>From 8d7ae49d6632648f69199ffb0a79ef4824082046 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 1 Jan 2013 12:02:19 -0500 Subject: [PATCH 00/17] Updated NIST Mappings Initial patchset to: (1) Create a profile mapping against NIST Low-Low-Low (as defined by CNSS 1253) (2) Updated several NIST mappings, getting specific to sub-components and control enhancements. Used formatting scheme from CNSS Shawn Wells (17): Removed AC-2 mapping from ldap_server_config_olcrootpw Setting a root password does not correspond to AC-2. Removing mapping. Mapped sshd_use_approved_ciphers to AC-3 AC-3 requires FIPS 140-2 certified ciphers Mapped to correct rule (account_temp_expire_date) Former mapping didn't exist, needed to be mapped to account_temp_expire_date Mapped account_temp_expire_date and account_disable_post_pw_expiration to AC-2(2) and AC-2(3) Mapped account_temp_expire_date and account_disable_post_pw_expiration to AC-2(2) and AC-2(3) Mapped audit_sysadmin_actions to AC-2(7)(b) Req calls for tracking/monitoring privileged role assignments, which is done through sudoers Removed "strict" from var_selinux_policy_name There is no strict mode in RHEL6 -- only targeted or mls Removed AC-3 mapping against various rules AC-3 states that DAC and MAC systems must be enabled, and that FIPS used whenever possible. It does *not* call out file permissions, network firewalls, etc... those things are set later (e.g. CM-6, SC-*). Removed AC-4 mappings Removed numberous AC-4 mappings. AC-4 calls for the IS to *enforce* flow control (e.g. turn on iptables, selinux) but does not give configuration guidance. This is enabled in later controls. Updated mappings for AC-6* Updated serveral mappings for AC-6. A key distinction between AC-6 and CM-6/CM-7 is that AC-6 calls for least privilege -- e.g. file permissions -- whereas the later CM-* sections call out least functionality (e.g. only ssh can listen on port 22). Updated mappings for AC-7* Updated mappings to reflect granularity of AC-7(a) vs AC-7(b) Updated mappings of AC-8* Updated to reflect granularity of AC-8(a-c) Updated AC-11* mappings Reflect granularity of AC-11(a), (b), and (1) Initial profile for NIST low/low/low Initial profile for NIST low/low/low Much work left to do! Created auxiliary mappings file for NIST profiles Added mappings against AC-17* Added serveral mappings against the AC-17* requirements, broke them down into sup compartments AC-17(1), AC-17(a), etc Added mappings for AC-18*, disablement of wireless capabilities Updated granularity of existing mappings Finished mappings through AC-* RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +- RHEL6/input/auxiliary/nist_support.xml | 42 ++ RHEL6/input/intro/intro.xml | 15 +- RHEL6/input/profiles/nist-CL-IL-AL.xml | 526 ++++++++++++++++++++ RHEL6/input/profiles/stig-rhel6-server.xml | 2 - RHEL6/input/services/avahi.xml | 8 +- RHEL6/input/services/base.xml | 39 +- RHEL6/input/services/ldap.xml | 6 +- RHEL6/input/services/mail.xml | 8 +- RHEL6/input/services/obsolete.xml | 27 +- RHEL6/input/services/ssh.xml | 6 +- RHEL6/input/system/accounts/banners.xml | 6 +- RHEL6/input/system/accounts/pam.xml | 6 +- RHEL6/input/system/accounts/physical.xml | 18 +- .../accounts/restrictions/account_expiration.xml | 5 +- .../accounts/restrictions/password_expiration.xml | 6 +- .../accounts/restrictions/password_storage.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 8 +- RHEL6/input/system/accounts/session.xml | 2 +- RHEL6/input/system/auditing.xml | 68 ++-- RHEL6/input/system/logging.xml | 8 +- RHEL6/input/system/network/iptables.xml | 18 +- RHEL6/input/system/network/kernel.xml | 6 +- RHEL6/input/system/network/ssl.xml | 8 +- RHEL6/input/system/network/wireless.xml | 10 +- RHEL6/input/system/permissions/execution.xml | 4 +- RHEL6/input/system/permissions/files.xml | 46 +- RHEL6/input/system/permissions/mounting.xml | 14 +- RHEL6/input/system/permissions/partitions.xml | 9 +- RHEL6/input/system/selinux.xml | 9 +- RHEL6/input/system/software/integrity.xml | 2 +- 31 files changed, 747 insertions(+), 189 deletions(-) create mode 100644 RHEL6/input/auxiliary/nist_support.xml create mode 100644 RHEL6/input/profiles/nist-CL-IL-AL.xml