On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
Based on xccdf:sub elements thread:
  https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005104.html

switch on OVAL variables evaluation for Fedora content in XCCDF rules description.

Together with that change, indent content of <pre> elements with one heading tab character.

Tested on Fedora (both make & make validate seems to be working properly).

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

When we originally started authoring content, some 2 years ago, the XCCDF variable inclusion was not working (hence the comments scattered around). Applied your patch locally - everything looks great! Note a few whitespace errors, however this could be how I downloaded:

$ git apply /tmp/j1.patch
/tmp/j1.patch:104: trailing whitespace.
<tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt>
warning: 1 line adds whitespace errors.

Unclear on the purpose of the tabs though. For example:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>	PASS_MIN_DAYS	<b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>	PASS_MIN_DAYS	<b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
+A value greater than 1 day is considered to be sufficient for many environments.

In this case it gives the user the impression these values should be prefaced with a tab. While technically acceptable, in /etc/login.defs everything is defined starting as the first character. Is there a reason for the tab?








0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch

From a05cfa4500f487466605b59053aa94d92a8ce866 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Fri, 21 Mar 2014 15:22:04 +0100
Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
 description

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 Fedora/input/services/ntp.xml                      |  2 +-
 Fedora/input/services/ssh.xml                      | 26 +++++------
 .../accounts/restrictions/password_expiration.xml  | 40 +++++++++--------
 .../system/accounts/restrictions/root_logins.xml   | 22 +++++-----
 Fedora/input/system/permissions/files.xml          | 50 +++++++++++-----------
 Fedora/input/system/settings/disable_prelink.xml   |  4 +-
 Fedora/input/system/software/updating.xml          |  4 +-
 Fedora/transforms/shorthand2xccdf.xslt             |  4 +-
 8 files changed, 76 insertions(+), 76 deletions(-)

diff --git a/Fedora/input/services/ntp.xml b/Fedora/input/services/ntp.xml
index 61fc8c8..5d48733 100644
--- a/Fedora/input/services/ntp.xml
+++ b/Fedora/input/services/ntp.xml
@@ -51,7 +51,7 @@ http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate</rationale>
 <description>To specify a remote NTP server for time synchronization, edit
 the file <tt>/etc/ntp.conf</tt>. Add or correct the following lines,
 substituting the IP or hostname of a remote NTP server for <em>ntpserver</em>:
-<pre>server <i>ntpserver</i></pre>
+<pre>	server <b>ntpserver</b></pre>
 This instructs the NTP software to contact that remote server to obtain time
 data.
 </description>
diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
index ce289b1..7ca7173 100644
--- a/Fedora/input/services/ssh.xml
+++ b/Fedora/input/services/ssh.xml
@@ -28,9 +28,9 @@ information.</description>
 <Rule id="sshd_disable_root_login" severity="medium">
 <title>SSH Root Login Disabled</title>
 <description>The root user should never be allowed to login to a system
-directly over a network. To disable root login via SSH, add or correct the
-following line in <tt>/etc/ssh/sshd_config</tt>:
-<pre>PermitRootLogin no</pre>
+directly over a network. To disable root login via SSH, edit the
+<tt>/etc/ssh/sshd_config</tt> file as follows:
+<pre>	PermitRootLogin <b>no</b></pre>
 </description>
 <rationale>
 Permitting direct root login reduces auditable information about who ran
@@ -44,8 +44,8 @@ root's password.
 <Rule id="sshd_disable_empty_passwords" severity="high">
 <title>SSH Access via Empty Passwords Disabled</title>
 <description>To explicitly disallow remote login from accounts with empty
-passwords, add or correct the following line in <tt>/etc/ssh/sshd_config</tt>:
-<pre>PermitEmptyPasswords no</pre>
+passwords, edit the <tt>/etc/ssh/sshd_config</tt> file as follows:
+<pre>	PermitEmptyPasswords <b>no</b></pre>
 Any accounts with empty passwords should be disabled immediately, and PAM
 configuration should prevent users from being able to assign themselves empty
 passwords.
@@ -64,11 +64,13 @@ misconfiguration elsewhere.
 <description>SSH allows administrators to set an idle timeout interval.
 After this interval has passed, the idle user will be automatically logged out.
 <br /><br />
-To set an idle timeout interval, edit the following line in
-<tt>/etc/ssh/sshd_config</tt> as follows:
-<pre>ClientAliveInterval <b>INTERVAL</b></pre>
+To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file,
+locate the following line:
+<pre>	ClientAliveInterval	<b>INTERVAL</b></pre>
+and correct it to have the form of:
+<pre>	ClientAliveInterval	<b><sub idref="sshd_idle_timeout_value" /></b></pre>
 The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
-minutes, set <b>interval</b> to 900.
+minutes, set <b>INTERVAL</b> to 900.
 <br /><br />
 If a shorter timeout has already been set for the login shell, that value will
 preempt any SSH setting made here. Keep in mind that some processes may stop
@@ -85,9 +87,9 @@ one system leading trivially to compromises on another.
 <Rule id="sshd_set_keepalive">
 <title>SSH Client Alive Count Used</title>
 <description>To ensure the SSH idle timeout occurs precisely when the
-<tt>ClientAliveCountMax</tt> is set, edit <tt>/etc/ssh/sshd_config</tt> as
-follows:
-<pre>ClientAliveCountMax 0</pre>
+<tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt> 
+file as follows:
+<pre>	ClientAliveCountMax <b>0</b></pre>
 </description>
 <rationale>
 This ensures a user login will be terminated as soon as the
diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
index fd4646e..055c408 100644
--- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
+++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
@@ -25,7 +25,7 @@ users 7 days of warnings at login time that their passwords are about to expire.
 For example, for each existing human user <i>USER</i>, expiration parameters
 could be adjusted to a 180 day maximum password age, 7 day minimum password
 age, and 7 day warning period with the following command:
-<pre># chage -M 180 -m 7 -W 7 USER</pre>
+<pre>	# chage -M 180 -m 7 -W 7 USER</pre>
 </description>
 
 <Value id="var_accounts_password_minlen_login_defs" type="number" >
@@ -77,10 +77,10 @@ age, and 7 day warning period with the following command:
 <Rule id="accounts_password_minlen_login_defs" severity="medium">
 <title>Password Minimum Length</title>
 <description>To specify password length requirements for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the following
-lines:
-<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
-<br/><br/>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>	PASS_MIN_LEN	<b>LENGTH</b></pre>
+and correct it to have the form of:
+<pre>	PASS_MIN_LEN	<b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre>
 Nowadays recommended values, considered as secure by various organizations
 focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
 <tt>14 (DoD)</tt> characters for password length requirements.
@@ -109,15 +109,16 @@ counterproductive behavior that may result.
 <Rule id="accounts_minimum_age_login_defs" severity="medium">
 <title>Password Minimum Age</title>
 <description>To specify password minimum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>	PASS_MIN_DAYS	<b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>	PASS_MIN_DAYS	<b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
+A value greater than 1 day is considered to be sufficient for many environments.
 </description>
 <ocil clause="it is not set to the required value">
 To check the minimum password age, run the command:
 <pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
-A value of 1 day is considered to be sufficient for many environments.
+A value greater than 1 day is considered to be sufficient for many environments.
 </ocil>
 <rationale>
 Setting the minimum password age protects against users cycling
@@ -131,15 +132,16 @@ requirement.
 <Rule id="accounts_maximum_age_login_defs" severity="medium">
 <title>Password Maximum Age</title>
 <description>To specify password maximum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item appropriately:
-<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
-A value of 180 days is sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>	PASS_MAX_DAYS	<b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>	PASS_MAX_DAYS	<b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre>
+A value less than 180 days is sufficient for many environments.
 </description>
 <ocil clause="it is not set to the required value">
 To check the maximum password age, run the command:
 <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
-A value of 180 days is sufficient for many environments.
+A value less than 180 days is sufficient for many environments.
 </ocil>
 <rationale>
 Setting the password maximum age ensures users are required to
@@ -155,11 +157,11 @@ location subject to physical compromise.</rationale>
 <title>Password Warning Age</title>
 <description>To specify how many days prior to password
 expiration that a warning will be issued to users,
-edit the file <tt>/etc/login.defs</tt> and add or correct
- the following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_WARN_AGE <i>DAYS</i></pre>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>	PASS_WARN_AGE	<b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>	PASS_WARN_AGE	<b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
 A value of 7 days would be nowadays considered to be a standard.
-<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
 </description>
 <ocil clause="it is not set to the required value">
 To check the password warning age, run the command:
diff --git a/Fedora/input/system/accounts/restrictions/root_logins.xml b/Fedora/input/system/accounts/restrictions/root_logins.xml
index c04dc22..b299d54 100644
--- a/Fedora/input/system/accounts/restrictions/root_logins.xml
+++ b/Fedora/input/system/accounts/restrictions/root_logins.xml
@@ -37,9 +37,7 @@ only allows the root user to login at the console physically attached to the
 machine. To prevent root from logging in, remove the contents of this file.
 To prevent direct root logins, remove the contents of this file by typing the
 following command:
-<pre>
-echo > /etc/securetty
-</pre>
+<pre>	echo > /etc/securetty</pre>
 </description>
 <ocil clause="the /etc/securetty file is not empty">
 To ensure root may not directly login to the system over physical consoles,
@@ -61,10 +59,10 @@ by security standards.
 <description>
 To restrict root logins through the (deprecated) virtual console devices,
 ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
-<pre>vc/1
-vc/2
-vc/3
-vc/4</pre>
+<pre>	vc/1
+	vc/2
+	vc/3
+	vc/4</pre>
 </description>
 <ocil clause="root login over virtual console devices is permitted">
 To check for virtual console entries which permit root login, run the
@@ -85,8 +83,8 @@ using the root account.
 <title>Serial Port Root Logins Restricted</title>
 <description>To restrict root logins on serial ports,
 ensure lines of this form do not appear in <tt>/etc/securetty</tt>:
-<pre>ttyS0
-ttyS1</pre>
+<pre>	ttyS0
+	ttyS1</pre>
 <!-- TODO: discussion/description of serial port -->
 </description>
 <ocil clause="root login over serial ports is permitted">
@@ -134,7 +132,7 @@ in <tt>/etc/passwd</tt>. System accounts are those user accounts with a user ID
 500. The user ID is stored in the third field.
 If any system account <i>SYSACCT</i> (other than root) has a login shell,
 disable it with the command:
-<pre># usermod -s /sbin/nologin <i>SYSACCT</i></pre>
+<pre>	# usermod -s /sbin/nologin <i>SYSACCT</i></pre>
 </description>
 <ocil clause="any system account (other than root) has a login shell">
 To obtain a listing of all users,
@@ -185,8 +183,8 @@ access to root privileges in an accountable manner.
 <title>Root Path Is Vendor Default</title>
 <description>
 Assuming root shell is bash, edit the following files:
-<pre>~/.profile</pre>
-<pre>~/.bashrc</pre>
+<pre>	~/.profile</pre>
+<pre>	~/.bashrc</pre>
 Change any <tt>PATH</tt> variables to the vendor default for root and remove any
 empty <tt>PATH</tt> entries or references to relative paths.
 </description>
diff --git a/Fedora/input/system/permissions/files.xml b/Fedora/input/system/permissions/files.xml
index b365f1c..dba01f4 100644
--- a/Fedora/input/system/permissions/files.xml
+++ b/Fedora/input/system/permissions/files.xml
@@ -12,17 +12,16 @@ correctly and restrictively.
 <description>System-wide shared library files, which are linked to executables
 during process load time or run time, are stored in the following directories
 by default:
-<pre>/lib
-/lib64
-/usr/lib
-/usr/lib64
-</pre>
+<pre>	/lib
+	/lib64
+	/usr/lib
+	/usr/lib64</pre>
 Kernel modules, which can be added to the kernel during runtime, are stored in
 <tt>/lib/modules</tt>. All files in these directories should not be
 group-writable or world-writable. If any file in these directories is found to
 be group-writable or world-writable, correct its permission with the following
 command:
-<pre># chmod go-w <i>FILE</i></pre>
+<pre>	# chmod go-w <i>FILE</i></pre>
 </description>
 <rationale>Files from shared library directories are loaded into the address
 space of processes (including privileged ones) or of the kernel itself at 
@@ -38,17 +37,16 @@ system.
 <description>System-wide shared library files, which are linked to executables
 during process load time or run time, are stored in the following directories
 by default:
-<pre>/lib
-/lib64
-/usr/lib
-/usr/lib64
-</pre>
+<pre>	/lib
+	/lib64
+	/usr/lib
+	/usr/lib64</pre>
 Kernel modules, which can be added to the kernel during runtime, are also
 stored in <tt>/lib/modules</tt>. All files in these directories should be owned
 by the <tt>root</tt> user. If the directory, or any file in these directories,
 is found to be owned by a user other than root correct its ownership with the
 following command:
-<pre># chown root <i>FILE</i></pre>
+<pre>	# chown root <i>FILE</i></pre>
 </description>
 <rationale>Files from shared library directories are loaded into the address 
 space of processes (including privileged ones) or of the kernel itself at 
@@ -62,16 +60,16 @@ runtime. Proper ownership is necessary to protect the integrity of the system.
 <title>System Executables Have Restrictive Permissions</title>
 <description>
 System executables are stored in the following directories by default:
-<pre>/bin
-/usr/bin
-/usr/local/bin
-/sbin
-/usr/sbin
-/usr/local/sbin</pre>
+<pre>	/bin
+	/usr/bin
+	/usr/local/bin
+	/sbin
+	/usr/sbin
+	/usr/local/sbin</pre>
 All files in these directories should not be group-writable or world-writable.
 If any file <i>FILE</i> in these directories is found to be group-writable or
 world-writable, correct its permission with the following command:
-<pre># chmod go-w <i>FILE</i></pre>
+<pre>	# chmod go-w <i>FILE</i></pre>
 </description>
 <rationale>System binaries are executed by privileged users, as well as system
 services, and restrictive permissions are necessary to ensure execution of
@@ -85,16 +83,16 @@ these programs cannot be co-opted.
 <title>System Executables Have Root Ownership</title>
 <description>
 System executables are stored in the following directories by default:
-<pre>/bin
-/usr/bin
-/usr/local/bin
-/sbin
-/usr/sbin
-/usr/local/sbin</pre>
+<pre>	/bin
+	/usr/bin
+	/usr/local/bin
+	/sbin
+	/usr/sbin
+	/usr/local/sbin</pre>
 All files in these directories should be owned by the <tt>root</tt> user. If
 any file <i>FILE</i> in these directories is found to be owned by a user other
 than root, correct its ownership with the following command:
-<pre># chown root <i>FILE</i></pre>
+<pre>	# chown root <i>FILE</i></pre>
 </description>
 <rationale>System binaries are executed by privileged users as well as system
 services, and restrictive permissions are necessary to ensure that their
diff --git a/Fedora/input/system/settings/disable_prelink.xml b/Fedora/input/system/settings/disable_prelink.xml
index a5871a6..079e68c 100644
--- a/Fedora/input/system/settings/disable_prelink.xml
+++ b/Fedora/input/system/settings/disable_prelink.xml
@@ -4,10 +4,10 @@
 The prelinking feature changes binaries in an attempt to decrease their startup
 time. In order to disable it, change or add the following line inside the file
 <tt>/etc/sysconfig/prelink</tt>:
-<pre>PRELINKING=no</pre>
+<pre>	PRELINKING=no</pre>
 Next, run the following command to return binaries to a normal, non-prelinked
 state:
-<pre># /sbin/prelink -ua</pre>
+<pre>	# /sbin/prelink -ua</pre>
 </description>
 <rationale>
 The prelinking feature can interfere with the operation of checksum integrity
diff --git a/Fedora/input/system/software/updating.xml b/Fedora/input/system/software/updating.xml
index 84de806..3b9f6a3 100644
--- a/Fedora/input/system/software/updating.xml
+++ b/Fedora/input/system/software/updating.xml
@@ -22,7 +22,7 @@ checking of an RPM package's signature always occurs prior to its
 installation. To configure yum to check package signatures before installing
 them, ensure the following line appears in <tt>/etc/yum.conf</tt> in
 the <tt>[main]</tt> section:
-<pre>gpgcheck=1</pre>
+<pre>	gpgcheck=1</pre>
 </description>
 <ocil clause="GPG checking is not enabled">
 To determine whether <tt>yum</tt> is configured to use <tt>gpgcheck</tt>,
@@ -46,7 +46,7 @@ protects against malicious tampering.
 <title>gpgcheck Enabled For All Yum Package Repositories</title>
 <description>To ensure signature checking is not disabled for
 any repos, remove any lines from files in <tt>/etc/yum.repos.d</tt> of the form:
-<pre>gpgcheck=0</pre>
+<pre>	gpgcheck=0</pre>
 </description>
 <ocil clause="GPG checking is disabled">
 To determine whether <tt>yum</tt> has been configured to disable
diff --git a/Fedora/transforms/shorthand2xccdf.xslt b/Fedora/transforms/shorthand2xccdf.xslt
index c0f4546..a0da413 100644
--- a/Fedora/transforms/shorthand2xccdf.xslt
+++ b/Fedora/transforms/shorthand2xccdf.xslt
@@ -383,12 +383,12 @@
 
   <xsl:template match="service-disable-macro">
     The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be disabled with the following command:
-    <xhtml:pre># systemctl disable <xsl:value-of select="@service"/>.service</xhtml:pre>
+    <xhtml:pre>	# systemctl disable <xsl:value-of select="@service"/>.service</xhtml:pre>
   </xsl:template>
 
   <xsl:template match="service-enable-macro">
     The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be enabled with the following command:
-    <xhtml:pre># systemctl enable <xsl:value-of select="@service"/>.service</xhtml:pre>
+    <xhtml:pre>	# systemctl enable <xsl:value-of select="@service"/>.service</xhtml:pre>
   </xsl:template>
 
   <xsl:template match="service-disable-check-macro">
-- 1.8.3.1


-- 
Shawn Wells
Director, Innovation Programs
shawn@redhat.com | 443.534.0130
@shawndwells