>From 7178840030a743f77c3ecacb50403a1c5972675e Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 14 Apr 2013 03:43:26 -0400 Subject: [PATCH 1/5] Updated XCCDF and OVAL of groupowner_rsyslog_files - Changed XCCDF name to rsyslog_files_groupownership, to stay compliant with naming scheme for other rsyslog_* rules - Updated file pattern match to '.', as not all log files have a *.log syntax Testing: [shawn@rhel6 checks]$ sudo sh -c "chgrp -R root /var/log" [shawn@rhel6 checks]$ ./testcheck.py rsyslog_files_groupownership.xml Evaluating with OVAL tempfile : /tmp/rsyslog_files_groupownershipvDb8cx.xml Definition oval:scap-security-guide.testing:def:100: true Evaluation done. [shawn@rhel6 checks]$ sudo sh -c "chgrp shawn /var/log/messages" [shawn@rhel6 checks]$ ./testcheck.py rsyslog_files_groupownership.xml Evaluating with OVAL tempfile : /tmp/rsyslog_files_groupownership5hwL0x.xml Definition oval:scap-security-guide.testing:def:100: false Evaluation done. --- RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/auxiliary/stig_overlay.xml | 2 +- .../input/checks/rsyslog_files_groupownership.xml | 24 ++++++++++++++----- RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL6/input/system/logging.xml | 2 +- 7 files changed, 23 insertions(+), 13 deletions(-) diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml index d4a9cf0..fab8b62 100644 --- a/RHEL6/input/auxiliary/alt-titles-stig.xml +++ b/RHEL6/input/auxiliary/alt-titles-stig.xml @@ -344,7 +344,7 @@ The system's system logging services must be enabled. All rsyslog-generated log files must be owned by root. - +<title rule="rsyslog_files_groupownership" shorttitle="Ensure Log Files Are Owned By Appropriate Group"> All rsyslog-generated log files must be group-owned by root. diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 2c553bd..2e0b5b4 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -297,7 +297,7 @@ <overlay owner="disastig" ruleid="userowner_rsyslog_files" ownerid="RHEL-06-000133" disa="1314" severity="medium"> <title>All rsyslog-generated log files must be owned by root. - + All rsyslog-generated log files must be group-owned by root. diff --git a/RHEL6/input/checks/rsyslog_files_groupownership.xml b/RHEL6/input/checks/rsyslog_files_groupownership.xml index 729f4b2..c28b257 100644 --- a/RHEL6/input/checks/rsyslog_files_groupownership.xml +++ b/RHEL6/input/checks/rsyslog_files_groupownership.xml @@ -1,6 +1,5 @@ - + Confirm Existence and Permissions of System Log Files @@ -11,11 +10,22 @@ appropriate group. - + - + + + + + + + + /var/log + . + + + + + 0 + diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index 2a7565a..48a0358 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -102,7 +102,7 @@ - - -