Signed-off-by: David Smith dsmith@eclipse.ncsc.mil --- RHEL6/input/system/accounts/pam.xml | 9 ++++++--- RHEL6/input/system/accounts/physical.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 2 +- RHEL6/input/system/auditing.xml | 8 +++++++- RHEL6/input/system/permissions/files.xml | 4 ++-- RHEL6/transforms/shorthand2xccdf.xslt | 4 ++-- 6 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index b432083..12f2ade 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -238,6 +238,7 @@ Look for the value of the <tt>maxrepeat</tt> parameter. The DoD requirement is <rationale> Passwords with excessive repeating characters may be more vulnerable to password-guessing attacks. </rationale> +<ident cce="TODO" /> <ref disa="366"/> </Rule>
@@ -272,7 +273,7 @@ search space. usage of uppercase letters in a password. When set to a negative number, any password will be required to contain that many uppercase characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each uppercase character. -Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of a digit in passwords. +Add <tt>ucredit=-1</tt> after pam_cracklib.so to require use of an upper case character in passwords. </description> <ocil clause="ucredit is not found or not set to the required value"> To check how many uppercase characters are required in a password, run the following command: @@ -507,8 +508,8 @@ This is the default. <ocil clause="it does not"> Inspect the <tt>password</tt> section of <tt>/etc/pam.d/system-auth</tt> and ensure that the <tt>pam_unix.so</tt> module includes the argument -<tt>sha512</tt>. -<tt>$ grep sha512 /etc/pam.d/system-auth</tt> +<tt>sha512</tt>: +<pre>$ grep sha512 /etc/pam.d/system-auth</pre> </ocil> <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. @@ -534,6 +535,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the following line appears: Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> <!-- <oval id="accounts_password_hashing_algorithm" /> --> +<ident cce="TODO" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121024"/> </Rule> @@ -555,6 +557,7 @@ in the <tt>[default]</tt> section: Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> <!-- <oval id="accounts_password_hashing_algorithm" /> --> +<ident cce="TODO" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121026"/> </Rule> diff --git a/RHEL6/input/system/accounts/physical.xml b/RHEL6/input/system/accounts/physical.xml index 013bb0b..99c9fef 100644 --- a/RHEL6/input/system/accounts/physical.xml +++ b/RHEL6/input/system/accounts/physical.xml @@ -156,7 +156,7 @@ The commands following the line below will be executed when the key sequence is A locally logged-in user who presses Ctrl-Alt-Del, when at the console, can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term -loss of availability systems due to unintentional reboot. +loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Del sequence is reduced because the user will be prompted before any action is taken. diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/RHEL6/input/system/accounts/restrictions/root_logins.xml index cc56c6d..cff8032 100644 --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml @@ -154,7 +154,7 @@ this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed. </description> <ocil clause="any account other than root has a UID of 0"> -To list all password file entries for accounts with UID 0: +To list all password file entries for accounts with UID 0, run the following command: <pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre> This should print only one line, for the user root. </ocil> diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml index c49c16b..6943c14 100644 --- a/RHEL6/input/system/auditing.xml +++ b/RHEL6/input/system/auditing.xml @@ -304,6 +304,7 @@ minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, <tt>keep_logs</tt> can be employed.</rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" /> <ref nist="AU-1(b),AU-4,AU-11" /> <tested by="DS" on="20121024"/> @@ -354,6 +355,7 @@ disk space is starting to run low: </ocil> <rationale>Notifying administrators of an impending disk space problem may allow them to take corrective action prior to any disruption.</rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/> <ref nist="AU-1(b),AU-4" disa="140,143,1339" /> <tested by="DS" on="20121024"/> @@ -394,6 +396,7 @@ when disk space has run low: audit records. If a separate partition or logical volume of adequate size is used, running low on space for audit records should never occur. </rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" /> <ref nist="AU-1(b),AU-4" disa="140,1343" /> <tested by="DS" on="20121024"/> @@ -416,6 +419,7 @@ account when it needs to notify an administrator: </ocil> <rationale>Email sent to the root account is typically aliased to the administrators of the system, who can take appropriate action.</rationale> +<ident cce="TODO" /> <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" /> <ref nist="AU-1(b),AU-4" disa="139,144" /> </Rule> @@ -680,7 +684,7 @@ audited.</rationale> <Rule id="audit_logs_permissions"> <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title> <description> -Change the mode of the audit log files: +Change the mode of the audit log files with the following command: <pre># chmod 0640 <i>audit_file</i></pre> </description> <ocil clause="any are more permissive"> @@ -691,6 +695,7 @@ Audit logs must be mode 0640 or less permissive. <rationale> If users can write to audit logs, audit trails can be modified or destroyed. </rationale> +<ident cce="TODO" /> <oval id="file_permissions_var_log_audit" /> <ref nist="AC-6,AU-1(b),AU-9" disa="166" /> <tested by="DS" on="20121024"/> @@ -706,6 +711,7 @@ If users can write to audit logs, audit trails can be modified or destroyed. </ocil> <rationale>Failure to give ownership of the audit log file(s) to root allows the designated owner, and unauthorized users, potential access to sensitive information.</rationale> +<ident cce="TODO" /> <oval id="file_ownership_var_log_audit" /> <ref nist="AC-6,AU-1(b),AU-9" disa="166" /> <tested by="DS" on="20121024"/> diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index d2b94ab..2d05ef2 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -86,7 +86,7 @@ on the system. Protection of this file is important for system security.</ration <Rule id="perms_group_file" severity="medium"> <title>Verify Permissions on <tt>group</tt> File</title> <description><fileperms-desc-macro file="/etc/group" perms="644"/></description> -<ocil><fileowner-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil> +<ocil><fileperms-check-macro file="/etc/group" perms="-rw-r--r--"/></ocil> <rationale>The <tt>/etc/group</tt> file contains information regarding groups that are configured on the system. Protection of this file is important for system security.</rationale> <ident cce="26954-8" /> @@ -135,7 +135,7 @@ is critical for system security.</rationale> <title>Verify User Who Owns <tt>passwd</tt> File</title> <description><fileowner-desc-macro file="/etc/passwd" owner="root"/></description> <ocil><fileowner-check-macro file="/etc/passwd" owner="root"/></ocil> -<rationale>The <tt>/etc/passwd</tt> contains information about the users that are configured on +<rationale>The <tt>/etc/passwd</tt> file contains information about the users that are configured on the system. Protection of this file is critical for system security.</rationale> <ident cce="26953-0" /> <oval id="file_owner_etc_passwd" /> diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index 708e593..507238e 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -237,7 +237,7 @@ exclude-result-prefixes="xccdf xhtml dc"> <!-- convenience macros for XCCDF prose --> <xsl:template match="sysctl-desc-macro"> To set the runtime status of the xhtml:code<xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter, - run the following command. + run the following command: <xhtml:pre xml:space="preserve"># sysctl -w <xsl:value-of select="@sysctl"/>=<xsl:value-of select="@value"/></xhtml:pre>
<!-- The following text could also be included conditionally, if the defaultness of the sysctl were indicated. --> @@ -249,7 +249,7 @@ exclude-result-prefixes="xccdf xhtml dc"> The status of the xhtml:code<xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter can be queried by running the following command: <xhtml:pre xml:space="preserve">$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre> - The output of the command should indicate a value of xhtml:code<xsl:value-of select="@value"/></xhtml:code>: + The output of the command should indicate a value of xhtml:code<xsl:value-of select="@value"/></xhtml:code>. If this value is not the default value, investigate how it could have been adjusted at runtime, and verify it is not set improperly in xhtml:code/etc/sysctl.conf</xhtml:code>.