Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
rhel6/src/input/system/network/kernel.xml | 242 ++++++++++++++---------------
rhel6/src/transforms/shorthand2xccdf.xslt | 15 ++
2 files changed, 135 insertions(+), 122 deletions(-)
diff --git a/rhel6/src/input/system/network/kernel.xml
b/rhel6/src/input/system/network/kernel.xml
index 9a3baca..a9eebd8 100644
--- a/rhel6/src/input/system/network/kernel.xml
+++ b/rhel6/src/input/system/network/kernel.xml
@@ -1,46 +1,50 @@
<Group id="network-kernel">
<title>Kernel Parameters Which Affect Networking</title>
-<description>The <tt>sysctl</tt> utility is used to set a number of
-parameters which affect the operation of the Linux kernel. Several
-of these parameters are specific to networking, and the
-configuration options in this section are recommended.</description>
+<description>The <tt>sysctl</tt> utility is used to set
+parameters which affect the operation of the Linux kernel. Kernel parameters
+which affect networking and have security implications are described here.
+</description>
<Group id="network_host_parameters">
<title>Network Parameters for Hosts Only</title>
-<description>Is this system going to be used as a firewall or
-gateway to pass IP traffic between different networks?
-<br />If not, edit the file <tt>/etc/sysctl.conf</tt> and add or
-correct the following lines:
-<pre>net.ipv4.ip_forward = 0
-net.ipv4.conf.all.send_redirects = 0
-net.ipv4.conf.default.send_redirects = 0</pre>
-These settings disable hosts from performing network
-functionality which is only appropriate for routers.</description>
+<description>If the system is not going to be used as a router, then certain
+kernel parameters should be set to ensure that the host will not perform routing
+of network traffic.</description>
<Rule id="disable_sysctl_ipv4_default_send_redirects">
-<title>Disable net.ipv4.conf.default.send_redirects Kernel Runtime
Parameter</title>
-<description>The default setting for sending ICMP redirects should
-be disabled for network interfaces.</description>
-<rationale>This setting is only appropriate for routers and it should be disabled
on all other systems.</rationale>
+<title>Disable Kernel Parameter for Sending ICMP Redirects by
Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.send_redirects"
value="0" />
+</description>
+<rationale>Sending ICMP redirects permits the system to instruct other systems
+to update their routing information. The ability to send ICMP redirects is
+only appropriate for routers.</rationale>
<ident cce="4151-7" />
<oval id="sysctl_net_ipv4_conf_default_send_redirects" />
<ref nist="AC-4, SC-5, SC-7" />
</Rule>
<Rule id="disable_sysctl_ipv4_all_send_redirects">
-<title>Disable net.ipv4.conf.all.send_redirects Kernel Runtime
Parameter</title>
-<description>Sending ICMP redirects should be disabled for all
interfaces.</description>
-<rationale>This setting is only appropriate for routers and it should be disabled
on all other systems.</rationale>
+<title>Disable Kernel Parameter for Sending ICMP Redirects for All
Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.send_redirects"
value="0" />
+</description>
+<rationale>Sending ICMP redirects permits the system to instruct other systems
+to update their routing information. The ability to send ICMP redirects is
+only appropriate for routers.</rationale>
<ident cce="4155-8" />
<oval id="sysctl_net_ipv4_conf_all_send_redirects" />
<ref nist="CM-6" />
</Rule>
<Rule id="disable_sysctl_ipv4_ip_forward">
-<title>Disable net.ipv4.ip_forward Kernel Runtime Parameter</title>
-<description>IP forwarding should be disabled.</description>
-<rationale>The ability to forward packets between two networks is only appropriate
for routers. This setting
-should be disabled on all other systems.</rationale>
+<title>Disable Kernel Parameter for IP Forwarding</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.ip_forward" value="0" />
+</description>
+<rationale>IP forwarding permits the kernel to forward packets from one network
+interface to another. The ability to forward packets between two networks is
+only appropriate for routers.</rationale>
<ident cce="3561-8" />
<oval id="sysctl_net_ipv4_ip_forward" />
<ref nist="AC-3, CM-6, CM-7, SC-5" />
@@ -48,24 +52,10 @@ should be disabled on all other systems.</rationale>
</Group>
<Group id="network_host_and_router_parameters">
-<title>Set Network Related Kernel Runtime Parameters</title>
-<description>Edit the file <tt>/etc/sysctl.conf</tt> and add or correct
the
-following lines:
-<pre>net.ipv4.conf.all.accept_source_route = 0
-net.ipv4.conf.all.accept_redirects = 0
-net.ipv4.conf.all.secure_redirects = 0
-net.ipv4.conf.all.log_martians = 1
-net.ipv4.conf.default.accept_source_route = 0
-net.ipv4.conf.default.accept_redirects = 0
-net.ipv4.conf.default.secure_redirects = 0
-net.ipv4.icmp_echo_ignore_broadcasts = 1
-net.ipv4.icmp_ignore_bogus_error_messages = 1
-net.ipv4.tcp_syncookies = 1
-net.ipv4.conf.all.rp_filter = 1
-net.ipv4.conf.default.rp_filter = 1</pre>
-These options improve Linux's ability to defend against
-certain types of IPv4 protocol attacks.
-</description>
+<title>Network Related Kernel Runtime Parameters for Hosts and
Routers</title>
+<description>Certain kernel parameters should be set for systems which are
+acting as either hosts or routers to improve the system's ability defend
+against certain types of IPv4 protocol attacks.</description>
<Value id="sysctl_net_ipv4_conf_all_accept_source_route_value"
type="string"
operator="equals" interactive="0">
@@ -151,11 +141,10 @@ via broadcast/multicast</description>
</Value>
-<Value id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value"
type="string"
+<Value id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"
type="string"
operator="equals" interactive="0">
-<title>net.ipv4.icmp_ignore_bogus_error_messages</title>
-<description>Enable to prevent certain types of
-attacks</description>
+<title>net.ipv4.icmp_ignore_bogus_error_responses</title>
+<description>Enable to prevent unnecessary logging</description>
<value selector="">1</value>
<value selector="enabled">1</value>
<value selector="disabled">0</value>
@@ -197,11 +186,11 @@ operator="equals" interactive="0">
</Value>
<Rule id="set_sysctl_net_ipv4_conf_all_accept_source_route">
-<title>Set net.ipv4.conf.all.accept_source_route Kernel Runtime
Parameter</title>
-<description>Accepting source routed packets should be:
-<sub idref="sysctl_net_ipv4_conf_all_accept_source_route_value" />for all
interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
+<title>Disable Kernel Parameter for Accepting Source-Routed Packets for All
Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route"
value="0" />
+</description>
+<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="4236-6" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route"
value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
@@ -209,11 +198,11 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_all_accept_redirects">
-<title>Set net.ipv4.conf.all.accept_redirects Kernel Runtime
Parameter</title>
-<description>Accepting ICMP redirects should be:
-<sub idref="sysctl_net_ipv4_conf_all_accept_redirects_value" />for all
interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
+<title>Disable Kernel Parameter for Accepting ICMP Redirects for All
Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_redirects"
value="0" />
+</description>
+<rationale>Accepting ICMP redirects has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="4217-6" />
<oval id="sysctl_net_ipv4_conf_all_accept_redirects"
value="sysctl_net_ipv4_conf_all_accept_redirects_value" />
@@ -222,26 +211,27 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<Rule id="set_sysctl_net_ipv4_conf_all_secure_redirects">
-<title>Set net.ipv4.conf.all.secure_redirects Kernel Runtime
Parameter</title>
-<description>Accepting "secure" ICMP redirects (those from gateways
-listed in the default gateways list) should be:
-<sub idref="sysctl_net_ipv4_conf_all_secure_redirects_value" />for all
interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
-uses. It should be disabled unless it is absolutely required.</rationale>
+<title>Disable Kernel Parameter for Accepting Secure Redirects for All
Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.secure_redirects"
value="0" />
+</description>
+<rationale>Accepting "secure" ICMP redirects (from those gateways listed
as
+default gateways) has few legitimate uses. It should be disabled unless it is
+absolutely required.</rationale>
<ident cce="3472-8" />
<oval id="sysctl_net_ipv4_conf_all_secure_redirects"
value="sysctl_net_ipv4_conf_all_secure_redirects_value" />
<ref nist="CM-7, AC-4" />
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_all_log_martians">
-<title>Set net.ipv4.conf.all.log_martians Kernel Runtime Parameter</title>
-<description>Logging of "martian" packets (those with impossible
-addresses) should be:
-<sub idref="sysctl_net_ipv4_conf_all_log_martians_value" />for all
interfaces
-as appropriate.</description>
-<rationale>The presence of suspicious packets, such as spoofed packets,
source-routed packets, and redirects
-could be a sign of nefarious network activity. Logging these packets enables this
activity to be detected.</rationale>
+<title>Enable Kernel Parameter to Log Martian Packets</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.log_martians"
value="1" />
+</description>
+<rationale>The presence of "martian" packets (which have impossible
addresses)
+as well as spoofed packets, source-routed packets, and redirects could be a
+sign of nefarious network activity. Logging these packets enables this activity
+to be detected.</rationale>
<ident cce="4320-8" />
<oval id="sysctl_net_ipv4_conf_all_log_martians"
value="sysctl_net_ipv4_conf_all_log_martians_value" />
<ref nist="CM-7" />
@@ -249,12 +239,11 @@ could be a sign of nefarious network activity. Logging these packets
enables thi
<Rule id="set_sysctl_net_ipv4_conf_default_accept_source_route">
-<title>Set net.ipv4.conf.default.accept_source_route Kernel Runtime
Parameter</title>
-<description>The default setting for accepting source routed
-packets should be:
-<sub idref="sysctl_net_ipv4_conf_default_accept_source_route_value" />for
all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
+<title>Disable Kernel Parameter for Accepting Source-Routed Packets By
Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_source_route"
value="0" />
+</description>
+<rationale>Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="4091-5" />
<oval id="sysctl_net_ipv4_conf_all_accept_source_route"
value="sysctl_net_ipv4_conf_all_accept_source_route_value" />
@@ -263,11 +252,10 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<Rule id="set_sysctl_net_ipv4_conf_default_accept_redirects">
-<title>Set net.ipv4.conf.default.accept_redirects Kernel Runtime
Parameter</title>
-<description>The default setting for accepting ICMP redirects
-should be:
-<sub idref="sysctl_net_ipv4_conf_default_accept_redirects_value" />for
all interfaces
-as appropriate.</description>
+<title>Disable Kernel Parameter for Accepting ICMP Redirects By
Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.accept_redirects"
value="0" />
+</description>
<rationale>This feature of the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
<ident cce="4186-3" />
@@ -277,14 +265,13 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<Rule id="set_sysctl_net_ipv4_conf_default_secure_redirects">
-<title>Set net.ipv4.conf.default.secure_redirects Kernel Runtime
Parameter</title>
-<description>The default setting for accepting "secure" ICMP
-redirects (those from gateways listed in the default gateways list)
-should be:
-<sub idref="sysctl_net_ipv4_conf_default_secure_redirects_value" />for
all interfaces
-as appropriate.</description>
-<rationale>This feature of the IPv4 protocol has few legitimate
-uses. It should be disabled unless it is absolutely required.</rationale>
+<title>Disable Kernel Parameter for Accepting Secure Redirects By
Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.secure_redirects"
value="0" />
+</description>
+<rationale>Accepting "secure" ICMP redirects (from those gateways listed
as
+default gateways) has few legitimate uses. It should be disabled unless it is
+absolutely required.</rationale>
<ident cce="3339-9" />
<oval id="sysctl_net_ipv4_conf_default_secure_redirects"
value="sysctl_net_ipv4_conf_default_secure_redirects_value" />
<ref nist="AC-4, SC-5, SC-7" />
@@ -292,62 +279,73 @@ uses. It should be disabled unless it is absolutely
required.</rationale>
<Rule id="set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts">
-<title>Set net.ipv4.icmp_echo_ignore_broadcasts Kernel Runtime
Parameter</title>
-<description>Ignoring ICMP echo requests (pings) sent to broadcast
-/ multicast addresses should be:
-<sub idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />for all
interfaces
-as appropriate.</description>
-<rationale>This setting prevents attacks against the ICMP
protocol.</rationale>
+<title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo
Requests</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.icmp_echo_ignore_broadcasts"
value="1" />
+</description>
+<rationale>Ignoring ICMP echo requests (pings) sent to broadcast or multicast
+addresses makes the system slightly more difficult to enumerate on the network.
+</rationale>
<ident cce="3644-2" />
<oval id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"
value="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" />
</Rule>
-<Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_messages">
-<title>Set net.ipv4.icmp_ignore_bogus_error_messages Kernel Runtime
Parameter</title>
-<description>Ignoring bogus ICMP responses to broadcasts should be:
-<sub idref="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" />for
all interfaces
-as appropriate.</description>
-<rationale>This setting prevents attacks against the ICMP
protocol.</rationale>
+<Rule id="set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses">
+<title>Enable Kernel Parameter to Ignore Bogus ICMP Error Messages</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.icmp_ignore_bogus_error_responses"
value="1" />
+</description>
+<rationale>Ignoring bogus ICMP error responses reduces
+log size, although some activity would not be logged.</rationale>
<ident cce="4133-5" />
-<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_messages"
value="sysctl_net_ipv4_icmp_ignore_bogus_error_messages_value" />
+<oval id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"
value="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" />
<ref nist="AC-3, CM-6, CM-7, SC-5" />
</Rule>
<Rule id="set_sysctl_net_ipv4_tcp_syncookies">
-<title>Set net.ipv4.tcp_syncookies Kernel Runtime Parameter</title>
-<description>Sending TCP syncookies should be:
-<sub idref="sysctl_net_ipv4_tcp_syncookies_value" />for all interfaces
-as appropriate.</description>
-<rationale>This setting enables a cryptographic feature called SYN cookies to allow
machines to continue to
-accept legitimate connections when faced with a SYN flood attack.</rationale>
+<title>Enable Kernel Parameter to Use TCP Syncookies</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1"
/>
+</description>
+<rationale> A TCP SYN flood attack can cause a denial of service by filling a
+system's TCP connection table with connections in the SYN_RCVD state.
+Syncookies can be used to track a connection when a subsequent ACK is received,
+verifying the initiator is attempting a valid connection and is not a flood
+source. This feature is activated when a flood condition is detected, and
+enables the system to continue servicing valid connection requests.
+</rationale>
<ident cce="4265-5" />
<oval id="sysctl_net_ipv4_tcp_syncookies"
value="sysctl_net_ipv4_tcp_syncookies_value" />
<ref nist="CM-6, CM-7" />
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_all_rp_filter">
-<title>Set net.ipv4.conf.all.rp_filter Kernel Runtime Parameter</title>
-<description>Performing source validation by reverse path should
-be:
-<sub idref="sysctl_net_ipv4_conf_all_rp_filter_value" />for all
interfaces
-as appropriate.</description>
-<rationale>This setting enables RFC-recommended source validation. It should not be
used on machines which
-are routers for very complicated networks, but is helpful for end hosts and routers
serving small networks.</rationale>
+<title>Enable Kernel Parameter to Use Reverse Path Filtering for All
Interfaces</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.all.rp_filter" value="1"
/>
+</description>
+<rationale>Enabling reverse path filtering drops packets with source addresses
+that should not have been able to be received on the interface they were
+received on. It should not be used on systems which are routers for
+complicated networks, but is helpful for end hosts and routers serving small
+networks.</rationale>
<ident cce="4080-8" />
<oval id="sysctl_net_ipv4_conf_all_rp_filter"
value="sysctl_net_ipv4_conf_all_rp_filter_value" />
<ref nist="AC-4, SC-5, SC-7" />
</Rule>
<Rule id="set_sysctl_net_ipv4_conf_default_rp_filter">
-<title>Set net.ipv4.conf.default.rp_filter Kernel Runtime Parameter</title>
-<description>The default setting for performing source validation
-by reverse path should be:
-<sub idref="sysctl_net_ipv4_conf_default_rp_filter_value" />for all
interfaces
-as appropriate.</description>
-<rationale>This setting enables RFC-recommended source validation. It should not be
used on machines which
-are routers for very complicated networks, but is helpful for end hosts and routers
serving small networks.</rationale>
+<title>Enable Kernel Parameter to Use Reverse Path Filtering by
Default</title>
+<description>
+<sysctl-desc-macro sysctl="net.ipv4.conf.default.rp_filter"
value="1" />
+</description>
+<rationale>Enabling reverse path filtering drops packets with source addresses
+that should not have been able to be received on the interface they were
+received on. It should not be used on systems which are routers for
+complicated networks, but is helpful for end hosts and routers serving small
+networks.</rationale>
<ident cce="3840-6" />
<oval id="sysctl_net_ipv4_conf_default_rp_filter"
value="sysctl_net_ipv4_conf_default_rp_filter_value" />
<ref nist="AC-4, SC-5, SC-7" />
diff --git a/rhel6/src/transforms/shorthand2xccdf.xslt
b/rhel6/src/transforms/shorthand2xccdf.xslt
index 0ef3222..c975973 100644
--- a/rhel6/src/transforms/shorthand2xccdf.xslt
+++ b/rhel6/src/transforms/shorthand2xccdf.xslt
@@ -162,6 +162,21 @@ exclude-result-prefixes="xccdf xhtml">
</xsl:copy>
</xsl:template>
+
+
+ <!-- convenience macros for XCCDF prose -->
+ <xsl:template match="sysctl-desc-macro">
+ The status of the <xhtml:code><xsl:value-of
select="@sysctl"/></xhtml:code> kernel parameter can be queried
+ by running the following command:
+ <xhtml:pre>$ sysctl <xsl:value-of
select="@sysctl"/></xhtml:pre>
+ The output of the command should indicate a value of
<xhtml:code><xsl:value-of select="@value"/></xhtml:code>.
+ </xsl:template>
+
+ <xsl:template match="service-disable-macro">
+ The <xhtml:code><xsl:value-of
select="@service"/></xhtml:code> service can be disabled with the
following command:
+ <xhtml:pre># chkconfig <xsl:value-of select="@service"/>
off</xhtml:pre>
+ </xsl:template>
+
<!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
<!-- (expanding xhtml tags back into the xhtml namespace) -->
<xsl:template match="br">
--
1.7.1