>From fa7d1a65b78e8d7f290080d36ef2513cbd559e2f Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 10 Jan 2013 09:48:58 -0500 Subject: [PATCH 16/20] Mapped CM-6 (significant change) - CM-6(a) calls for the establishment of security config settings, which would apply to EVERY rule in the prose guide. To cumbersome to map this! Removed all existing mappings and created a "applies to everything" rule in auxiliary. Plan is to adjust Make process to tag everyrule with whatever NIST mappings are attached. Much easier to maintain moving forward. - CM-6(b) calls for the implimentation of CM-6(a). Procedural. - CM-6(c) documents exceptions, procedural. - CM-6(d) calls for monitoring of controls. Mapped to AIDE and RPM integrity checks (yeah, RPM integrity checks are kind of a stretch. Will re-evaluate if other NIST controls more directly apply). --- RHEL6/input/auxiliary/nist_support.xml | 9 +++- RHEL6/input/profiles/nist-CL-IL-AL.xml | 11 +++- RHEL6/input/services/avahi.xml | 12 ++-- RHEL6/input/services/base.xml | 54 +++++++++--------- RHEL6/input/services/cron.xml | 10 ++-- RHEL6/input/services/dhcp.xml | 18 +++--- RHEL6/input/services/dns.xml | 20 ++++---- RHEL6/input/services/ftp.xml | 20 ++++---- RHEL6/input/services/http.xml | 58 ++++++++++---------- RHEL6/input/services/ldap.xml | 2 +- RHEL6/input/services/mail.xml | 4 +- RHEL6/input/system/accounts/banners.xml | 8 ++-- RHEL6/input/system/accounts/pam.xml | 6 +- RHEL6/input/system/accounts/physical.xml | 16 +++--- .../accounts/restrictions/password_expiration.xml | 8 ++-- .../accounts/restrictions/password_storage.xml | 2 +- .../system/accounts/restrictions/root_logins.xml | 6 +- RHEL6/input/system/accounts/session.xml | 10 ++-- RHEL6/input/system/auditing.xml | 14 +++--- RHEL6/input/system/logging.xml | 16 +++--- RHEL6/input/system/network/iptables.xml | 12 ++-- RHEL6/input/system/network/ipv6.xml | 16 +++--- RHEL6/input/system/network/kernel.xml | 10 ++-- RHEL6/input/system/network/network.xml | 6 +- RHEL6/input/system/network/ssl.xml | 10 ++-- RHEL6/input/system/network/uncommon.xml | 8 ++-- RHEL6/input/system/network/wireless.xml | 4 +- RHEL6/input/system/permissions/execution.xml | 6 +- RHEL6/input/system/permissions/files.xml | 38 +++++++------- RHEL6/input/system/permissions/mounting.xml | 32 ++++++------ RHEL6/input/system/permissions/partitions.xml | 4 +- RHEL6/input/system/selinux.xml | 14 +++--- RHEL6/input/system/software/disk_partitioning.xml | 10 ++-- RHEL6/input/system/software/integrity.xml | 12 ++-- 34 files changed, 250 insertions(+), 236 deletions(-) diff --git a/RHEL6/input/auxiliary/nist_support.xml b/RHEL6/input/auxiliary/nist_support.xml index b929fe3..538c443 100644 --- a/RHEL6/input/auxiliary/nist_support.xml +++ b/RHEL6/input/auxiliary/nist_support.xml @@ -14,7 +14,7 @@ automated means. This requirement is procedural, and can not be met through automated means. - + @@ -39,4 +39,11 @@ This requirement is permanent not a finding. No fix is required. + +Requirement Applies to All Rules +The following requirements apply to all rules +These are generic NIST requirements, and apply to all rules + + + diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml index e74ba27..52091f0 100644 --- a/RHEL6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml @@ -275,9 +275,16 @@ assurance." requirement, and perhaps using audit+AIDE to track changes to relevant files --> + + + +