## Version .02 Feburary 2007 ## # # Date Created : 2007-02-06 # # # CHANGELOG: # - 2007-02-07: Finished Mapping existing STIG scripts to DCID 6/3 # Sections. [St. Laurent] # - 2007-07-30 Changes Made from Mark Neilsen. [St. Laurent] # # # Profile Name: dcid-6-3-PL3-ks.1.0.txt # Profile Label: dcid-6-3-PL3-ks.1.0.txt # #Details: This KickStart file lists out DCID 6/3 Policy at the PL3 # Confidentiality level. Security settings are applied and # mapped to each specific PL3 section in DCID 6/3. # # By setting these secuiry features in a KickStart file # allows for an auditor to have a high degree of assurance # that a system is being setup meeting the security # requirements the same (correct way) every time. # # An MD5 should be set on this file to ensure the degree of # resistance to unauthorized modification. # ## Version .02 Feburary 2007 ## install text network --bootproto dhcp # This is for a SS install # url --url http://192.168.1.1/ty/h-113gLb cdrom lang en_US langsupport --default en_US en_US keyboard us mouse none zerombr yes clearpart --all #PARTITION NOTES #The following options are required under 'Disk Partition Information' #section in ks.cfg file, for creating the Logical Volume Manager (LVM) #partitions using kickstart. #Disk partitioning information #part pv. #volgroup #logvol --vgname= --size= --name= #EXAMPLE #part /boot --fstype ext3 --size=150 #part swap --size=1024 #part pv.01 --size=1 --grow #volgroup vg_root pv.01 #logvol / --vgname=vg_root --size=8192 --name=lv_root #logvol /var --vgname=vg_root --size=4096 --name=lv_var #logvol /tmp --vgname=vg_root --size=2048 --name=lv_tmp #logvol /spare --vgname=vg_root --size=1 --grow --name=lv_spare partition /boot --fstype "ext3" --size=128 partition pv.2 --size=0 --grow volgroup VolGroup00 --pesize=32768 pv.2 logvol swap --fstype swap --name=swapVol --vgname=VolGroup00 --size=512 logvol / --fstype ext3 --name=rootVol --vgname=VolGroup00 --size=5120 logvol /var --fstype ext3 --name=varVol --vgname=VolGroup00 --size=5120 logvol /home --fstype ext3 --name=homeVol --vgname=VolGroup00 --size=5120 logvol /tmp --fstype ext3 --name=tmpVol --vgname=VolGroup00 --size=2048 bootloader --location mbr --password Dodiis_Redhat4321 timezone --utc America/New_York auth --enablemd5 --enableshadow rootpw --iscrypted RA0Tkt.cUJc/Q selinux --enforcing firewall --enabled --port=22:tcp --port=161:tcp --port=1002:tcp reboot #xconfig --card "VESA driver (generic)" --videoram 8192 --hsync 31.5-37.9 --vsync 50-70 --resolution #1024x768 --depth 32 --startxonboot --defaultdesktop gnome %packages --resolvedeps @Base -xdelta -nmap -emacspeak -byacc -gimp-help -splint -perl-Crypt-SSLeay -units -perl-XML-Grove -perl-XML-LibXML-Common -perl-XML-SAX -perl-XML-Twig -valgrind -valgrind-callgrind -gimp-gap -cdecl -perl-XML-Dumper -kernel-smp-devel -blas -lapack -java-1.4.2-gcj-compat -kernel-hugemem-devel -kernel-devel -perl-XML-Encoding -gnome-games -isdn4k-utils -vnc -vnc-server e2fsprogs kernel-smp -tog-pegasus -tog-pegasus-devel -ethereal -ethereal-gnome -tcpdump -xchat -vino -gaim -gnome-pilot @ office @ admin-tools @ editors @ system-tools @ gnome-desktop @ dialup @ base-x @ printing @ server-cfg @ graphical-internet kernel -python-ldap -httpd-suexec -system-config-httpd -psgml -emacs-leim -gimp-data-extras -xcdroast -perl-XML-LibXML -gimp-print-plugin -xsane-gimp -gimp lvm2 -zsh net-snmp-utils -rhythmbox -gcc-g77 grub -texinfo -octave -dia -perl-LDAP -oprofile -emacs system-config-printer-gui -doxygen -planner -tux -indent -cdparanoia -gcc-java -gnomemeeting openoffice.org-i18n openoffice.org-libs openoffice.org firefox -evolution -xsane -ctags -cscope -sane-frontends -perl-XML-Parser -php-mysql -rcs -perl-XML-NamespaceSupport %pre #%post --nochroot #mkdir -p /mnt/sysimage/root/DoDIIS/errata #mkdir /tmp/dodiis-iso #mount /tmp/cdrom /tmp/dodiis-iso #cp -fa /tmp/dodiis-iso/RedHat/post/* /mnt/sysimage/root/DoDIIS #cp -fa /tmp/dodiis-iso/RedHat/errata/* /mnt/sysimage/root/DoDIIS/errata %post --log=/root/post-install.log # Log %post errors ########################################################################## # The post section of this kickstart file takes care of the secure # configuraton of Red Hat according to DCID 6/3. # #Levels of Concern: #Confidentiality PL3 #[ PL3 ] ########################################################################## #The Red Hat provided GPG key Red Hat uses to sign all of our RPM packages rpm --import /usr/share/rhn/RPM-GPG-KEY #(FOUO) #DCID 6/3 PL3 #4.B.3 Protection Level 3 #4.B.3.a(1) [Access1] #Synopsis: Access control, including: # #KickStart Actions: None #(FOUO) #4.B.3.a(1)(a) #Synopsis: Denial of physical access by unauthorized individuals # unless under constant supervision of technically qualified, # authorized personnel. # #KickStart Actions: None #(FOUO) #4.B.3.a(1)(b) #Synopsis: Procedures for controlling access by users and maintainers # to IS resources, including those that are at remote locations. # #KickStart Actions: None #(FOUO) #4.B.3.a(2) [Access2] # Synopsis: Access control, including Discretionary Access Control (DAC) # Policy. A system has implemented DAC when the Security # Support Structure defines and controls access between named # users and named objects in the System....These access controls # shall be capable of including or excluding access t the # granularity of a single user. # # KickStart Actions: All ext3 file systmes have been mounted with the ACL # setting to allow for a finer granualrity of DAC. # (See: getfacl and setfacl man pages). # Create ACL and other security features during # the mounting of each file system (/etc/fstab). FSTAB=/etc/fstab SED=/bin/sed #nosuid and acl on /home if [ $(grep " \/home " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then MNT_OPTS=$(grep " \/home " ${FSTAB} | awk '{print $4}') ${SED} -i "s/\( \/home.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB} fi #nosuid and acl on /sys if [ $(grep " \/sys " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then MNT_OPTS=$(grep " \/sys " ${FSTAB} | awk '{print $4}') ${SED} -i "s/\( \/sys.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB} fi #nosuid and acl on /boot if [ $(grep " \/boot " ${FSTAB} | grep -c "nosuid") -eq 0 ]; then MNT_OPTS=$(grep " \/boot " ${FSTAB} | awk '{print $4}') ${SED} -i "s/\( \/boot.*${MNT_OPTS}\)/\1,nosuid,acl/" ${FSTAB} fi #nodev and acl on /usr if [ $(grep " \/usr " ${FSTAB} | grep -c "nodev") -eq 0 ]; then MNT_OPTS=$(grep " \/usr " ${FSTAB} | awk '{print $4}') ${SED} -i "s/\( \/usr.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB} fi #nodev and acl on /home if [ $(grep " \/home " ${FSTAB} | grep -c "nodev") -eq 0 ]; then MNT_OPTS=$(grep " \/home " ${FSTAB} | awk '{print $4}') ${SED} -i "s/\( \/home.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB} fi #nodev and acl on /usr/local if [ $(grep " \/usr\/local " ${FSTAB} | grep -c "nodev") -eq 0 ]; then MNT_OPTS=$(grep " \/usr\/local " ${FSTAB} | awk '{print $4}') ${SED} -i "s/\( \/usr\/local.*${MNT_OPTS}\)/\1,nodev,acl/" ${FSTAB} fi #(FOUO) #4.B.3.a(3) [Access3] #Synopsis: Access Control, including: # #KickStart Actions: None #(FOUO) #4.B.3.a(3)(a) #Synopsis: Some process or mechanism(s) that allow users (or processes acting # on their behalf) to determine the formal access approvals. This # process or mechanism is intended to aid the user in determining # the appropriateness of information exchange. # #KickStart Actions: None #(FOUO) #4.B.3.a(3)(b) #Synopsis: Some process or mechanism(s) that allow users (or processes acting # on their behalf) to determine the sensitivity level of data. This # process or mechanism is intended to aid the user in determining # the appropriateness of information exchange. # #KickStart Actions: None #(FOUO) #4.B.3.a(4) [AcctMan] #Synopsis: Account Management procedures that include: # #KickStart Actions: None #(FOUO) #4.B.3.a(4)(a) #Synopsis: Identifying types of accounts (individual and group, conditions # for group membership, associated privileges). # #KickStart Actions: None #(FOUO) #4.B.3.a(4)(b) #Synopsis: Establishing an account (i.e., required paperwork and processes). # #KickStart Actions: None #(FOUO) #4.B.3.a(4)(c) #Synopsis: Activiating an account. # #KickStart Actions: None #(FOUO) #4.B.3.a(4)(d) #Synopsis: Modifying an account (e.g., disabling an account, changing # privilege level, group memberships, authenticators). # #KickStart Actions: None #(FOUO) #4.B.3.a(4)(e) #Synopsis: Terminating an account (i.e., processes and assurances). # #KickStart Actions: None #(FOUO) #4.B.3.a(5) [Audit1] #Synopsis: Auditing procedures, including: # #KickStart Actions: None #(FOUO) #4.B.3.a(5)(a) #Synopsis: Provide the capability to ensure that all audit records # include enough info to allow the ISSO to determine the date and # and time of the action, the system local of the action, the # system entity that initiated or completed the action, the # resources involved, and the action involved. This is done by # default with syslog in Red Hat. # #KickStart Actions: None #(FOUO) #4.B.3.a(5)(b) #Synopsis: Protect the contents of audit trails against unauthorized # access, modification, or deletion. # #KickStart Actions: Reset the permissions of /etc/syslog.conf to 640 and set # /var/{run,log}/{wtmp,utmp} files to 664. #Syslog permissions settings chmod 640 /etc/syslog.conf #/var/{run,log}/{utmp,wtmp} permission settings perl -npe 's%chmod 0664 /var/run/utmp /var/log/wtmp%chmod 0644 /var/run/utmp /var/log/wtmp%g' -i /etc/rc.d/rc.sysinit #(FOUO) #4.B.3.a(5)(c) #Synopsis: Maintain collected audit data at least 5 years and # review at least weekly. # #KickStart Actions: Log rotation to 90 days (12 weeks) and turn compression on. # This will have to up'd if system does not retain backups # for 5 years (e.g., tape backup). for logconf in `ls -1 /etc/logrotate.conf` do perl -npe 's/rotate\s+4/rotate 12/' -i $logconf perl -npe 's/\#compress/compress/' -i $logconf done # Rotate the audit-logs on a daily basis--keep them all cat < /etc/logrotate.d/audit /var/log/audit/audit.log { daily notifempty missingok postrotate /sbin/service auditd restart 2> /dev/null > /dev/null || true endscript } EOF EOF #(FOUO) #4.B.3.a(5)(d) #Synopsis: The system creates and maintains an audit trail # that includes selected records of: # #KickStart Actions: Turn on the Audit Daemon and set permissions chkconfig auditd on #Reset permissions on audit logs chmod 700 /var/log/audit chmod 600 /var/log/audit/* #(FOUO) #4.B.3.a(5)(d)(1) #Synopsis: Successful and unsuccessful logons and logoffs. # #KickStart Actions: None, This is met with the /var/log/wtmp and # /var/log/utmp files. Permissions have been set # correctly above. #(FOUO) #4.B.3.a(5)(d)(1) #Synopsis: Successful and unsuccessful logons and logoffs # #Kickstart Actions: See Section 4.B.3.a(5)(d)(2) # #4.B.3.a(5)(d)(2) #Synopsis: Accesses to security-relevant objects and directories # including opens, closes, modifications, and deletions. # #KickStart Actions: This will require refinement. # Commented rules do not insert w/o an error. cat < /etc/audit.rules ##Remove any existing rules -D ##Increase buffer size to handle the increased number of messages. ##Feel free to increase this if the machine panic's -b 8192 ##Set failure mode to panic #-f 2 ##Audits for failed attempts to access files and programs. -a exit,always -S mknod -F success=0 -a exit,possible -S open -F success=0 -a exit,possible -S pipe -F success=0 -a exit,possible -S mkdir -F success=0 -a exit,possible -S creat -F success=0 #LEAK #MOD -a exit,possible -S truncate -F success=0 -a exit,possible -S truncate64 -F success=0 -a exit,possible -S ftruncate -F success=0 -a exit,possible -S ftruncate64 -F success=0 ##Audit for files and programs deleted by user -a exit,possible -S unlink -F success!=0 -a exit,possible -S rmdir -F success!=0 -a exit,possible -w /bin/rm -F success=0 -F success!=0 -a exit,possible -S rename -F success!=0 ##Audit all administrative actions # AUD_it # Backup_export # Dev_change # Dev_configure # Dev_create -a exit,possible -S chown -F success!=0 -a exit,possible -S chown32 -F success!=0 -a exit,possible -S fchown -F success!=0 -a exit,possible -S fchown32 -F success!=0 -a exit,possible -S lchown -F success!=0 -a exit,possible -S lchown32 -F success!=0 -a exit,always -S chroot -F success!=0 -a exit,always -S mount -F success=0 -F success!=0 -a exit,always -S umount -F success=0 -F success!=0 -a exit,always -S umount2 -F success=0 -F success!=0 -a exit,always -w /usr/sbin/pwck -F success=0 -F success!=0 -a exit,always -S adjtimex -F success!=0 -a exit,always -S settimeofday -F success!=0 -a exit,always -S kill -F success=0 -F success!=0 #Proc_privilege -a exit,always -w /bin/chgrp -F success=0 -F success!=0 -a exit,always -w /usr/bin/newgrp -F success=0 -F success!=0 -a exit,always -w /usr/sbin/groupadd -F success=0 -F success!=0 -a exit,always -w /usr/sbin/groupmod -F success=0 -F success!=0 -a exit,always -w /usr/sbin/groupdel -F success=0 -F success!=0 #Restore imports #TCBCK_delete -a exit,possible -w /usr/sbin/useradd -F success=0 -F success!=0 -a exit,possible -w /usr/sbin/userdel -F success=0 -F success!=0 -a exit,possible -w /usr/sbin/usermod -F success=0 -F success!=0 -a exit,possible -w /usr/bin/chage -F success=0 -F success!=0 -a exit,possible -S reboot -F success!=0 #User_setenv ##FOUO ##4.B.3.a(5)(d)(1) - Successful and unsuccessful logons and logoffs. ##Audit all security actions -w /bin/login -p x -a exit,possible -w /bin/logout -F success!=0 -a exit,possible -S init_module -F success!=0 -a exit,possible -S delete_module -F success!=0 -a exit,possible -w /bin/su -F success!=0 ##Audit use of privileged commands -a exit,possible -w /usr/bin/setfacl -F success=0 -F success!=0 -a exit,possible -w /usr/bin/chacl -F success=0 -F success!=0 -a exit,possible -S chmod -F success=0 -F success!=0 -a exit,possible -S fchmod -F success=0 -F success!=0 -a exit,possible -S link -F success=0 -F success!=0 -a exit,possible -S symlink -F success=0 -F success!=0 # Proc_realgid # Proc_setuserids #Audit application and session initiation # Proc_Delete EOF #(FOUO) #4.B.3.a(5)(d)(3) #Synopsis: Activities at the system console, and other system # accesses by privileged users. # #KickStart Actions: All authentication attemps will be monitored # in /var/log/messages. echo "auth.notice /var/log/messages" >> /etc/syslog.conf #(FOUO) #4.B.3.a(6) [Audit3] #Synopsis: Audit procedures that include the existence and use of audit # reduction and analysis tools. # #KickStart Actions: None #(FOUO) #4.B.3.a(7) [Audit4] #Synopsis: An audit trail, created and maintained by the IS, that is # capable of recording changes to the mechanism's list of user # formal access permissions. # #KickStart Actions: None #(FOUO) #4.B.3.a(8) [Audit5] #Synopsis: Audit Procedures, including: # #KickStart Actions: None #(FOUO) #4.B.3.a(8)(a) #Synopsis: Individual accountability (i.e., unique identification of each # user and association of that identity with all auditable actions # taken by that individual). # #KickStart Actions: None #(FOUO) #4.B.3.a(8)(b) #Synopsis: Periodic testing by the ISSO or ISSM of the security posture of # the IS by employing various intrusion/attack detection and # monitoring tools. These tools shall build upon audit reduction # and analysis tools to aid the ISSO or ISSM in the monitoring # and detection of suspicious, intrusive, or attack-like behavior # patterns. # #KickStart Actions: None #(FOUO) #4.B.3.a(9) [I&A2] #Synopsis: An Identification and Authentication managment mechanism that # ensures a unique identifier for each user and that associates that # identifier with all auditable actions taken by ther user. # #KickStart Actions: None #(FOUO) #4.B.3.a(9)(a) #Synopsis: Initial authenticator content and administrative procedures for # initial authenticator distribution. # #KickStart Actions: None #(FOUO) #4.B.3.a(9)(b) #Synopsis: Individual and Group authenticators. (Group authenticators may only # be used in conjuction withthe use of an individual/unique # authenticator, that is, indivuals must be authenticated with an # individual authenticator prior to use of a group athenticator). # #KickStart Actions: None #(FOUO) #4.B.3.a(9)(c) #Synopsis: Length, composition, and generation of authenticators. # #KickStart Actions: The following item have been set to meet this policy. #Note: #Investigating using PAM for preventing 10 recent passwords- doesn't appear #to be easily done using pam_passwdqc #Passwd Strength #PAM Notes (on Absolute PATH): # # If the path to a library is not absolute, it is assumed to be # relative to the directory /usr/lib/security/$ISA/ # # For PA applications, /usr/lib/security/$ISA/libpam_unix.so.1 is a # symbolic link that points to the corresponding PA (32 or 64-bit) PAM # backend library. # # The $ISA (i.e. Instruction Set Architecture) token will be replaced # by the PAM engine with an appropriate directory string. # See pam.conf(4). cat < /etc/pam.d/system-auth #%PAM-1.0 #This file is auto-generated. #User changes will be destroyed the next time authconfig is run. #auth required /lib/security/$ISA/pam_env.so auth required pam_env.so auth sufficient pam_unix.so likeauth nullok auth required pam_deny.so auth required pam_tally.so onerr=fail no_magic_root account required pam_unix.so account sufficient pam_succeed_if.so uid < 100 quiet account required pam_permit.so account required pam_tally.so deny=3 reset no_magic_root password required pam_passwdqc.so enforce=users ask_oldauthtok=update password sufficient pam_unix.so nullok use_authtok md5 shadow remember=10 password required pam_deny.so session required pam_limits.so session required pam_unix.so EOF # Password Strength Settings /etc/login.defs perl -npe 's/PASS_MIN_LEN\s+5/PASS_MIN_LEN 9/' -i /etc/login.defs #STIG specifies using following, but it's not a valid parameter #PAM is set in Section 4.B.3.a(9)(c) #echo "PASSLENGTH 8" >> /etc/login.defs #(FOUO) #4.B.3.a(9)(d) #Synopsis: Change Processes (periodic in case of compromise) # #KickStart Actions: None #(FOUO) #4.B.3.a(9)(e) #Synopsis: Aging of static authenticators. # #KickStart Actions: Change the password expiration time from undefined # to 60 days. Users cannot change passwords more than # once a day. #Experation time to 60 days. perl -npe 's/PASS_MAX_DAYS\s+99999/PASS_MAX_DAYS 60/' -i /etc/login.defs chage -M 60 root #Ensure that the user cannot change their password more than once a day. perl -npe 's/PASS_MIN_DAYS\s+0/PASS_MIN_DAYS 1/g' -i /etc/login.defs #(FOUO) #4.B.3.a(9)(f) #Synopsis: History of static authenticator changes, with assurance of # non-replication of individual authenticators, per directions # in approved SSP. # #KickStart Actions: opasswd file creation in /etc/security/opasswd # for non-replication. touch /etc/security/opasswd chmod 600 /etc/security/opasswd #(FOUO) #4.B.3.a(9)(g) #Synopsis: Protection of authenticators to perserve confidentiality and # integrity. Red Hat encrypts authenticators using the MD5 # Message Digest. # #KickStart Actions: Additional I&A Security. #(FOUO) #4.B.3.a(10) [I&A4] #Synopsis: Identification and Authentication. In those instances where the # the means of authentication is user-specified passwords, the ISSO # or ISSm may employ (under the auspices of the DAA) automated tools # to validate that the passwords are sufficiently strong to resist # cracking and other attacks intended to discover a users password. # #KickStart Actions: See 4.B.3.a(9)(c); specifically passwdqc #(FOUO) #4.B.3.a(11) [I&A5] #Synopsis: Identification and Authentication. In those instances where the # users are remotely accessing the system, the users shall employ # a strong authentication mechanism. # #KickStart Actions: By default ssh uses Triple DES. This script will edit # the /etc/ssh/ssh_config file to use stronger encryption. perl -npe 's/\#\s+Cipher\s+3des/Ciphers aes256-cbc/' -i /etc/ssh/ssh_config #(FOUO) #4.B.3.a(12) [LeastPrv] #Synopsis: Least Privilege procedures, including the assurance that each user # or process is granted the most restrictive set of privileges or # accesses needed for performance of authorized tasks shall be # employed. # #KickStart Actions: Restrict Root Logins and Least Privilege Enhancements. #Further restricting root logins cat << EOF > /etc/pam.d/su #%PAM-1.0 #auth sufficient /lib/security/$ISA/pam_rootok.so auth sufficient pam_rootok.so #Uncomment the following line to implicitly trust users in the "wheel" group. #auth sufficient pam_wheel.so trust use_uid #Uncomment the following line to require a user to be in the "wheel" group. auth required pam_wheel.so use_uid auth required pam_stack.so service=system-auth account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth #pam_selinux.so close must be first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth #pam_selinux.so open and pam_xauth must be last two session rules session required pam_selinux.so open multiple session optional pam_xauth.so EOF # You have to enter a Superuser PW when booting into single user mode echo "~~:S:wait:/sbin/sulogin" >> /etc/inittab #(FOUO) #4.B.3.a(13) [Marking] #Synopsis: Marking procedures and mechanisms to ensure that either the # user or the system itself marks all data transmitted or stored # by the system to reflect the sensitivity of the data. Markings # shall be retained with the data. # #KickStart Actions: None #(FOUO) #4.B.3.a(14) [ParamTrans] #Synopsis: Parameter Transmission. Security parameters shall be reliably # associated (either explicity or implicity) with information # exchanged between systems. # #KickStart Actions: None #(FOUO) #4.B.3.a(15) [Recovery] #Synopsis: Recovery procedures and technical system features to assure # that system recovery is done in a trusted and secure manner. # If any circumstances can cause an untrusted recovery, such # Circumstances shall be documented and appropriate mitigating # procedures shall be put in place. # #KickStart Actions: Centralized Time #Recovery and Audit need correct time stamps this was put here. #Could go in multiple places. # Pick a US-based clock server. Should be set to AGENCY NTP server perl -npe 's/^server.*/server clock\.ismc\.ic\.gov/g' -i /etc/ntp.conf #(FOUO) #4.B.3.a(16) [ResrcCtrl] #Synopsis: Resource Control. All authorizations to the information # contained within an object shall be revoked prior to # initial assignment, allocation, or reallocation to a subject # from the Security Support Structure's pool of unused objects. # No information including encrypted representations of # information, produced by a subject's actions is to be # available to any subject that obtains access to an object # that has been released back to the system. There must be no # residual data from the former object. # #KickStart Actions: None #(FOUO) #4.B.3.a(17) [ScrnLck] #Synopsis: Screen Lock. Unless there is an overriding technical or # operational problem, a screen-lock functionality shall be # associated with each computer. When activated, a screen-lock # function shall place an unclassified pattern onto the entire # screen, totally hiding what was previously visible on the # screen. Such a capability shall: # #KickStart Actions: None #(FOUO) #4.B.3.a(17)(a) #Synopsis: Be enabled either by explicit user action or if the system # is left idle for a specified period of time (e.g., 15 min # or more). # #KickStart Actions: Interactive Shell setting here. #Gnome screen-saver line command tool --> needs to be tested. #gconftool-2 --direct \ # --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ # --type int \ # --set /apps/gnome-screensaver/idle_delay 15 #(FOUO) #4.B.3.a(17)(b) #Synopsis: Ensure that once the security/screen-lock sofware is # activated, access to the system requires knowledge of a # unique authenticator. # #KickStart Actions: None #(FOUO) #4.B.3.a(17)(c) #Synopsis: Not be considered a substitute for logging out (unless a # mechanism actually logs out the user when the user idle # time is exceeded. # #KickStart Actions: None #(FOUO) #4.B.3.a(18) [Separation] #Synopsis: Separation of Roles. The functions of the ISSO and the # System Administrator shall not be performed by the same # person. # #KickStart Actions: None #(FOUO) #4.B.3.a(19) [SessCtrl1] #Synopsis: Session Controls, including: # #KickStart Actions: None #(FOUO) #4.B.3.a(19)(a) #Synopsis: User notification such that all IS users shall be # notified prior to gaining access to a system that system # usage may be monitored, recorded, and subject to audit. # Electronic means shall be employed where technically # feasible. # #KickStart Actions: See Section 4.B.3.a(19)(b) #(FOUO) #4.B.3.a(19)(b) #Synopsis: The user shall also be advised that use of the system # indicates (1) the consent of the user to such monitoring # and recording and (2) that unauthorized use is prohibited # and subject to criminal and civil penalities. Electronic # means shall be employed where technically feasible. # #KickStart Actions: Banner Settings #Set the /etc/issue file to the DoD login banner. This one has no linefeeds, #so it will wrap accordingly. cat </etc/issue THIS IS A DEPARTMENT OF DEFENSE COMPUTER SYSTEM. THIS COMPUTER SYSTEM, INCLUDING ALL RELATED EQUIPMENT, NETWORKS, AND NETWORK DEVICES (SPECIFICALLY INCLUDING INTERNET ACCESS), ARE PROVIDED ONLY FOR AUTHORIZED US GOVERNMENT USE. DOD COMPUTER SYSTEMS MAY BE MONITORED FOR ALL LAWFUL PURPOSES, INCLUDING TO ENSURE THEIR USE IS AUTHORIZED, FOR MANAGEMENT OF THE SYSTEM, TO FACILITATE PROTECTION AGAINST UNAUTHORIZED ACCESS, AND TO VERIFY SECURITY PROCEDURES, SURVIVABILITY, AND OPERATIONAL SECURITY. MONITORING INCLUDES ACTIVE ATTACKS BY AUTHORIZED DOD ENTITIES TO TEST OR VERIFY THE SECURITY OF THIS SYSTEM. DURING MONITORING, INFORMATION MAY BE EXAMINED, RECORDED, COPIED, AND USED FOR AUTHORIZED PURPOSES. ALL INFORMATION, INCLUDING PERSONAL INFORMATION, PLACED ON OR SENT OVER THIS SYSTEM, MAY BE MONITORED. USE OF THIS DOD COMPUTER SYSTEM, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES CONSENT TO MONITORING OF THIS SYSTEM. UNAUTHORIZED USE MAY SUBJECT YOU TO CRIMINAL PROSECUTION. EVIDENCE OF UNAUTHORIZED USE COLLECTED DURING MONITORING MAY BE USED FOR ADMINISTRATIVE, CRIMINAL, OR OTHER ADVERSE ACTION. USE OF THIS SYSTEM CONSTITUTES CONSENT TO MONITORING FOR THESE PURPOSES. EOF #This part creates the same login banner once your username and password has #been entered. This has linefeeds in it. cat </etc/X11/gdm/PreSession/Default #!/bin/sh # # Note that any setup should come before the sessreg command as # that must be 'exec'ed for the pid to be correct (sessreg uses the parent # pid) # # Note that output goes into the .xsession-errors file for easy debugging # PATH="/usr/bin/X11:/usr/X11R6/bin:/opt/X11R6/bin:$PATH:/bin:/usr/bin" /usr/bin/gdialog --yesno "THIS IS A DEPARTMENT OF DEFENSE COMPUTER SYSTEM. THIS COMPUTER SYSTEM, INCLUDING ALL RELATED EQUIPMENT, NETWORKS, AND NETWORK DEVICES (SPECIFICALLY INCLUDING INTERNET ACCESS), ARE PROVIDED ONLY FOR AUTHORIZED US GOVERNMENT USE. DOD COMPUTER SYSTEMS MAY BE MONITORED FOR ALL LAWFUL PURPOSES, INCLUDING TO ENSURE THEIR USE IS AUTHORIZED, FOR MANAGEMENT OF THE SYSTEM, TO FACILITATE PROTECTION AGAINST UNAUTHORIZED ACCESS, AND TO VERIFY SECURITY PROCEDURES, SURVIVABILITY, AND OPERATIONAL SECURITY. MONITORING INCLUDES ACTIVE ATTACKS BY AUTHORIZED DOD ENTITIES TO TEST OR VERIFY THE SECURITY OF THIS SYSTEM. DURING MONITORING, INFORMATION MAY BE EXAMINED, RECORDED, COPIED, AND USED FOR AUTHORIZED PURPOSES. ALL INFORMATION, INCLUDING PERSONAL INFORMATION, PLACED ON OR SENT OVER THIS SYSTEM, MAY BE MONITORED. USE OF THIS DOD COMPUTER SYSTEM, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES CONSENT TO MONITORING OF THIS SYSTEM. UNAUTHORIZED USE MAY SUBJECT YOU TO CRIMINAL PROSECUTION. EVIDENCE OF UNAUTHORIZED USE COLLECTED DURING MONITORING MAY BE USED FOR ADMINISTRATIVE, CRIMINAL, OR OTHER ADVERSE ACTION. USE OF THIS SYSTEM CONSTITUTES CONSENT TO MONITORING FOR THESE PURPOSES." if ( test 1 -eq \$? ); then gdialog --infobox "Logging out in 10 Seconds" 1 20 & sleep 10 exit 1 fi gdmwhich () { COMMAND="$1" OUTPUT= IFS=: for dir in $PATH do if test -x "$dir/$COMMAND" ; then if test "x$OUTPUT" = "x" ; then OUTPUT="$dir/$COMMAND" fi fi done unset IFS echo "$OUTPUT" } XSETROOT=\`gdmwhich xsetroot\` if [ "x$XSETROOT" != "x" ] ; then # Try to snarf the BackgroundColor from the config file BACKCOLOR=`grep '^BackgroundColor' /etc/X11/gdm/gdm.conf | sed 's/^.*=\(.*\)$/\1/'` if [ "x$BACKCOLOR" = "x" ]; then BACKCOLOR="#76848F" fi "$XSETROOT" -cursor_name left_ptr -solid "$BACKCOLOR" fi SESSREG=\`gdmwhich sessreg\` if [ "x$SESSREG" != "x" ] ; then # some output for easy debugging echo "$0: Registering your session with wtmp and utmp" echo "$0: running: $SESSREG -a -w /var/log/wtmp -u /var/run/utmp -x \"$X_SERVERS\" -h \"$REMOTE_HOST\" -l \"$DISPLAY\" \"$USER\"" exec "$SESSREG" -a -w /var/log/wtmp -u /var/run/utmp -x "$X_SERVERS" -h "$REMOTE_HOST" -l "$DISPLAY" "$USER" # this is not reached fi #Some output for easy debugging echo "$0: could not find the sessreg utility, cannot update wtmp and utmp" exit 0 EOF #/etc/ssh/sshd_config banner settings perl -npe 's/^#Banner \/some\/path/Banner \/etc\/issue/g' -i /etc/ssh/sshd_config #(FOUO) #4.B.3.a(20) [SessCtrl2] #Synopsis: Enforcement of Session Controls, including: # #KickStart Actions: None #(FOUO) #4.B.3.a(20)(a) #Synopsis: Procedures for controlling and auditing concurrent logons from # different workstations. # #KickStart Actions: None #(FOUO) #4.B.3.a(20)(b) #Synopsis: Staton or session time-outs, as applicable. # #KickStart Actions: None #Set an inactive shell timeout - likely going away in March STIG echo "TMOUT=900" >> /etc/profile #(FOUO) #4.B.3.a(20)(c) #Synopsis: Limited retry on logon as technically feasible. # #KickStart Actions: None #Users get five attempts to enter their password each login attempt echo "LOGIN_RETRIES 3" >> /etc/login.defs #Make the user wait four seconds if they fail after LOGIN_RETRIES echo "FAIL_DELAY 900" >> /etc/login.defs #(FOUO) #4.B.3.a(20)(d) #Synopsis: System actions on unsuccessful logons (e.g., blacklisting of # the terminal or user identifier). # #KickStart Actions: None #(FOUO) #4.B.3.a(21) [Storage] #Synopsis: Data Storage, implementing at least one of the following: # #KickStart Actions: None #(FOUO) #4.B.3.a(21)(a) #Synopsis: Information stored in an area approved for open storage of # the information. # #KickStart Actions: None #(FOUO) #4.B.3.a(21)(b) #Synopsis: Information stored in an area for continuous personnel access # control (24/7). # #KickStart Actions: None #(FOUO) #4.B.3.a(21)(c) #Synopsis: Information secured as appropriate for closed storage. # #KickStart Actions: None #(FOUO) #4.B.3.a(21)(d) #Synopsis: Information encrypted using NSA-approved encryption mechanisms # appropriate for the classification of stored data. # #KickStart Actions: None #Will need to down load an encryption package like "secret agent" #(FOUO) #4.B.3.a(22) [Trans1] #Synopsis: Data Transmission # #KickStart Actions: None #(FOUO) #4.B.3.a(22)(a) #Synopsis: Data transmission that implements at least one of the following. # #KickStart Actions: None #(FOUO) #4.B.3.a(22)(a)(1) #Synopsis: Information distributed only within an area approved for # open storage of the information. # #KickStart Actions: None #(FOUO) #4.B.3.a(22)(a)(2) #Synopsis: Information distributed via a Proteced Distributed System # (PDS). # #KickStart Actions: None #(FOUO) #4.B.3.a(22)(a)(3) #Synopsis: Information distributed using NSA-approved encryption # mechanisms appropriate for the classification of # information. # #KickStart Actions: echo 'Ciphers aes256-cbc,aes192-cbc,blowfish-cbc,cast128-cbc,aes128-cbc,3des-cbc' >> /etc/ssh/ssh_config #(FOUO) #4.B.3.a(22)(a)(4) #Synopsis: Information distributed using a trusted courier. # #KickStart Actions: None #(FOUO) #4.B.3.a(22)(b) #Synopsis: Data lines, other than those that are protected with nationally # certified crypographic devices or PDSs, shall not be used for # gaining access to system resources that process intelligence # information unless the DAA provides specific written # authorization for a system to operate in this manner. # #KickStart Actions: None #(FOUO) #DCID 6/3 PL3 #4.B.3 Protection Level 3 #4.B.3.b(1) [Doc1] #Synopsis: Documentation shall include: # #KickStart Actions: None #(FOUO) #4.B.3.b(1)(a) #Synopsis: A System Security Plan. # #KickStart Actions: None #(FOUO) #4.B.3.b(1)(b) #Synopsis: SECCONOP. # #KickStart Actions: None #(FOUO) #4.B.3.b(2) [Doc2] #Synopsis: Documentation shall include guide(s) or manual(s) for the systems # privileged users (PUG). # #KickStart Actions: None #(FOUO) #4.B.3.b(3) [Doc3] #Synopsis: Documentation shall include: # #KickStart Actions: None #(FOUO) #4.B.3.b(3)(a) #Synopsis: Certification test plans and procedures detailing the # implmentation of the features and assurances for the # required Protection Level. # #KickStart Actions: None #(FOUO) #4.B.3.b(3)(b) #Synopsis: Reports of test results. # #KickStart Actions: None #(FOUO) #4.B.3.b(3)(c) #Synopsis: A general user's guide that describes the protection # mechanisms provided, and that supplies guidlines on how # the mechanisms are to be used, and how they interact. # #KickStart Actions: None #(FOUO) #4.B.3.b(4) [SysAssur1] #Synopsis: System Assurance shall include: # #KickStart Actions: None #(FOUO) #4.B.3.b(4)(a) #Synopsis: Features and procedures to validate the integrity and the # expected operation of the security-relevant software # hardware, and firmware. # #KickStart Actions: Expected Operations #Max Number of Remembered Connection Requests echo "net.ipv4.tcp_max_syn_backlog = 1280" >> /etc/sysctl.conf #ICMP ECHO Request Protection echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf #Reject incoming packets if their source address doesn't match the #network interface that they're arriving on, which helps to prevent #IP spoofing echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf #Disables IP Source Routing echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf #This effectively prevents any non-root user from running traceroute chmod 700 /usr/sbin/traceroute #Turn off xinetd chkconfig xinetd off # Turn off unneeded services chkconfig bluetooth off chkconfig cups off chkconfig cups-config-daemon off chkconfig irda off chkconfig lm_sensors off chkconfig portmap off chkconfig rawdevices off chkconfig rpcgssd off chkconfig rpcidmapd off chkconfig rpcsvcgssd off chkconfig sendmail off #/etc/xinetd.conf perms settings chmod 440 /etc/xinetd.conf #(FOUO) #4.B.3.b(4)(b) #Synopsis: Features or procedures for protection of the operating # system from improper changes. # #KickStart Actions: Actions Listed Below #Direct root logins are only allowed via tty1 echo "tty1" > /etc/securetty #Correct the Red Hat supplied modes on these directories chmod 750 /var/crash /var/www/usage /usr/libexec/dovecot #Change all user files to mode 700 find /home -name '.*' -type f -exec chmod -R 700 {} \; find /root -name '.*' -type f -exec chmod -R 700 {} \; #Script to create symlinks for dangerous files for file in /root/.rhosts /root/.shosts /etc/hosts.equiv do rm -f $file ln -s /dev/null $file done #World Writable files for part in `awk'($3== "ext2" || $3 == "ext3") \ { print $2 }' /etc/fstab` do find $part -xdev -type f -perm -0002 -print > /root/system.ww.txt gzip --best /root/system.ww.`date +%Y:%m:d`.txt done #SUID | SGID files for part in `awk'($3== "ext2" || $3 == "ext3") \ { print $2 }' /etc/fstab` do find $part -xdev -type f -04000 -o -perm -02000 -print > /root/system.suid-sgid.txt gzip --best /root/system.suid-sgid.`date +%Y:%m:%d`.txt done #Set up tcpwrappers, only ssh traffic is allowed in by default echo "ALL:ALL" >> /etc/hosts.deny echo "sshd:ALL" >> /etc/hosts.allow #No one gets to run cron jobs unless we say they can touch /etc/cron.allow awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/cron.deny #No one gets to run at jobs unless we say they can touch /etc/at.allow chmod 600 /etc/at.allow awk -F: '{print $1}' /etc/passwd | grep -v root > /etc/at.deny #We need to restrict ssh root logins; meaningless, because root #can only login to tty1 perl -npe 's/#PermitRootLogin yes/PermitRootLogin no/' -i /etc/ssh/sshd_config #Check local device files against baseline #as a note, it may be sufficient to do a rpm --verify on the associated #block device packabes (devfs?) find /dev -type b -or -type c -or -type s >> /root/blockdevices.`date +%Y:%m:%d644`.txt #Reset the umasks for all users to 077 perl -npe 's/umask\s+0\d2/umask 077/g' -i /etc/bashrc perl -npe 's/umask\s+0\d2/umask 077/g' -i /etc/profile perl -npe 's/umask\s+0\d2/umask 077/g' -i /etc/csh.cshrc #Correct the perms on /root to a DISA allowed 700 chmod 700 /root #iptable perms settings chmod 700 /etc/rc.d/init.d/iptables chmod 700 /sbin/iptables chmod 700 /usr/share/logwatch/scripts/services/iptables #/etc/skel perms settings chmod -R 700 /etc/skel #/usr/share/man perms settings find /usr/share/man -type f -not -perm 644 -exec chmod 644 {} \; #/usr/share/doc perms settings find /usr/share/doc -type f -exec chmod 644 {} \; #/etc/crontab and /etc/log.d/scripts/logwatch.pl perms settings chmod 600 /etc/crontab chmod 700 /etc/log.d/scripts/logwatch.pl #Change all pre-installed system cron jobs to DISA-blessed mode rwx------ #Some files in here are scripts, though-- find /etc/cron.*/ -type f -exec chmod 700 {} \; #/var/crash perms settings chmod 700 /var/crash #Sendmail Protection: Comment out HelpFile flag perl -npe 's/O\s+HelpFile/#O HelpFile/g' -i /etc/mail/sendmail.cf #Sendmail Protection: SmtpGreetingMessage string setting perl -npe 's/O\s+SmtpGreetingMessage=.*/O SmtpGreetingMessage=OneDotOneDotOneDotOneDotNunyo-Business/' -i /etc/mail/sendmail.cf #/etc/snmp/snmpd.conf group setting change chgrp sys /etc/snmp/snmpd.conf #X Settings perl -npe 's/^defaultserverargs=""/defaultserverargs="-s 15 -audit -auth"/' -i /usr/X11R6/bin/startx #/etc/sysctl.conf perms settings chmod 600 /etc/sysctl.conf #Do not allow CTRL ALT DEL command to shutdown the system perl -npe 's/ca::ctrlaltdel:\/sbin\/shutdown/#ca::ctrlaltdel:\/sbin\/shutdown/' -i /etc/inittab #/dev/*ty* perms settings find /dev -name "*ty*" -exec chmod 700 {} \; #Delete the following users for protection of the operating system. for i in shutdown halt games operator ftp news gopher do userdel $i done #Sendmail Vulnerability with the "decode" alias set in /etc/aliases (turn off) perl -npe 's/^decode/#decode/' -i /etc/aliases newaliases #Change the mode of the maillog file to a DISA-blessed rw------- chmod 600 /var/log/maillog #/etc/security/access.conf perms settings for DISA #Set mode to DISA-blessed rw-r------ chmod 640 /etc/security/access.conf #Need to check on all proper X Server Secuity Settings to Meet DCID 6/3 #check proper X server options #Set the /etc/samba.conf file #This will create an attribute so that the /etc/samba/smb.conf file cannot be #modified. It cannot be deleted or remaned, a link cannot be created to this #file, and no data can be written to the the file. chattr +i /etc/samba/smb.conf #If we're not running an POP/IMAP server, remove the user dovecot rpm -q dovecot 2>&1 > /dev/null if [ $? = "1" ] then userdel dovecot else echo "dovecot package installed, not deleting user dovecot" fi #If we're not running named, delete the user rpm -q bind 2>&1 > /dev/null if [ $? = "1" ] then userdel named else echo "bind package installed, not deleting user named" fi #(FOUO) #4.B.3.b(5) [SysAssur2] #Synopsis: System Assurance shall include: # #KickStart Actions: None #(FOUO) #4.B.3.b(5)(a) #Synopsis: Controls of access to the Security Support Structure # (i.e, software hardware, and firmware that perform # operating system or security functions). # #KickStart Actions: None #(FOUO) #4.B.3.b(5)(b) #Synopsis: Assurance of the integrity of the Security Support # Structure. # #KickStart Actions: None #(FOUO) #4.B.3.b(6) [SysAssur3] #Synopsis: System Assurance shall include: # #KickStart Actions: None #(FOUO) #4.B.3.b(6)(a) #Synopsis: Isolating the Security Support Structure by means of # partitions, domains, etc., including control of access # to, and integrity of, hardware, and software and firmware # that perform security functions. # #KickStart Actions: None #(FOUO) #4.B.3.b(6)(b) #Synopsis: Using up-to-date vulnerability assessment tools to validate # the continued integrity of the Security Support Structure # by ensuring that the system configuration does not contain # any well-known security vulnerabilities. # #KickStart Actions: None #(FOUO) #4.B.3.b(7) [Test2] #Synopsis: The ISSM shall provide written verification to the DAA that the # system operates in accordance with the approved SSP, and that the # security features, including access controls, configuration # management, and discretionalry access controls, are implemented # and operational. # #KickStart Actions: None #(FOUO) #4.B.3.b(8) [Test3] #Synopsis: Additional Testing: # #KickStart Actions: None #(FOUO) #4.B.3.b(8)(a) #Synopsis: Certification testing shall be conducted including verification # that the features and assurance required for the Protection Level # are functional. # #KickStart Actions: None #(FOUO) #4.B.3.b(8)(b) #Synopsis: A test plan and procedures shall be developed and include: # #KickStart Actions: None #(FOUO) #4.B.3.b(8)(b)(1) #Synopsis: A detailed description of the manner in which the system's # Security Support Structure meets the technical requirements # for the Protection Levels and Levels-of-Concern for integrity # and availability. # #KickStart Actions: None #(FOUO) #4.B.3.b(8)(b)(2) #Synopsis: A detailed description of the assurances that have been implemented # and how this implementation will be verified. # #KickStart Actions: None #(FOUO) #4.B.3.b(8)(b)(3) #Synopsis: An outline of the inspection and test procedures used to verify this # compliance. # #KickStart Actions: None #(FOUO) #4.B.3.b(9) [Test4] #Synopsis: Testing, as required by the DAA: # #KickStart Actions: None #(FOUO) #4.B.3.b(9)(a) #Synopsis: Security Penetration Testing shall be conducted to determine the level # of difficulty in penetrating the security countermeasures of the # system. # #KickStart Actions: None #(FOUO) #4.B.3.b(9)(b) #Synopsis: An Independent Validaton and Verification team shall be formed to # assist in the security testing and to perform validaton and # verification testing of the system. # #KickStart Actions: None #Give us a way in for testing, otherwise, log in to tty1 as root, and create your own account #useradd redhat #echo "red.hat" | passwd --stdin redhat #usermod -g wheel redhat # # ############################################################################### ############################################################################### #POST INSTALLATION INSTALLS AND CONFIGURATIONS echo "" echo "Installing RHEL Updates... Please be patient" echo "" # # #Change Background and Wallpaper rm -f /usr/share/backgrounds/images/default.png cp -fa /root/DoDIIS/DoDIISsci.png /usr/share/backgrounds/images/default.png rm -f /usr/share/gdm/themes/RHEL/background.png cp -fa /root/DoDIIS/background.png /usr/share/gdm/themes/RHEL/background.png # # # #Install Bastille and dependent files # # MY_RPMS=/root/DoDIIS # rpm -i $MY_RPMS/jre-1_5_0_11-linux-i586.rpm # rpm -i $MY_RPMS/sav-1.0.1-66.i386.rpm # rpm -i $MY_RPMS/savap-1.0.1-66.i386.rpm # rpm -i $MY_RPMS/savjlu-1.0.1-66.i386.rpm # rpm -i $MY_RPMS/savui-1.0.1-66.i386.rpm # rpm -i $MY_RPMS/perl-Curses-1.12-1.2.el4.rf.i386.rpm # rpm -i $MY_RPMS/perl-Tk-804.027-3.2.el4.rf.i386.rpm # rpm -i $MY_RPMS/Bastille-3.0.9-1.0.noarch.rpm # # # Update our RPM's with the lastest updates # rpm -F $MY_RPMS/errata/*.rpm # # # #Run Bastille to lockdown system further # LOG=/root/bastille-lockdown.log # /bin/touch $LOG # cp -f /root/DoDIIS/config-bastille /etc/Bastille/config 2>&1 | tee -a $LOG # chown root:root /etc/Bastille/config # /usr/sbin/bastille -n -b 2>&1 | tee -a $LOG # # # #Set permissions on DoDIIS Directory # chmod 0700 /root/DoDIIS # # # ############################################################################# ############################################################################# #GEN001260 (Needs to be at bottom, as it somehow gets reset) --note that the #culprit doing the reset is /etc/rc.d/rc.sysinit. I need to find out why find /var/log/ -type f -not -perm 644 -exec chmod 644 {} \; #eject #EOF# ############################## #END OF KICKSTART FILE POST SETTINGS