_installed
RHEL-06-000213,uninstall_rsh-server
RHEL-06-000356,deny_password_attempts
RHEL-06-000073,set_system_login_banner
RHEL-06-000214,disable_rsh
RHEL-06-000349,smartcard_auth
RHEL-06-000078,enable_randomize_va_space
RHEL-06-000079,enable_execshield
RHEL-06-000216,disable_rexec
RHEL-06-000348,ftp_present_banner
RHEL-06-000080,disable_sysctl_ipv4_default_send_redirects
RHEL-06-000081,disable_sysctl_ipv4_all_send_redirects
RHEL-06-000218,disable_rlogin
RHEL-06-000220,uninstall_ypserv
RHEL-06-000221,disable_ypbind
RHEL-06-000224,enable_cron
RHEL-06-000222,uninstall_tftp-server
RHEL-06-000227,sshd_allow_only_protocol2
RHEL-06-000230,sshd_set_idle_timeout
RHEL-06-000223,disable_tftp
RHEL-06-000231,sshd_set_keepalive
RHEL-06-000234,sshd_disable_rhosts
RHEL-06-000236,disable_host_auth
RHEL-06-000237,sshd_disable_root_login
RHEL-06-000239,sshd_disable_empty_passwords
RHEL-06-000240,sshd_enable_warning_banner
RHEL-06-000241,sshd_do_not_permit_user_env
RHEL-06-000243,sshd_use_approved_ciphers
RHEL-06-000246,disable_avahi
RHEL-06-000347,no_netrc_files
RHEL-06-000247,enable_ntpd
RHEL-06-000248,ntpd_specify_remote_server
RHEL-06-000249,postfix_network_listening
RHEL-06-000135,rsyslog_file_permissions
RHEL-06-000138,ensure_logrotate_activated
RHEL-06-000252,ldap_client_start_tls
RHEL-06-000253,ldap_client_tls_cacertpath
RHEL-06-000256,package_openldap-servers_removed
RHEL-06-000145,enable_auditd_service
RHEL-06-000257,set_screensaver_inactivity_timeout
RHEL-06-000258,enable_screensaver_after_idle
RHEL-06-000148,enable_auditd_service
RHEL-06-000154,enable_auditd_service
RHEL-06-000160,configure_auditd_max_log_file
RHEL-06-000161,configure_auditd_max_log_file_action
RHEL-06-000165,audit_rules_time_adjtimex
RHEL-06-000159,configure_auditd_num_logs
RHEL-06-000281,rpm_verify_hashes
RHEL-06-000259,enable_screensaver_password_lock
RHEL-06-000260,set_blank_screensaver
RHEL-06-000261,service_abrtd_disabled
RHEL-06-000262,
RHEL-06-000346,set_daemon_umask
RHEL-06-000282,world_writeable_files
RHEL-06-000265,service_ntpdate_disabled
RHEL-06-000345,user_umask_logindefs
RHEL-06-000266,service_oddjobd_disabled
RHEL-06-000344,user_umask_profile
RHEL-06-000267,service_qpidd_disabled
RHEL-06-000343,user_umask_cshrc
RHEL-06-000268,service_rdisc_disabled
RHEL-06-000342,user_umask_bashrc
RHEL-06-000269,use_nodev_option_on_nfs_mounts
RHEL-06-000341,snmpd_not_default_password
RHEL-06-000270,use_nosuid_option_on_nfs_mounts
RHEL-06-000271,mountopt_noexec_on_removable_partitions
RHEL-06-000272,require_smb_client_signing
RHEL-06-000273,require_smb_client_signing_mount.cifs
RHEL-06-000274,limiting_password_reuse
RHEL-06-000275,encrypt_partitions
RHEL-06-000340,snmpd_use_newer_protocol
RHEL-06-000276,encrypt_partitions
RHEL-06-000277,encrypt_partitions
RHEL-06-000278,rpm_verify_permissions
RHEL-06-000279,
RHEL-06-000280,
RHEL-06-000284,install_antivirus
RHEL-06-000285,install_hids
RHEL-06-000286,disable_ctrlaltdel_reboot
RHEL-06-000287,service_postfix_enable
RHEL-06-000306,aide_periodic_cron_checking
RHEL-06-000288,package_sendmail_removed
RHEL-06-000289,service_netconsole_disabled
RHEL-06-000307,aide_periodic_cron_checking
RHEL-06-000290,disable_xwindows_with_runlevel
RHEL-06-000308,disable_users_coredumps
RHEL-06-000291,packagegroup_xwindows_remove
RHEL-06-000309,no_insecure_locks_exports
RHEL-06-000311,configure_auditd_space_left_action
RHEL-06-000292,disable_dhcp_client
RHEL-06-000313,configure_auditd_action_mail_acct
RHEL-06-000294,gid_passwd_group_same
RHEL-06-000315,kernel_module_bluetooth_disabled
RHEL-06-000296,account_unique_name
RHEL-06-000319,max_concurrent_login_sessions
RHEL-06-000297,account_temp_expire_date
RHEL-06-000320,set_iptables_default_rule_forward
RHEL-06-000321,install_openswan
RHEL-06-000324,enable_gdm_login_banner
RHEL-06-000326,
RHEL-06-000298,account_temp_expire_date
RHEL-06-000331,service_bluetooth_disabled
RHEL-06-000334,account_disable_post_pw_expiration
RHEL-06-000299,password_require_consecrepeat
RHEL-06-000335,account_disable_post_pw_expiration
RHEL-06-000302,aide_periodic_cron_checking
RHEL-06-000303,aide_periodic_cron_checking
RHEL-06-000336,sticky_world_writable_dirs
RHEL-06-000304,aide_periodic_cron_checking
RHEL-06-000337,world_writable_files_system_ownership
RHEL-06-000305,aide_periodic_cron_checking
RHEL-06-000338,tftpd_uses_secure_mode
RHEL-06-000339,ftp_log_transactions


Well, dang. Hell of a way to make me recant the "nobody has found the mappings meaningful enough to do" statement! :)

Existing mappings are identified within <refs> tags:

<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32"/>


Before extending XCCDF rules to include something akin to a <ref stig="338,339">, can FSO (Leland? Ricki?) chime in on how static these identifiers will be? Or, even better, could we generate them directly from SSG?



Disclaimer
The information contained in this communication from
trey.henefield@ultra-ats.com sent at 2013-09-09 12:34:33 is private and may be legally privileged or export controlled. It is intended solely for use by scap-security-guide@lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide@lists.fedorahosted.org you are hereby notified that any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.